TradeHub OS Privacy Policy

1. Who We Are

TradeHub OS is a CRM and business management platform built for UK tradespeople. The platform is operated by TradeHub OS.

For data protection purposes, TradeHub OS is the data controller responsible for your personal data.

If you have any questions about this Privacy Policy or how we handle your data, contact us at: privacy@tradehubos.co.uk

2. What Data We Collect

2.1 Account and Profile Data

When you create a TradeHub OS account, we collect:

• Full name and business name
• Email address
• Phone number
• Business address and postcode
• Trade type (e.g. plumber, electrician, builder)
• Payment information (processed securely by Stripe — we do not store card details)

2.2 Business Data You Enter

As you use TradeHub OS, we store the data you input, including:

• Customer names, phone numbers, and email addresses
• Job details, quotes, and invoices
• Lead information and pipeline data
• Photos and documents uploaded to jobs
• Communications logs (SMS, email, and messaging records)
• Revenue and financial data you enter

2.3 Usage and Technical Data

We automatically collect certain technical data when you use the platform:

• IP address and device information
• Browser type and operating system
• Pages visited and features used (via PostHog analytics, hosted in the EU)
• Session recordings for UX improvement (inputs masked — no sensitive data captured)
• Error logs for technical support purposes

2.4 Onboarding Quiz Data

If you complete our onboarding quiz at tradehubos.co.uk/start, we may collect:

• Trade type and business size answers
• Name and phone number, if voluntarily provided at the lead capture step
• This data is used to personalise your plan recommendation and may be used to follow up if you do not complete signup

3. How We Use Your Data

We use your data for the following purposes:

• To provide and operate the TradeHub OS platform and its features
• To process payments and manage your subscription via Stripe
• To send automated SMS and email notifications on your behalf to your customers (e.g. quote notifications, job confirmations, invoice reminders, review requests)
• To capture and manage leads, including leads from connected Facebook and Instagram advertising campaigns
• To send and receive messages with your customers through connected channels (Facebook Messenger, Instagram, WhatsApp) where you have enabled them
• To sync data with third-party services you connect (Google Calendar, Google Drive, Gmail) — only with your explicit authorisation
• To operate the TradeHub OS AI Copilot — your business data is used as context for AI responses but is not used to train AI models
• To send you platform-related communications including trial reminders, feature updates, and billing notifications
• To analyse platform usage and improve our product using anonymised analytics data
• To comply with legal obligations and enforce our Terms of Service

4. Legal Basis for Processing

Under UK GDPR, we process your data on the following legal bases:

• Contract performance — to deliver the TradeHub OS service you have subscribed to
• Legitimate interests — to improve our platform, prevent fraud, and ensure security
• Consent — for optional integrations such as Meta (Facebook/Instagram), WhatsApp, and Google services, and for marketing communications
• Legal obligation — where required by law

5. Third-Party Services

TradeHub OS integrates with the following third-party services. Each has its own privacy policy:

5.1 Stripe

Payment processing. We pass your billing information to Stripe to process subscription payments. Stripe stores your payment card details securely. We do not store card numbers. See: stripe.com/privacy

5.2 Twilio

SMS communications. We use Twilio to send automated SMS messages to your customers on your behalf (quote notifications, job confirmations, missed-call text-backs, review requests). Your customers' phone numbers are passed to Twilio for this purpose. See: twilio.com/legal/privacy

5.3 Resend

Email communications. We use Resend to send automated emails. Your customers' email addresses are passed to Resend for this purpose. See: resend.com/legal/privacy-policy

5.4 Google AI (Gemini)

The TradeHub OS Copilot feature uses Google's Gemini API, accessed via the Lovable AI gateway. When you use Copilot, the messages you type and the related business data you reference (such as leads, jobs, quotes, customers and revenue figures) are sent to the AI provider to generate responses. This data is not used to train the AI provider's models. We ask for your explicit consent inside the app before any data is sent to the AI service for the first time, and Copilot remains disabled until you agree. The rest of TradeHub OS works without it. See: ai.google.dev/gemini-api/terms and policies.google.com/privacy

