Legal
Privacy Policy
What personal data we collect, why, how long we keep it, and the rights you have over it. Written in plain English, because you should be able to read the whole thing.
This policy covers personal data handled by Trades Toolbox — both on this website and inside the product. When we change it, we update the date at the top, and if the change matters we say so plainly on this page.
1. Who we are
Trades Toolbox is the trading name of SME Toolbox Ltd, a company registered in England and Wales. For your own personal data — the data this policy is mostly about — SME Toolbox Ltd is the data controller: the one responsible for deciding why and how it is used. For your customers' data we are a processor, not the controller; section 2 explains the split.
- Company: SME Toolbox Ltd, trading as Trades Toolbox
- Company number: 17376135
- Registered office: 38 Scott Close, Ditton, Aylesford, England, ME20 6QP
- ICO registration number:[[PLACEHOLDER: ICO registration number — registration in progress]]
- Privacy questions:privacy@tradestoolbox.co.uk
We have not appointed a statutory Data Protection Officer, because we are not required to have one. For anything about your data, use the email above — it reaches the founders, not a support queue.
2. Your data and your customers' data are different things
One distinction runs through this whole policy, so here it is up front.
- Your data — your name, your work email, your business details, how you use the website and the product. For this,we are the controller, and this policy is where you find out what we do with it.
- Your customers' data — the names, contact details and messages of the people you do work for, which you put into the product or connect through your email account. For this,you are the controller and we are your processor: we handle it only to run the service for you, on your instructions. That relationship is governed by our data processing agreement, not by this policy. [[PLACEHOLDER: link to the DPA once it exists — required before launch]]
We do not use your customers' data for our own commercial purposes, we never contact your customers to sell to them, and we never sell anyone's data. (We do process it where needed to keep the service secure and to meet our own legal obligations — that is part of running the service for you, and the data processing agreement covers it.)
3. What we collect, and how
| When | What we collect |
|---|---|
| You visit this website | Aggregate usage through Umami analytics — page views, referrers, device type. It is cookieless and does not identify you. We do not build profiles of visitors. |
| You sign up for an account | Your name, your work email address, your business name, and a password (stored only in securely hashed form — we cannot read it). |
| You use the product | The business records you create (customers, jobs, quotes, invoices), settings you choose, and activity logs of what the system did on your behalf. If you connect your email account, we access it only in the ways you approve when you connect it. |
| You pay for the paid tier | Your card details go directly to our payment provider — we never see or store the full card number. We keep records of what you were charged and when. [[PLACEHOLDER: name the payment provider once chosen — billing is not yet live]] |
| You email us | Your email address, your name if you give it, and whatever you write. |
| We contact you about our services | If we get in touch about Trades Toolbox before you have ever spoken to us, we found your business contact details in public sources — your own website, or a public business listing. We hold your name, business name and business contact details, and where we found them. Tell us to stop and we stop, and we tell you where we got your details the first time we contact you. |
We do not ask for special category data (health, race, religion and similar) and we never use it deliberately. But real messages carry real life — a customer rearranging a job might mention being in hospital, and that message passes through the system like any other. We do not mine, profile or make decisions from that kind of information; it is simply stored and shown back to you as part of the message it arrived in. The service is for businesses, not children — you must be 18 or over to hold an account.
4. Why we use your data, and our legal basis
Under UK GDPR we need a lawful basis for each thing we do with your data. Here is each purpose and its basis.
| What we do | Lawful basis |
|---|---|
| Run your account and provide the service — including the emails that are part of the service itself, like your daily briefing if you turn it on | Contract — it is what you signed up for |
| Take payment and keep billing and tax records | Contract, and legal obligation for the records HMRC requires us to keep |
| Keep the service secure and fix problems | Legitimate interests — protecting the service and everyone's data in it |
| Improve the product, prevent fraud and misuse, and establish or defend legal claims | Legitimate interests — running a service responsibly |
| Administer accounts used by someone other than the account owner — a teammate's name and work email, for example | Legitimate interests — running the account we were asked to run |
| Respond when you email us | Legitimate interests — answering people who contact us |
| Website analytics | Legitimate interests — cookieless, aggregate, non-identifying |
| Contact businesses that might want the service | Legitimate interests — telling relevant businesses we exist, using publicly available business contact details, with an easy way to say no |
Where we rely on legitimate interests, we have weighed our interest against your rights and expectations, and you can object at any time (see section 9). If you are a customer, service emails are all you get by default — we will not send you marketing without asking you first. And every marketing message we ever send, to anyone, has a working way to say stop.
Note for solicitor: (1) Umami is cookieless and non-identifying, so we rely on legitimate interests for analytics and show no consent banner — please confirm this PECR position. (2) Direct marketing to prospects is business-to-business, but many of our prospects are sole traders, who are treated as individual subscribers under PECR — coldemail to them needs consent. Our operating rule is to segment and not cold-email sole traders; please confirm the policy wording above is consistent with that. (3) ICO — registration is in progress; the founders should run the ICO fee self-assessment, not just register. (4) RESOLVED 2026-08-28: the privacy@tradestoolbox.co.uk mailbox is confirmed real — a Microsoft distribution list created 1 July 2026. It had been flagged as possibly unprovisioned because it appears nowhere else in the repo; that inference was checked with the founders and was wrong. Companion brief: docs/legal/solicitor-brief-2026-08.md.
