Your information. Clearly explained.

1. Who we are

TradeCore is operated by Stuart Marshall, a sole trader trading as TradeCore, at 48 Glyn Road, Birmingham, B32 2TA, United Kingdom. For privacy enquiries, email support@tradecore.ltd.

We act as controller for account administration, subscriptions, support and platform security. Your employer or contracting company generally controls the workforce and job information it places in its workspace; we process that information on its behalf. Its own privacy notice should explain its decisions about workforce monitoring and record keeping.

2. Information we process

Account and contact details, company branding, user roles, login and security records, chosen plans, trial and subscription dates, billing records and support messages. Operational records can include sites, plots or rooms, allocations, time entries, pay rates, worker invoices, notes, photographs, issues and audit history.

Holiday and sickness records may also be processed when those features are used. Sickness information can be health data. Avoid unnecessary medical details; your company must identify an appropriate lawful basis and, where required, a special-category condition for processing it.

3. Why we use it and our lawful bases

We use account, subscription and support information to provide and administer the service under our contract. Where you act for a company rather than contract personally, our legitimate interests include administering that business relationship and assisting its authorised users.

Our legitimate interests also include protecting accounts, preventing abuse, investigating faults and maintaining reliable service. We retain records where necessary to comply with legal obligations. Where consent is required for an optional activity, you can withdraw it without affecting processing already carried out lawfully. Registering for a trial does not by itself subscribe you to promotional emails.

4. Location, photos and notifications

When a company enables location checks, the app requests a location reading during a start or finish action. The reading, accuracy and distance from the site may be stored as work evidence; this is not continuous background tracking. Device permission can be declined or revoked, although your company may need to resolve attendance exceptions.

Work photographs are private by default. An authorised administrator can share selected photographs through a revocable gallery link; anyone holding that link can view its contents. Avoid sharing links or images containing unnecessary personal information.

Push notifications require your device permission. We store the subscription information needed to send them, and you can disable them through your browser or device settings.

5. Suppliers and access

Authorised users can access information according to their company roles and permissions. TradeCore may access records where needed for support, administration, security or legal obligations. We do not sell personal information for advertising.

Supabase provides authentication, database and storage services; Vercel hosts the app; Resend delivers service emails; Stripe processes subscription payments. Full card numbers are handled by Stripe, not stored in TradeCore. Suppliers may use infrastructure or personnel outside the UK. Where restricted international transfers take place, applicable data-protection safeguards are required.

We may disclose information if legally required or reasonably necessary to investigate fraud, protect rights or address a security incident.

Optional accounting connections

When an authorised company administrator connects Xero, TradeCore reads the selected organisation’s details, supplier contacts, expense accounts and tax settings to set up invoice mappings. On your instruction, it sends approved worker invoice amounts, references and work descriptions to that organisation as draft supplier bills, and reads their status, CIS deductions and payment information when you check them.

Access tokens are encrypted on our servers. Disconnecting in TradeCore removes the stored connection credentials and stops further access through that connection. You can also revoke TradeCore in Xero’s connected apps settings. Existing invoices and audit records are not deleted by disconnecting, and records already sent to Xero remain subject to your Xero account’s controls. Your company is responsible for choosing the correct organisation and informing workers about relevant sharing. TradeCore does not initiate bank payments through this connection.

6. Cookies, browser storage and website measurement

We count arrivals on public website pages automatically using a daily aggregate total. This basic counter does not store a visitor identifier, cookie, IP address, referrer, page history or individual visit record. It counts arrivals rather than unique people: refreshing or opening a new tab can count again. Browsing between pages in the same loaded website does not add another arrival. We check existing essential sign-in state before counting and exclude signed-in users, login and private app pages. No account information is sent to the counter. Known automated requests are excluded, and blocked requests cannot be counted. This statistical count helps us understand overall website use and is separate from optional analytics and email campaign tracking. Older optional browser identifiers are removed from your browser measurement settings when you next visit; existing consent-based records remain separate and are removed after 90 days without activity when visits are recorded.

