Privacy Policy

TradeDraft is a sole-trader business based in England. This policy explains what personal data we collect, why, and your rights over it. Questions: hello@tradedraft.co.uk, Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset BH16 6FA.

If you're the customer who received a quote

Most of this page is written for the tradespeople who use TradeDraft. This section is for you: someone who was sent a quote and asked to accept it online.

• Who holds your data. The tradesperson who sent you the quote decides what happens to your details — in data-protection terms they are the controller. TradeDraft only stores and processes it on their instructions, as their processor. We do not use your details for our own purposes, and we never sell them.
• What we hold about you. Whatever your tradesperson put in the quote (typically your name, the job address and what the work involves), and — if you accept online — your typed name, the date and time, and your device's IP address and browser. That last set exists so both of you have a record of what was agreed and when.
• Why, and for how long. An accepted quote is a formed contract, and the acceptance record is the evidence of it. We keep accepted quotes and their acceptance records for six years, which is the period a dispute about a contract can normally be brought. Quotes that are never accepted are deleted 90 days after they expire.
• Where it is. In a UK-hosted database (Supabase, London region), encrypted in transit and at rest. The email carrying your quote is delivered by Resend, which processes email content in the US under UK-approved safeguards.
• Your rights. You can ask for a copy of your data, ask for it to be corrected, or object to how it is used. Ask your tradesperson first — they are the controller, so the decision is theirs to make. If you cannot reach them, email us at hello@tradedraft.co.uk and we will pass your request on and help them answer it. Note that records kept as evidence of an agreement can lawfully survive an erasure request, under the exception for establishing or defending legal claims.
• If you're unhappy. You can complain to the UK's Information Commissioner's Office at ico.org.uk.

What we collect and why

"Lawful basis" below is the legal reason we're allowed to hold each item, mostly contract, meaning we need it to provide the service you've signed up for.

• Account email and password: to create your account and sign you in. Your password is stored only as a secure one-way hash, never in readable form. If you choose Continue with Google rather than setting a password, Google confirms who you are and passes us your name, email address and Google account ID. We never see your Google password, and we ask Google for nothing else: no contacts, no calendar, no files. Lawful basis: contract.
• Quote, company and logo data you enter into TradeDraft, to produce your documents. Lawful basis: contract.
• Payment details are handled by Stripe. We never see or store your card number; we keep only a Stripe customer reference and your subscription status.
• Anonymised usage data: to understand and improve the product. Lawful basis: legitimate interests.
• Essential sign-in storage in your browser to keep you signed in. No advertising or third-party tracking cookies.
• Your email, if you ask for the free toolkit or a guide, so we can send you the files you asked for. Lawful basis: contract, meaning sending you the thing you requested. If you also tick the box to hear from us, we record the exact wording you agreed to and when, so we can show what you consented to. Lawful basis for those later emails: consent, which you can withdraw at any time using the unsubscribe link on every one.
• Your name, email, trade and town, if you claim one of the first 50 held prices, so we can hold your place, send your code and honour that price for the first 12 months of your subscription. Lawful basis: contract, and our legitimate interest in keeping a record of the price we promised you.

Your TradeDraft data

When you build quotes in TradeDraft, here is exactly what happens to your data:

• What we store:
  • your account email;
  • your company profile: business details, default pricing and your logo;
  • each saved quote: its reference, your client's name and contact details, the job details and the figures;
  • files you attach to a job: photos, receipts, and notes & files you upload;
  • invoices raised from an accepted quote, and their payment status;
  • a send log: each time you send or re-send a quote, we keep an immutable record of the quote reference, your client's name and the exact document that was sent — your record of what you sent and when;
  • your subscription status.
  Your internal pricing (overheads, markup and margin) is yours alone; your client only ever sees the finished quote.
• Where: in our database at Supabase, hosted in the UK (London region), encrypted in transit (HTTPS) and at rest (AES-256). Access is locked to your account, so no other user can ever see your data.
• Online acceptance records. If you send a quote by accept link and your customer accepts it, we store their typed name, the date and time, and their device's IP address and browser as the record of acceptance. That record is held for you, as part of your quote data. Lawful basis: legitimate interests, namely to create a reliable record evidencing the agreement, so you (and we) can show what was accepted if a dispute arises; kept for up to 6 years (see "How long we keep it" below).
• Deleting it: delete any single quote from Your Quotes, or use Delete my account in Settings. Your personal details, company profile and logo, drafts, saved quotes, rate book and settings are removed immediately, and any subscription is cancelled. Records of quotes your customers formally accepted, and of invoices that were paid, are kept for 6 years as legal and financial evidence (see “How long we keep it”), then permanently deleted. You can also email hello@tradedraft.co.uk and we'll do it for you.
• Anonymous usage counts: to understand whether the product works — for example how many quotes get sent, or how often someone reaches the point of starting a subscription — we count a handful of plain events like “a quote was sent”. These carry no identifier of any kind: no name, no account, no device or session ID, not even the page address — just the event and the time, so they can never be traced back to you or anyone. This is our own system, not a third party; the counts are deleted after 30 days. Separately, Cloudflare provides cookieless website-visitor statistics (page views, no personal data), which is the only outside analytics we use. Lawful basis: legitimate interests, namely running and improving the service.

