Privacy Policy

The data controller is HireTrades Ltd, a company registered in England and Wales (the "controller", "we", "us"). For EU/EEA users we act as controller for data we collect when you use HireTrades.

You can reach our data team at privacy@hiretrades.uk.

This notice applies to personal data we process when you visit hiretrades.uk, use the HireTrades mobile apps (iOS / Android), create a personal account, activate a business profile, post content (including Pulse videos), make a purchase, or otherwise interact with us.

It is read alongside our Terms and Conditions and Cookie Policy.

We collect the following categories of personal data:

• Account data — name, email, phone, password hash, date you created the account, country, language, 2FA status.
• Business profile data (when you activate a business profile) — trading name, trade categories, services offered, areas covered, photos, certifications, insurance details, VAT number, payout details, business address.
• Identity & verification data — government-ID images and selfies you submit for ID verification, processed by our verification provider.
• Job, request & quote data — postcode/location, descriptions and photos you upload to jobs or requests, quotes you submit, messages with other users.
• Pulse content — video, audio, thumbnails and captions you upload to Pulse, plus any AI-generated transcript.
• Payment & billing data — billing name, billing address, last four digits of card, Stripe customer ID, Apple/Google IAP receipt IDs, subscription state. We do not see or store your full card number.
• Device & usage data — IP address, browser/app version, OS, device model, push tokens (FCM / APNs), crash diagnostics, pages/screens viewed, referrer.
• Communications — emails, SMS and in-app messages you send us, plus our replies.
• Location data — coarse location derived from your IP, plus precise GPS only when you tap "Near me" or use a location-aware feature and grant permission.
• Referral data — referral codes you share, who signed up using your code, badges you have earned.

We collect data: (a) directly from you when you sign up, edit your profile, post content or contact us; (b) automatically through cookies, SDKs and server logs; (c) from third parties — for example, OAuth providers (Google, Facebook, Apple) when you choose to sign in with them; payment processors when you transact; ID verification providers when you upload documents; and from public sources when we list trade categories.

Under UK GDPR (and EU GDPR for EEA users) we must have a legal basis to process your personal data. We rely on the following:

• Contract (Art. 6(1)(b)) — to create and run your account, deliver the platform, match jobs to tradespeople, process payments, deliver subscriptions, process referrals.
• Legitimate interests (Art. 6(1)(f)) — to improve and secure the platform, prevent fraud, debug crashes, send transactional notifications, send service updates and non-marketing communications, and maintain analytics. You can object at any time.
• Consent (Art. 6(1)(a)) — for optional cookies, marketing emails/push, precise GPS location, accessing your camera/photos for uploads. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — tax, accounting, anti-fraud, anti-money-laundering, responding to lawful requests from authorities, complying with UK consumer law.
• Public interest / safety (Art. 6(1)(d)/(e)) — in rare cases, e.g. to act on severe-weather warnings issued by the Met Office.

Where we rely on legitimate interests we have carried out a balancing test. You can request a copy of that test by emailing us.

Activating a business profile makes selected information about your business publicly visible on HireTrades — for example trading name, trade categories, location, photos, reviews and any Pulse content you publish. You can choose what to publish and edit it at any time from Business Settings.

If you invite others to join your business profile (as owner, admin, editor or viewer) their email and name are processed by us to provide the invitation. They become controllers for their own personal data.

Verification documents (ID, insurance certificates) are never published and are only visible to our verification team.

Videos you upload to Pulse are stored on our content network (Cloudflare Stream) and are publicly viewable on HireTrades. We may automatically generate captions, thumbnails and engagement metrics. You can delete a Pulse upload at any time from your dashboard; we will remove it from public view immediately and from backups within 30 days.

You warrant that everyone identifiable in a Pulse upload has consented to appear, and that the content does not breach the rights of any third party.

Website payments are processed by Stripe Payments Europe Ltd as an independent controller for fraud-prevention purposes and as our processor for payment execution. We receive only the metadata needed to fulfil your order (amount, last four digits, status). Stripe's privacy notice applies in addition.