The service uses browser storage and cookies where needed to keep you signed in, preserve settings and support the installed app. Clearing browser data can sign you out or remove saved preferences. Google Search Console and Bing Webmaster Tools provide search-performance information; their search reporting is separate from your private company records.

7. How long information is kept

Our scheduled retention process removes read notifications after 30 days, work photographs after 2 years, and location checks, time entries, invoices and audit records after 6 years. Removal occurs through scheduled processing rather than precisely on the anniversary. Backups and legally required records may have different retention periods.

Other account, company, subscription and support information is kept for as long as necessary for the service, legal obligations, security and resolving disputes. Cancelling billing does not immediately delete company records. Contact us about closure or deletion; we will explain what can be removed and any reason for retaining information. Your company remains responsible for retaining records it is legally required to keep.

8. Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, portability or object to processing, including processing based on legitimate interests. These rights are subject to legal conditions and are not absolute. We may need to verify your identity before responding.

For workforce records, contact your company administrator first, or contact us and we will help direct the request. For TradeCore account, billing or privacy matters, email support@tradecore.ltd. You can complain to the UK Information Commissioner’s Office if you are unhappy with how your information is handled.

9. Business marketing and campaign measurement

TradeCore may hold business prospect details including company name, business type, contact name, work email, trade, website, publicly available source links and contact history. Information may come from you, your business website or other recorded public business sources. We use relevant corporate business contacts on a legitimate-interests basis where permitted; where electronic-marketing consent is required, we require that consent. A public email address alone is not treated as consent.

Marketing emails may be sent through IONOS using our TradeCore mailbox. Unsubscribe using the link in an email or contact tradecore@tradecore.ltd. We retain a minimal suppression record to honour your objection and prevent future imports from resubscribing you. Opting out of marketing does not stop essential account messages.

For contacts with recorded tracking consent, emails may include an open-measurement image and a tagged trial link. These record whether an email image was requested or a link followed; automated scanners and privacy services can make those measurements inaccurate. A tagged website visit is recorded only if you allow campaign measurement on arrival. We also match verified trial signup emails to recent campaign contacts and record associated subscription conversions to assess the effectiveness of our business marketing. No advertising profiles are sold.

Prospect information is reviewed for relevance and kept only as necessary for business contact, compliance and resolving queries. You can ask for its source, access, correction or deletion, and can object to direct marketing at any time. Where a minimal suppression record remains necessary to honour an objection, we explain this when responding.

10. Optional tax-review service

If you request a TradeCore tax review, we use the personal details you confirm, your selected company’s recorded payments and deductions for the tax year, and additional information you supply to review that request. This can include your UTR, address, income and expenses. These requests are restricted to you and the TradeCore service team, rather than shared with other workers or company administrators. We retain the request and its review history as needed to provide the requested service and meet applicable record-keeping obligations; contact support@tradecore.ltd to discuss correction or deletion.

A review request is not HMRC authorisation. A paid service requires a separate quote and agreement. Stripe processes service-fee payments; TradeCore does not receive your card details. Any HMRC refund is intended to be paid directly to you. We do not use tax-review details for marketing.

Website traffic measurement

When you allow optional website measurement, we use Vercel Web Analytics to understand public page views, referral sources and broad device and country trends. Our integration removes query strings and fragments from page URLs and excludes private app routes. You can withdraw permission using Website privacy choices in the footer. This measurement is separate from essential account and security processing.

Recent app activity

To help administer and support the service, TradeCore records a signed-in user’s latest interaction time, company and app section while the app is visible and online. The platform owner can see the person’s name, company, role and section in an Active now view for two minutes after activity, and look up the latest recorded activity later to understand customer onboarding and use of the service. We keep only the latest marker per account, replacing it as new activity arrives; we do not keep an interaction history through this feature. It does not record typed content, mouse coordinates or screen recordings, and it is not a timesheet or proof of work.

11. Updates

We will update this notice when our processing changes and bring material changes to your attention where appropriate. The date above identifies the current version.