Privacy Policy

TradeDraft is a sole-trader business based in England. This policy explains what personal data we collect, why, and your rights over it. Questions: hello@tradedraft.co.uk, Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset BH16 6FA.

If you're the customer who received a quote

Most of this page is written for the tradespeople who use TradeDraft. This section is for you: someone who was sent a quote and asked to accept it online.

• Who holds your data. The tradesperson who sent you the quote decides what happens to your details — in data-protection terms they are the controller. TradeDraft only stores and processes it on their instructions, as their processor. We do not use your details for our own purposes, and we never sell them.
• What we hold about you. Whatever your tradesperson put in the quote (typically your name, the job address and what the work involves), and — if you accept online — your typed name, the date and time, and your device's IP address and browser. That last set exists so both of you have a record of what was agreed and when.
• Why, and for how long. An accepted quote is a formed contract, and the acceptance record is the evidence of it. We keep accepted quotes and their acceptance records for six years, which is the period a dispute about a contract can normally be brought. If you never accept a quote, the copy behind your link is deleted 90 days after the quote expires, and your tradesperson's own copy goes 90 days after their account ends unless they delete it sooner. One record stays longer: the send log keeps a copy of each quote as it was sent to you, accepted or not, for up to six years, as evidence of what was sent and when. It is kept even if your tradesperson closes their account.
• Where it is. In a UK-hosted database (Supabase, London region), encrypted in transit and at rest. The email carrying your quote is delivered by Resend, which processes email content in the US under UK-approved safeguards.
• Your rights. You can ask for a copy of your data, ask for it to be corrected, or object to how it is used. Ask your tradesperson first — they are the controller, so the decision is theirs to make. If you cannot reach them, email us at hello@tradedraft.co.uk and we will pass your request on and help them answer it. Note that records kept as evidence of an agreement can lawfully survive an erasure request, under the exception for establishing or defending legal claims.
• If you're unhappy. Tell us first at hello@tradedraft.co.uk: we acknowledge a data protection complaint within 30 days and tell you what we will do about it. You can also complain to the UK's Information Commission (it replaced the Information Commissioner's Office on 30 September 2026) at ico.org.uk.

What we collect and why

"Lawful basis" below is the legal reason we're allowed to hold each item, mostly contract, meaning we need it to provide the service you've signed up for.

• Account email and password: to create your account and sign you in. Your password is stored only as a secure one-way hash, never in readable form. If you choose Continue with Google rather than setting a password, Google confirms who you are and passes us your name, email address and Google account ID. We never see your Google password, and we ask Google for nothing else: no contacts, no calendar, no files. Lawful basis: contract.
• A record that you accepted our Terms: which version of the Terms you accepted, the exact sentence you agreed to, whether you ticked it when you signed up or when we asked the first time you signed in, and when. It lets both of us show what was agreed. It is kept with your account, included when you download your data, and deleted when you delete your account. Lawful basis: contract, and our legitimate interest in being able to show what was agreed.
• Quote, company and logo data you enter into TradeDraft, to produce your documents. Lawful basis: contract.
• Payment details are handled by Stripe. We never see or store your card number; we keep only a Stripe customer reference and your subscription status.
• Anonymised usage data: to understand and improve the product. Lawful basis: legitimate interests.
• Essential sign-in storage in your browser to keep you signed in. No advertising or third-party tracking cookies.
• Your email, if you ask for the free toolkit or a guide, so we can send you the files you asked for. Lawful basis: contract, meaning sending you the thing you requested. If you also tick the box to hear from us, we record the exact wording you agreed to and when, so we can show what you consented to. Lawful basis for those later emails: consent, which you can withdraw at any time using the unsubscribe link on every one.
• Your name, email, trade and town, if you send us the half-price offer form, so we can send you the details by email and honour that price for the first 12 months of your subscription. Lawful basis: contract, and our legitimate interest in keeping a record of the price we promised you.

Your TradeDraft data

When you build quotes in TradeDraft, here is exactly what happens to your data:

• What we store:
  • your account email;
  • your company profile: business details, default pricing and your logo;
  • each saved quote: its reference, your client's name and contact details, the job details and the figures;
  • files you attach to a job: photos, receipts, and notes & files you upload;
  • invoices raised from an accepted quote, and their payment status;
  • a send log: each time you send or re-send a quote, we keep an immutable record of the quote reference, your client's name and the exact document that was sent — your record of what you sent and when;
  • your subscription status.
  Your internal pricing (overheads, markup and margin) is yours alone; your client only ever sees the finished quote.
• Where: in our database at Supabase, hosted in the UK (London region), encrypted in transit (HTTPS) and at rest (AES-256). Access is locked to your account, so no other user can ever see your data.
• Online acceptance records. If you send a quote by accept link and your customer accepts it, we store their typed name, the date and time, and their device's IP address and browser as the record of acceptance. That record is held for you, as part of your quote data. Lawful basis: legitimate interests, namely to create a reliable record evidencing the agreement, so you (and we) can show what was accepted if a dispute arises; kept for up to 6 years (see "How long we keep it" below).
• Deleting it: delete any single quote from Your Quotes, or use Delete my account in Settings. Your personal details, company profile and logo, drafts, saved quotes, rate book and settings are removed immediately, and any subscription is cancelled. Records of quotes your customers formally accepted, of invoices that were paid, and of the credit notes and refunds recorded against invoices, are kept for 6 years as legal and financial evidence (see “How long we keep it”), then permanently deleted. You can also email hello@tradedraft.co.uk and we'll do it for you.
• Anonymous usage counts: to understand whether the product works — for example how many quotes get sent, or how often someone reaches the point of starting a subscription — we count a handful of plain events like “a quote was sent”. These carry no identifier of any kind: no name, no account, no device or session ID, not even the page address — just the event and the time, so they can never be traced back to you or anyone. This is our own system, not a third party; the counts are deleted after 30 days, and only weekly totals (numbers, nothing else) are kept after that. Separately, Cloudflare provides cookieless website-visitor statistics (page views, no personal data), which is the only outside analytics we use. Lawful basis: legitimate interests, namely running and improving the service.

Who processes your data

We use a small number of trusted processors: Supabase (database and authentication, UK-hosted), Stripe (subscription payments), Google (sign-in, and only if you choose the Continue with Google button), Payhip (checkout for the document-template shop, as merchant of record), Netlify (hosting), IONOS (our domain and the hello@ mailbox, so it holds any email you send us), Cloudflare (privacy-friendly, cookieless website analytics) and Resend (email delivery — acceptance and account notifications, the free guides you ask for, a quote you send us from the rebuild page, and our mailing list if you opt in) and Ideal Postcodes (UK address lookup, used only when you search a postcode while building a quote — it receives the postcode and the technical details any web request carries, never your customer's name or job). We do not sell your data to anyone, ever.

Some of these providers process limited data outside the UK. Stripe may process payment data in the US, and Resend — which delivers our emails, including the acceptance links you send to your clients — processes that email content in the US. Cloudflare, Netlify, Payhip and Google also operate internationally. Where data leaves the UK it's covered by UK-approved safeguards (the UK extension to the EU–US Data Privacy Framework, or standard contractual clauses). Your quote data itself is stored only in the UK.

If you are a tradesperson: when you store your client's details in a quote, you are the data controller of that information and TradeDraft acts as your data processor. See the "Data processing" section of our Terms for what that means. If you are the client, see the section for you at the top of this page.

How long we keep it

How long we keep something depends on what it is, and on whether you delete your account.

The 6 years applies whether you cancel or delete your account. It is long enough to cover the contract-limitation period wherever you are in the UK: six years in England, Wales and Northern Ireland, five in Scotland. Your own HMRC record-keeping duty can run for longer than six years from a job, so keep your own copies of your records.

Being unlinked from your account does not make these records anonymous, and we would rather be plain about that than let the wording imply otherwise. A contract has to name the parties to it, so a retained accepted quote still contains your business name and address (which, if you are a sole trader working under your own name, are your personal data) along with your customer's details and the record of their acceptance. That is inherent in keeping evidence of an agreement: stripped of who agreed what, the record would no longer evidence anything.

These are retention periods we operate, not a promise that a particular record will always be there. We take reasonable care to hold them for those periods and to keep them retrievable, but the service is provided "as is" and "as available" and our liability is limited as set out in our Terms of Use — so download and keep your own copy of anything you would need in a dispute. If we ever stop providing TradeDraft, we will give you at least 30 days' notice, unless something outside our control makes that impossible, and time to take copies before anything is deleted; clause 8 of our Data Processing Agreement says what happens to your customers' records then.

If you asked for the free toolkit or a guide but never opened an account, we keep your email until you unsubscribe or ask us to remove it, and in any case no longer than 3 years from your last contact with us. If you claimed the half-price offer, we keep that claim for your first twelve months while we're honouring the price, and afterwards as the record that the promise was made and kept. We don't delete it automatically, because it's the only proof of what you were offered. Ask us and we'll remove it.

If you send us a quote to be rebuilt in TradeDraft, by email or from the rebuild page, we use it only to produce the rebuild we send back to you. A quote sent from the page reaches our mailbox as an email with your files attached, delivered by Resend; the website itself keeps no copy of it. It is read by the person doing the work, is never published or used as an example, and sending it does not add you to any mailing list. Once we have sent the rebuild back to you, we delete your quote and the email it came in. If the rebuild comes back as a link that opens it in your own TradeDraft account, the rebuilt quote is held for you for up to 30 days and then deleted; once you open it, it is in your account and we hold no other copy of it.

Your rights

Under UK GDPR you can access, correct, export or delete your data, and object to or restrict certain processing. You can delete your account yourself from Settings, or email us. If you want to complain about how we handle your data, tell us first at hello@tradedraft.co.uk and we acknowledge it within 30 days. You can also complain to the Information Commission (it replaced the Information Commissioner's Office on 30 September 2026) at ico.org.uk.

Last updated: 3 November 2026