5.5 ElevenLabs

Voice synthesis. The Copilot voice feature uses ElevenLabs to convert text responses to audio. Text content is sent to ElevenLabs for this purpose. See: elevenlabs.io/privacy

5.6 PostHog (EU)

Product analytics. We use PostHog, hosted in the EU region, to understand how the platform is used. Inputs are masked in session recordings and no sensitive data is captured. See: posthog.com/privacy

5.7 Supabase

Infrastructure and database. Your data is stored in Supabase's EU-hosted infrastructure with row-level security. See: supabase.com/privacy

6. Meta Integrations (Facebook, Instagram, Messenger, WhatsApp)

TradeHub OS offers optional integrations with Meta platforms to help you capture leads, measure advertising performance, and communicate with your customers. These integrations are only active if you choose to connect your Meta accounts, and you can disconnect them at any time.

6.1 What we access

• Facebook Lead Ads: when you connect your Facebook Page, we receive lead form submissions in real time so they appear in your CRM pipeline for follow-up.
• Ad performance data: we read advertising metrics (such as ad spend) to display return-on-investment reporting inside your account.
• Messaging: where enabled, we send and receive messages with your customers via Facebook Messenger, Instagram, and WhatsApp, and display them in your Communications inbox.

6.2 How we use it

Data received through Meta integrations is used solely to provide the CRM, advertising, and messaging features you have enabled. We do not sell this data, and we do not use it for any purpose other than operating the features you have connected.

6.3 WhatsApp messaging window

WhatsApp messaging is subject to Meta's policies, including the 24-hour customer service messaging window. Outside this window, only pre-approved message templates may be sent.

Your use of these features is also subject to the Meta Platform Terms and Meta's own Privacy Policy.

7. Google User Data

TradeHub OS integrates with Google services (Gmail, Google Calendar, and Google Drive) to provide core CRM functionality. This section explains exactly how we access, use, store, and protect Google user data, in compliance with the Google API Services User Data Policy, including the Limited Use requirements.

7.1 What Google data we access

When you connect your Google account to TradeHub OS, you grant us permission to access the following, and only the following:

• Gmail (gmail.send scope): We can send emails on your behalf when you click "Send" inside TradeHub OS. We do not read, list, download, or store any emails in your Gmail inbox, sent folder, drafts, or any other Gmail folder. We do not access your contacts or email metadata.
• Google Calendar (calendar.events.owned scope): We create and manage calendar events that TradeHub OS itself creates inside a dedicated calendar named "TradeHub Jobs". We do not access, read, modify, or display any events, calendars, or scheduling data created outside of TradeHub OS.
• Google Drive (drive.file scope): We can create folders and upload files to your Google Drive only when you explicitly click "Export to Drive" inside TradeHub OS. We can only access files that TradeHub OS itself has created. We cannot browse, list, read, or modify any other files in your Drive.

7.2 Limited Use disclosure

TradeHub OS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for serving advertisements, and we do not transfer or sell Google user data to third parties except as necessary to provide or improve the user-facing features, to comply with applicable law, or as part of a merger or acquisition. Google user data is never used to train AI or machine learning models.

8. Data Storage and Security

• Your data is stored on EU-hosted Supabase infrastructure.
• All data is transmitted over HTTPS and protected with row-level security so that you can only access your own data.
• Job photos and uploaded documents are stored for a maximum of 14 days and then automatically deleted, unless you have exported them to your connected Google Drive.
• We retain your account and business data for the duration of your subscription and for 90 days after cancellation, after which it is permanently deleted unless we are required to retain it by law.

9. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data (rectification)
• Request deletion of your data (erasure)
• Request a copy of your data in a portable format (portability)
• Object to or restrict certain processing
• Withdraw consent for optional integrations at any time

To exercise any of these rights, contact us at privacy@tradehubos.co.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Children

TradeHub OS is a business tool intended for use by people aged 18 and over operating a legitimate UK trade business. We do not knowingly collect data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the platform. The "Last updated" date at the top of this policy reflects the most recent revision.