Who this notice covers
This notice covers people using the TradeJobSheet website and app, business account holders and customers whose job information is entered by a business. The business documenting your job is responsible for deciding what to record and whom to share it with. Contact that business first for questions about the content of its report.
Information used to run the service
We process account names, email addresses, password hashes and session records to provide sign-in and account security. A business may enter customer contact details, site addresses, job notes, materials, time, photographs, recordings, transcripts, report versions and signatures. Payment details are handled by Stripe; TradeJobSheet stores subscription references and status, not card numbers.
Why information is processed
Account and job data are used to provide the service requested by the account holder, support users and protect the application. Security records and hashed abuse-prevention identifiers help limit misuse. Businesses must have an appropriate lawful basis for the customer information they enter, give any required notices and avoid uploading unnecessary sensitive information.
Optional AI processing
AI processing is disabled for a business until an owner or admin enables it. Requests are sent from the application server to a private Python service. The configured ChatGPT session provider uses saved account authentication and undocumented backend behaviour. Text and selected images may be processed by that provider under its applicable account terms; hosting and processing may take place outside the UK. Do not enable this integration for customer data until the operator has assessed contractual terms, data protection arrangements and any international transfer requirements. Local transcription can be configured as an alternative for audio. AI output is a draft and requires review.
Service providers and sharing
The deployment uses Hostinger for the application, database and private file storage, Stripe for billing and Resend for transactional email. The AI service and its upstream provider process data only when those features are used. The specific regions and contractual arrangements depend on the operator’s deployment. A business controls report recipients and share links. Anyone with a valid link can access its report until expiry or revocation, so links should not be published openly.
Storage and retention
Job files are stored outside the public web directory, with access checked against the business or a valid share link. Approved and signed report versions are preserved to maintain the history. Cancellation or a failed payment does not trigger immediate deletion of customer records. Business owners can export structured data and request account or record deletion. Security rate-limit buckets and expired authentication records are removed by scheduled maintenance. Actual backup retention follows the operator’s backup policy.
The free generator
The free manual generator processes submitted information and photos in memory to create a PDF. It does not save a job record or report file. A hashed client identifier and short-lived request counter may be retained for abuse prevention. Keep a copy of your downloaded PDF; we cannot retrieve a free-tool document for you.
Your choices and rights
You may request access, correction, restriction or deletion of your personal information, or object to processing where applicable. The response depends on the role of the business and any legal retention duties. Contact the privacy email on the Contact page. If you are dissatisfied with a response, you may raise a concern with the UK Information Commissioner’s Office. No non-essential advertising or analytics cookies are included in this release.