Who processes your data

We use a small number of trusted processors: Supabase (database and authentication, UK-hosted), Stripe (subscription payments), Google (sign-in, and only if you choose the Continue with Google button), Payhip (checkout for the document-template shop, as merchant of record), Netlify (hosting), Cloudflare (privacy-friendly, cookieless website analytics) and Resend (email delivery — acceptance and account notifications, the free guides you ask for, and our mailing list if you opt in) and Ideal Postcodes (UK address lookup, used only when you search a postcode while building a quote — it receives the postcode and the technical details any web request carries, never your customer's name or job). We do not sell your data to anyone, ever.

Some of these providers process limited data outside the UK. Stripe may process payment data in the US, and Resend — which delivers our emails, including the acceptance links you send to your clients — processes that email content in the US. Cloudflare, Netlify, Payhip and Google also operate internationally. Where data leaves the UK it's covered by UK-approved safeguards (the UK extension to the EU–US Data Privacy Framework, or standard contractual clauses). Your quote data itself is stored only in the UK.

If you are a tradesperson: when you store your client's details in a quote, you are the data controller of that information and TradeDraft acts as your data processor. See the "Data processing" section of our Terms for what that means. If you are the client, see the section for you at the top of this page.

How long we keep it

For as long as you have an account. If you cancel, we keep your quotes for 90 days in case you return, then delete them. Where a quote has been formally accepted by a customer, or an invoice has been paid, we will keep that record (and its acceptance or payment details) for 6 years as evidence of the agreement — long enough to cover the contract-limitation period wherever you are in the UK (six years in England, Wales and Northern Ireland, five in Scotland) and HMRC's record-keeping rules — whether you cancel or delete your account. Deleting your account immediately erases your personal details, drafts, saved quotes, rate book and settings; those accepted-quote and paid-invoice records are the only thing kept, unlinked from your account, used only to settle a dispute, and permanently deleted after 6 years. Being unlinked from your account does not make these records anonymous, and we would rather be plain about that than let the wording imply otherwise. A contract has to name the parties to it, so a retained accepted quote still contains your business name and address — which, if you are a sole trader working under your own name, are your personal data — along with your customer's details and the record of their acceptance. That is inherent in keeping evidence of an agreement: stripped of who agreed what, the record would no longer evidence anything. Your send log — the record of each quote you sent, and the document that went out — is kept for up to 6 years as evidence of what was sent and when, even for quotes a customer never accepted. Like the accepted-quote and paid-invoice records above, it survives account deletion: it is unlinked from your account, used only to settle a dispute about what was sent, and permanently deleted after 6 years. Billing records are held by our payment provider for as long as the law requires. Anonymous statistics (which can't identify you) may be kept indefinitely.

These are retention periods we operate, not a promise that a particular record will always be there. We take reasonable care to hold them for those periods and to keep them retrievable, but the service is provided "as is" and "as available" and our liability is limited as set out in our Terms of Use — so download and keep your own copy of anything you would need in a dispute. If we ever stop providing TradeDraft, we will give you at least 30 days' notice, unless something outside our control makes that impossible, and time to take copies before anything is deleted; clause 8 of our Data Processing Agreement says what happens to your customers' records then.

If you asked for the free toolkit or a guide but never opened an account, we keep your email until you unsubscribe or ask us to remove it, and in any case no longer than 3 years from your last contact with us. If you claimed one of the first fifty held prices, we keep that claim for your first twelve months while we're honouring the price, and afterwards as the record that the promise was made and kept. We don't delete it automatically, because it's the only proof of what you were offered. Ask us and we'll remove it, which frees the place.

If you email us a quote to be rebuilt in TradeDraft, we use it only to produce the rebuild we send back to you. It is read by the person doing the work, is never published or used as an example, and sending it does not add you to any mailing list. The correspondence is kept like any other email to us — ask at any time and we will delete it.

Your rights

Under UK GDPR you can access, correct, export or delete your data, and object to or restrict certain processing. You can delete your account yourself from Settings, or email us. You can complain to the Information Commissioner's Office at ico.org.uk.

Last updated: 27 August 2026