Mobile in-app purchases are processed by Apple App Store or Google Play and governed by Apple's or Google's privacy notices. We receive only the receipt/subscription state via RevenueCat.

We send transactional messages (account confirmations, job status, quotes received, payment receipts, severe-weather alerts) on the basis of contract / legitimate interest. You cannot opt out of essential transactional messages while you have an active account.

Marketing emails, SMS and push are sent only with your consent and you can opt out at any time from Notification Settings or the "Unsubscribe" link in each email.

We use cookies and similar technologies to keep you signed in, remember your language and country, secure forms (CSRF), measure usage, and improve the service. See our Cookie Policy for the full list and to manage your choices.

We do not sell your personal data. We share it with carefully selected third parties only where necessary:

• Other HireTrades users — your public profile, public business profile, public Pulse posts, and the contents of jobs/quotes/messages you exchange with them.
• Hosting & infrastructure — Emergent platform (hosting), MongoDB Atlas (database), Cloudflare (CDN, Pulse video streaming).
• Communications — Twilio, Plivo, Telnyx and Sent.dm (SMS); SendGrid and SMTP providers (email); Firebase Cloud Messaging and APNs (push).
• Payments — Stripe (web), Apple, Google, RevenueCat (mobile IAP).
• Identity verification — our verification partner (disclosed at the point of upload).
• Analytics & monitoring — internal logs and crash diagnostics. We do not use Google Analytics for advertising.
• Authorities — when required by law or to protect rights, life or property.
• Buyers in case of corporate transactions — if HireTrades is sold, merged or restructured, your data will transfer subject to this notice.

All processors are bound by written contracts (UK GDPR Art. 28).

Your data is primarily stored in the UK and the EU. Some processors (e.g. Stripe, Apple, Google, Cloudflare) are based in or process data from the United States. Where data is transferred outside the UK or EEA, we rely on the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, the UK–US Data Bridge, and/or an adequacy decision — whichever applies to that destination.

You can request a copy of the relevant transfer mechanism by emailing privacy@hiretrades.uk.

• Active accounts — for as long as you have an account.
• Closed accounts — most data is deleted within 30 days of closure. Some data is retained for up to 7 years to meet HMRC, accounting and anti-fraud obligations.
• Pulse content — removed from public view immediately on deletion; removed from backups within 30 days.
• Marketing logs — opt-out preferences are retained indefinitely so we honour your choice across re-registrations.
• Server logs — typically 90 days.
• Verification documents — up to 12 months after verification, then deleted.

We use TLS for all traffic in transit, encrypt sensitive fields at rest, hash passwords with bcrypt, scope access on a need-to-know basis, run automated security scans, and operate two-factor authentication for staff with admin access. No system can be guaranteed 100% secure; if we become aware of a breach affecting your personal data we will notify the ICO within 72 hours and you without undue delay where required by law.

You have the right to:

• Access a copy of the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten") subject to legal retention.
• Restrict or object to certain processing (including direct marketing).
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent for processing based on consent, at any time.
• Not be subject to a decision based solely on automated processing producing legal or similarly significant effects.

You can exercise most rights from your dashboard (Edit Profile, Export Data, Delete Account). Otherwise email privacy@hiretrades.uk. We respond within one month.

HireTrades is not directed to children. You must be at least 18 years old to use the Service. If we learn we have collected personal data from a child under 16 without parental consent we will delete it.

We use automated matching to suggest jobs to tradespeople (by trade category, location and budget) and to surface relevant search results. These decisions do not produce legal or similarly significant effects on you, but you can ask us to review any specific recommendation by emailing us.

We do not engage in profiling for advertising purposes and we do not share your data with ad networks.

We may update this notice from time to time. Material changes will be notified by email or in-app at least 14 days before they take effect. Older versions are archived on request.

If you have a concern, please email privacy@hiretrades.uk first so we can try to resolve it.

UK users have the right to lodge a complaint with the Information Commissioner's Office (ICO).

EU/EEA users have the right to lodge a complaint with their local data protection authority. A list is available via the European Data Protection Board.