Privacy Policy

TradeDraft is a sole-trader business based in England. This policy explains what personal data we collect, why, and your rights over it. Questions: hello@tradedraft.co.uk, Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset BH16 6FA.

What we collect and why

"Lawful basis" below is the legal reason we're allowed to hold each item, mostly contract, meaning we need it to provide the service you've signed up for.

• Account email and password: to create your account and sign you in. Your password is stored only as a secure one-way hash, never in readable form. Lawful basis: contract.
• Quote, company and logo data you enter into TradeDraft, to produce your documents. Lawful basis: contract.
• Payment details are handled by Stripe. We never see or store your card number; we keep only a Stripe customer reference and your subscription status.
• Anonymised usage data: to understand and improve the product. Lawful basis: legitimate interests.
• Essential sign-in storage in your browser to keep you signed in. No advertising or third-party tracking cookies.

Your TradeDraft data

When you build quotes in TradeDraft, here is exactly what happens to your data:

• What we store:
  • your account email;
  • your company profile: business details, default pricing and your logo;
  • each saved quote: its reference, your client's name and contact details, the job details and the figures;
  • files you attach to a job: photos, receipts, and notes & files you upload;
  • invoices raised from an accepted quote, and their payment status;
  • your subscription status.
  Your internal pricing (overheads, markup and margin) is yours alone; your client only ever sees the finished quote.
• Where: in our database at Supabase, hosted in the UK (London region), encrypted in transit (HTTPS) and at rest (AES-256). Access is locked to your account, so no other user can ever see your data.
• Online acceptance records. If you send a quote by accept link and your customer accepts it, we store their typed name, the date and time, and their device's IP address and browser as the record of acceptance. That record is held for you, as part of your quote data. Lawful basis: legitimate interests, namely to create a reliable record evidencing the agreement, so you (and we) can show what was accepted if a dispute arises; kept for up to 6 years (see "How long we keep it" below).
• Deleting it: delete any single quote from Your Quotes, or use Delete my account in Settings. Your personal details, company profile and logo, drafts, saved quotes, rate book and settings are removed immediately, and any subscription is cancelled. Records of quotes your customers formally accepted, and of invoices that were paid, are kept for 6 years as legal and financial evidence (see “How long we keep it”), then permanently deleted. You can also email hello@tradedraft.co.uk and we'll do it for you.

Who processes your data

We use a small number of trusted processors: Supabase (database and authentication, UK-hosted), Stripe (subscription payments), Payhip (checkout for the document-template shop, as merchant of record), Netlify (hosting), Cloudflare (privacy-friendly, cookieless website analytics), MailerLite (guide sign-ups and our mailing list) and Resend (transactional email, such as acceptance and account notifications). We do not sell your data to anyone, ever.

Some of these providers process limited data outside the UK. In particular, Stripe may process payment data in the US. Where that happens it's covered by UK-approved safeguards (the UK extension to the EU–US Data Privacy Framework, or standard contractual clauses).

When you store your client's details in a quote, you are the data controller of that information and TradeDraft acts as your data processor. See the "Data processing" section of our Terms for what that means.

How long we keep it

For as long as you have an account. If you cancel, we keep your quotes for 90 days in case you return, then delete them. Where a quote has been formally accepted by a customer, or an invoice has been paid, we keep that record (and its acceptance or payment details) for 6 years as evidence of the agreement — the UK contract-limitation period and HMRC's record-keeping rules — whether you cancel or delete your account. Deleting your account immediately erases your personal details, drafts, saved quotes, rate book and settings; those accepted-quote and paid-invoice records are the only thing kept, unlinked from your account, used only to settle a dispute, and permanently deleted after 6 years. Billing records are held by our payment provider for as long as the law requires. Anonymous statistics (which can't identify you) may be kept indefinitely.

Your rights

Under UK GDPR you can access, correct, export or delete your data, and object to or restrict certain processing. You can delete your account yourself from Settings, or email us. You can complain to the Information Commissioner's Office at ico.org.uk.

Last updated: 2 July 2026