Privacy Policy

TradesAround is a directory connecting South East England homeowners with local tradespeople. This Privacy Policy explains what personal data we collect when you visit tradesaround.com, why we collect it, how we use it, and the rights you have under UK GDPR and the Data Protection Act 2018.

If anything here is unclear, email hi@tradesaround.com and we'll respond within seven days.

We collect personal data only when you give it to us or it's technically necessary to provide the service:

• When you submit an enquiry to a tradesperson — your name, email address, optional phone number, and the message you type, plus any follow-up messages you send in the conversation. We use these to relay the enquiry and your messages between you and the tradesperson through TradesAround; neither side sees the other's email or phone number unless you choose to share it in a message.
• When you sign up as a tradesperson — your business name, contact details, postcode, services offered, and any photos or descriptions you upload to your profile.
• When you sign in — your email address, so we can send a magic sign-in link. We don't store passwords.
• When you sign up for our newsletter — only your email address. See the "Newsletter" section below for the full opt-in / opt-out lifecycle and what we do with it.
• When you use the site — anonymous, aggregated page-view statistics. See the "Analytics" section below for what this does and does not include.
• From hosting logs — our hosting provider (Vercel) automatically records IP addresses, browser type, referrer, and timestamps as part of standard server operation. These logs are kept for a short window for security and operational reasons.

We do not buy or sell personal data. We do not run third-party advertising networks. We do not use behavioural tracking pixels.

We use the information you provide to:

• Forward enquiries to the tradesperson you contacted
• Show your business profile in the public directory (tradespeople only)
• Sign you in via magic-link email
• Verify a self-service email-address change: we send a confirmation link to the new address (the change only applies when you click it) and a security-alert notification to the old address after the change is applied. If you didn't initiate the change, the old-address notification tells you how to recover your account.
• Send our newsletter (only if you've confirmed your subscription — see the "Newsletter" section)
• Respond to support requests you send us
• Detect and prevent fraud, spam, and abuse
• Understand how the site is being used in aggregate, so we can improve it

We don't use your data for advertising, profiling, or any kind of automated decision-making that has legal effect.

We only set cookies and use device storage where it's strictly necessary to make the site work. We do not set marketing cookies, tracking cookies, or cross-site identifiers.

Here's the full list of what we use:

That's it. Three strictly-necessary items, no advertising or marketing cookies, no third-party tracking.

You can disable or delete cookies at any time through your browser's settings. If you disable the NextAuth cookies you won't be able to stay signed in.

If you sign up for our newsletter via the form in the site footer, here's what happens:

• Double opt-in. When you enter your email, we save it as pending and send you a confirmation email. You only join the audience after clicking the link in that confirmation — we never add anyone without their explicit click. If you don't confirm, nothing further is sent.
• What we store. Only your email address, the source page you signed up from (e.g. "footer"), the dates of subscribe / confirm / unsubscribe, and an unsubscribe token (a random string used to identify your subscription in the unsubscribe link). No marketing profiling, no behavioural tracking, no segmentation by behaviour.
• Unsubscribe anytime. Every newsletter email includes a one-click unsubscribe link. Clicking it removes you immediately — no "sorry to see you go" gauntlet. If you change your mind, the unsubscribe page offers a one-click resubscribe option (still goes through a fresh double-opt-in confirmation).
• How long we keep it. While your subscription is active, we keep your row for as long as you stay subscribed. After you unsubscribe, we retain the row with an unsubscribed flag so we have a record that you opted out (this prevents us from accidentally re-adding you if someone else types your email into the form). If you want the row completely deleted at any point, email hi@tradesaround.com with a request for erasure under UK GDPR Article 17, or delete your TradesAround account — that flow auto-purges any newsletter row matching your account email.
• Newsletter content (when we have any). The newsletter is currently capture-only — we're collecting addresses but haven't started sending yet. When we do, expect a short monthly digest at most: site updates, new guides, occasional spotlights on trades / locations. Never sponsored content from third parties.
• No third-party processors. Subscriber data is stored in our own database (Neon, see the "Who we share your data with" section below). Sending happens via Resend (same provider as our transactional emails). We don't use Mailchimp, ConvertKit, or any other marketing platform.

We share personal data only with the service providers we need to run the site, and only for the purposes listed:

• Vercel — hosts the website (USA, EU data residency available). Sees server logs.
• Neon — database hosting (EU). Stores your account, profile, and enquiry data.
• Cloudflare R2 — stores any photos or logos you upload (global edge network).
• Resend — sends transactional email (sign-in links, enquiry forwarding, account notifications). Sees recipient email and message content.
• Umami — cookieless analytics. Sees anonymous page-view events (no personal data).
• OpenAI — used only when an admin runs the "Generate Bio" tool on a tradesperson profile. Sees the public website text used to draft the bio. Never sees user enquiries or sign-in data.

We do not share data with advertisers, data brokers, or any third party for marketing purposes. We will disclose data when required by law (e.g. a court order) and will tell you unless we're legally prohibited from doing so.

You have the following rights over your personal data:

• Access — you can ask for a copy of the personal data we hold about you.
• Rectification — you can ask us to correct anything that's inaccurate.
• Erasure ("right to be forgotten") — you can ask us to delete your account and associated personal data, subject to limited legal retention obligations (e.g. accounting records).
• Restriction — you can ask us to stop processing your data while a dispute is resolved.
• Portability — you can ask for a machine-readable copy of your data to take elsewhere.
• Objection — you can object to specific kinds of processing, including direct marketing (we don't do direct marketing, but the right applies).
• Withdrawal of consent — where we're relying on consent for processing, you can withdraw it at any time. This doesn't affect processing already done.

To exercise any of these rights, email hi@tradesaround.com. We'll respond within one calendar month.

If you're not satisfied with how we've handled your data, you have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

We keep data only as long as we need it for the purposes listed in this policy:

• Enquiry submissions — retained for 24 months from submission, then deleted. This is so a tradesperson can respond to an enquiry weeks or months after it was sent, and so we can investigate disputes if either party raises one later.
• Tradesperson accounts and profiles — retained for as long as the account is active. When you delete the account, the profile is removed from the public directory within 24 hours and personal data is deleted within 30 days. We keep one thing afterwards: a one-way, scrambled form of your business's Google Maps listing ID — not your name or contact details — so that we never add your business back to the directory from public listings. It can't be turned back into the listing ID; email us if you'd like it removed.
• Hosting and server logs — retained for up to 90 days for security and operational purposes.
• Analytics data — Umami retains aggregated stats indefinitely, but since no personal identifier is captured, this isn't personal data.

TradesAround is intended for adult users (18+). We do not knowingly collect personal data from children under 13. If you believe a child has provided personal data through the site, contact us at hi@tradesaround.com and we'll delete it.

We may update this Privacy Policy from time to time — for example, when we add new features that involve new data processing. We'll update the "Last updated" date at the top of the page when we do.

If the change is material (significantly expands what we collect, who we share with, or how we use data), we'll notify account-holders by email before it takes effect.

Questions about your data or this policy? Email hi@tradesaround.com.