5. The AI part, in plain English
Parts of the product draft things for you — replies to enquiries, and summaries like the daily briefing. To do that, the relevant text (for example, an enquiry you received) is sent to our AI provider, Anthropic, which generates the draft. Three things to know:
- Nothing goes out without you. Drafts wait for your say-so. The AI never sends anything in your name on its own.
- Your data is not used to train the AI. Under our agreement with Anthropic, data sent through their service is not used to train their models. [[PLACEHOLDER: verify current Anthropic commercial API terms and DPA before publishing this sentence]]
- It involves a transfer outside the UK — see section 8.
6. How long we keep your data
- Your account and business records: for as long as your account is open. If you close your account, we delete your data [[PLACEHOLDER: proposed 90 days]] after closure — everything except the invoice and billing records described next, and anything else the law requires us to hold. The gap exists so you can change your mind or ask for an export.
- Invoices and billing records: two kinds. Our own records of what we charged you are kept for6 years from the end of the tax year they relate to, because the law requires us to keep our own accounts. The invoices you created for your customers are different: HMRC requiresyour business to keep those, so keeping them for that period is part of the service and continues on your instruction even after you close your account (the terms set this out). We give you a copy of your documents when you leave.
- Email enquiries: kept for [[PLACEHOLDER: proposed 24 months]] from your last contact with us, then deleted, unless a conversation is ongoing or we have a legal reason to keep it.
- Prospect details (businesses we researched to contact): deleted when you tell us you are not interested, or when it is clear the details are stale [[PLACEHOLDER: proposed 12 months from collection if no response]] — apart from a minimal do-not-contact record (your contact address and nothing else we can avoid), which we keep so we never contact you again.
- Website analytics: aggregate and non-identifying, so personal-data retention limits do not apply to it in the same way.
7. Who we share your data with
We do not sell personal data and we do not share it for advertising. We use a small number of service providers who process data on our behalf, under contract and only on our instructions:
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting — the website, the product, and the data in it | United Kingdom (London region) |
| Microsoft | Our own email and calendar systems, and — if you connect your Microsoft 365 account — the connection between the product and your mailbox. Your mailbox stays in your Microsoft account; we access it only in the ways you approve. | United Kingdom |
| Anthropic | AI drafting (see section 5) | United States — with UK-approved safeguards (section 8) |
| Umami (Umami Cloud) | Website analytics — cookieless, non-identifying | European Economic Area |
| [[PLACEHOLDER: payment provider — not yet chosen; add when billing goes live]] | Card payments for the paid tier | [[PLACEHOLDER: payment provider region and safeguards]] |
These are the main providers. The complete, current list of everyone who processes data on our behalf lives in the data processing agreement, and we update it there first.
We may also disclose data if the law requires it, or to establish, exercise or defend legal claims. If the business is ever sold, your data goes with it only under the same protections you have now.
8. Where your data lives
Your account and business records are stored in theUnited Kingdom (the AWS London region). Our email systems run on a Microsoft 365 tenant configured for UK data residency. [[PLACEHOLDER: verify the tenant's data-residency configuration before publishing this sentence]] Website analytics is processed in the EEA, which the UK recognises as providing adequate protection.
The exception is AI drafting: text sent to Anthropic is processed in theUnited States. That transfer is covered by a data processing agreement incorporating one of the UK's approved safeguards — the International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses. Email us if you want details of the safeguard used. [[PLACEHOLDER: confirm which safeguard the executed Anthropic DPA uses before publishing]]
9. Your rights
Under UK GDPR you can:
- Access — ask for a copy of the personal data we hold about you.
- Rectification — ask us to correct data that is wrong or incomplete.
- Erasure — ask us to delete your data, where that applies.
- Restriction — ask us to limit how we use your data in certain cases.
- Portability — ask for the data you gave us in a machine-readable format. (If you hold an account, you do not need to invoke a legal right for this — export is part of the deal. See ourterms.)
- Objection — object to anything we do under legitimate interests. For marketing and being contacted about our services, object once and it stops, no argument. For other purposes (security, for example) we stop unless there are compelling legitimate grounds to continue, or the data is needed for legal claims — and we tell you which it is.
- Withdraw consent — where we ever rely on consent, withdraw it at any time.
Email privacy@tradestoolbox.co.uk. It is free, and we respond within one month — for a genuinely complex request the law lets that extend by up to two further months, and if we ever need the extension we tell you within the first month, with the reason. We may need to confirm you are who you say you are before disclosing anything.
One honest caveat: if you ask us to erase data that HMRC requires us to keep (invoices, mainly), we will remove what we can and tell you exactly what we must keep and until when.
10. Cookies
This website sets no cookies. Our analytics (Umami) is cookieless and non-identifying, so no cookie banner is required under PECR — which is why you have not seen one.
Signing in to the product itself uses strictly necessary session storage to keep you signed in. That is essential to the service, involves no tracking, and needs no consent.
11. If something goes wrong
If we ever have a personal data breach that is likely to put you at high risk, we will tell you directly, without undue delay, plainly, with what happened and what we are doing about it. Where a breach is likely to put people at risk, we notify the ICO within 72 hours. Either way, we do not sit on bad news. Security worries or suspected breaches:privacy@tradestoolbox.co.uk.
12. Complaints — the ICO
If you are unhappy with how we have handled your data, contact us first and we will try to put it right. You also have the right to complain to the UK regulator, the Information Commissioner's Office:
- Website: ico.org.uk
- Helpline: 0303 123 1113