Who we are
TradesLab is provided by TradesLab Ltd, a company registered in England and Wales (company number 17498144), whose registered office is at 66 Paul Street, London EC2A 4NA, United Kingdom.
TradesLab Ltd is registered with the Information Commissioner’s Office (ICO). Registration number: ZC265635.
Questions about this policy or your personal data: email hello@trades-lab.com.
What this policy covers
This policy covers the TradesLab app at app.trades-lab.com, including its trade sections such as LoopLab, and our website at trades-lab.com.
Our two roles: controller and processor
For some personal data we decide how and why it is used, so we are the controller. For other personal data we only handle it for our customers, so we are their processor.
- As controller: we handle the accounts of the people who use TradesLab, billing, our emails to you, security and server logs, and enquiries through our website.
- As processor: we handle the content our customers put into TradesLab (drawings, photos, notes, site details, device and test records) and any personal data in it, such as a client’s or site contact’s name or a person who appears in a photo. The customer (the business with the TradesLab account) is the controller of that content.
As a processor we:
- use customer content only to provide TradesLab to that customer, as they instruct through the app and our terms, and never for our own purposes;
- make sure everyone who can access it is bound by confidentiality;
- use only the service providers listed below, under contracts that protect the data, and tell customers before we add a new one;
- help customers respond to requests from people whose data is in their content;
- tell the customer without undue delay if their content is affected by a security breach;
- let the customer export their content at any time, and delete it when they delete their company.
If your details are in a customer’s content (for example you’re their client or site contact) and you want to see, correct or delete them, please contact that customer. If you contact us, we’ll pass your request to them.
Information we collect as controller
- Account details: your name, work email address and role, and your company’s name, address, phone, email, website, company number, accreditation and logo.
- Billing: your plan, invoices and payment history. Card details are handled by Stripe; we never see or store full card numbers.
- Records of what happens: sign-in times, emails we send you, exports made, and the IP address and browser of requests, kept in security and server logs.
- On your device only: your sign-in session and settings such as the last view you used. If you turn on quick unlock, a scrambled form of your PIN, or a reference to your device’s Face ID or fingerprint, is stored on that device and never sent to us. Your fingerprint or face data never leaves your device.
Customer content we process
Sites (name, address, client, job number), drawings, devices, cable runs, markup, notes, photos and test records, and who made each change and when, including a history of every status change. Photos taken or added in the app are re-saved before upload, which removes hidden details such as their GPS location.
Why we use personal data, and our lawful bases
- To provide TradesLab to your company and its team: performing our contract with your company, and our legitimate interest in providing the service to the people your company invites.
- To send sign-in codes, invitations, and trial, billing and service emails: performing the contract.
- To keep the service secure, prevent abuse and fix problems: our legitimate interests.
- To reply to enquiries through our website: our legitimate interest in answering you, or taking steps you ask for before a contract.
- To keep accounts and invoices and meet other legal obligations: legal obligation.
We don’t sell personal data, we don’t use it for advertising, and we don’t make automated decisions about you that have legal or similar effects.
Visitors to our website
Our website, trades-lab.com, is hosted by Vercel.
- Contact form: if you send us a message, we receive the details you enter (your name, company, email address, trade and message). They are stored in our database (Supabase, in the EU) and emailed to us through Resend. We use them only to reply to you and keep them for up to 24 months after our last contact, unless you become a customer. To stop spam, we also keep a scrambled fingerprint of the connection the message came from, not the address itself.
- Cookies: The website sets no cookies and uses no analytics or tracking. Its fonts and pictures are served from our own site, so your browser does not contact anyone else while you read it.
Who handles personal data for us
We use these service providers, each under a contract that protects your data:
| Provider | What it does | Where data is stored or handled |
|---|---|---|
| Supabase | The database, file storage (drawings, photos, logos) and sign-in for the app | European Union (Ireland) |
| Vercel | Hosts the app and our website and delivers them to your browser, with server logs | Worldwide network; logs in the United States |
| Resend | Sends sign-in codes, invitations and service emails | United States |
| Stripe | Payments, subscriptions and invoices | European Union and United States |
| Anthropic | Reads the part of a drawing needed for automatic room names and scale detection, when you use them. It doesn’t use this to train its models. | United States |
| Cloudflare | Checks that sign-ups come from people, not bots | Worldwide network |
Within your company, people see what their role allows: for example admins see the team list and everyone sees who made each change. We may also share information where the law requires it, or with professional advisers.
Transfers outside the UK
Some providers handle data outside the UK, in the European Union or the United States. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where the provider is certified) or approved safeguards such as the UK International Data Transfer Addendum.
How long we keep it
- Your company’s data and content, while your company account exists. We never delete it because a payment was missed.
- When a company is deleted, its data is removed from TradesLab straight away and from our backups within 30 days.
- When someone is removed from a team, their access ends straight away; their name stays on the history of changes they made.
- Billing records, for as long as the law requires (usually six years).
- Website enquiries, for up to 24 months after our last contact.
- Security and server logs, for a short period (normally no more than 90 days).
How we protect it
Data is encrypted in transit and at rest. Each company’s data is kept separate and only its own team can reach it, by rules enforced in the database itself. Sign-in uses one-time codes sent by email, so there are no passwords to steal.
Your rights
You can ask to see, correct, export or delete your personal data, to restrict or object to how we use it, or to have it moved to another service, by emailing hello@trades-lab.com. If your details are in one of our customers’ content, please ask that customer (see “Our two roles” above).
You can complain to the Information Commissioner’s Office (ico.org.uk), but we’d appreciate the chance to put things right first.
Cookies and storage in the app
The TradesLab app only uses storage that’s needed to keep you signed in, to let the app open quickly and work as an installed app, and to remember your settings on your device. It doesn’t use advertising or tracking cookies, so it doesn’t ask for cookie consent.
Children
TradesLab is a service for businesses and isn’t intended for children.
Changes
If we change this policy we’ll update the date at the top, and tell customers about significant changes by email or in the app.