HandyTrack is operated by Terracode Limited, a company registered in England and Wales.
Data controller: Terracode Limited
Contact: privacy@handytrack.co.uk
We are the data controller for information collected through the HandyTrack mobile application and any associated web services.
Why: To create and manage your account and authenticate you securely. Legal basis: performance of a contract (UK GDPR Art. 6(1)(b)).
Why: To provide the core functionality of the app — scheduling, quoting, invoicing, and customer management. Legal basis: performance of a contract.
Why: To attach visual and audio records to jobs. Photos and recordings are stored securely in your account and never shared without your action. Legal basis: performance of a contract.
Permissions required: Camera, photo library access, microphone, and speech recognition. These are only used when you actively choose to take a photo, upload an image, or record a voice note. You can revoke these permissions at any time in your device settings.
HandyTrack uses two AI providers to power its voice and assistance features. When you record a voice note, the audio is transcribed by OpenAI's Whisper speech-to-text service. The resulting text — and, where you use those features, related job details, customer names, schedule data, and supplier-invoice images — is then processed by Anthropic's Claude to enhance notes, draft quotes, suggest scheduling, and read supplier invoices. Both providers are located in the United States.
What is sent, and when: voice audio, transcripts, dictated job and customer context, schedule data, and supplier-invoice images — only at the moment you actively use an AI feature. We do not log the content of these requests on our own systems; we record only token counts and cost.
Neither provider uses your data to train their models, and request content is not retained by them beyond the API call, in accordance with their data-processing terms. Transfers to the USA rely on Standard Contractual Clauses together with a transfer risk assessment.
Why: To provide accurate transcription and AI assistance. Legal basis: legitimate interests (UK GDPR Art. 6(1)(f)) — improving usability for tradespeople, including those with dyslexia. The AI features are always optional: you can type instead of using voice or AI at any time.
We store an Expo push notification token linked to your account to deliver reminders and alerts (e.g. job reminders, invoice follow-ups). Legal basis: performance of a contract.
Why: To maintain app stability and fix bugs. Legal basis: legitimate interests.
Crash and error diagnostics are handled in two ways. Errors inside the app are recorded to our own database and, once stripped of personal details, may raise an internal bug ticket in Trello. Separately, we use Sentry to capture crashes — including crashes in the underlying operating-system layer that our own reporting cannot see — so that we can detect a broken release quickly and roll it back.
Sentry receives the technical context needed to diagnose a crash: the error and stack trace, your device model and OS version, the app and release version, and an anonymous session identifier. We have deliberately disabled Sentry's optional collection of user-identifying information, so it is not sent your name, email address, phone number or account details. Crash diagnostics are not used for analytics, profiling or advertising.
Our Sentry account is hosted in Sentry's European region (Germany), so this crash data stays within the EU and is not transferred to the United States.
If you use invoicing and payment features, payment processing is handled entirely by Stripe. HandyTrack does not store card numbers, bank details, or any raw payment credentials. We store a Stripe customer ID to link your account to your Stripe payment profile.
Legal basis: performance of a contract.
If you subscribe to a paid plan (Pro or Team), the purchase is processed by the Apple App Store or Google Play as the merchant of record — HandyTrack never sees your card or bank details. We use RevenueCat to manage your subscription entitlements; it receives a pseudonymous identifier linked to your business and your current subscription status, but no name, email, or contact details.
Why: To provide and manage paid features. Legal basis: performance of a contract.
| Purpose | Legal Basis |
|---|---|
| Providing and operating the HandyTrack app | Contract performance |
| Authenticating your identity and securing your account | Contract performance |
| Sending job reminders and invoice notifications | Contract performance |
| Sending transactional emails and SMS (quotes, invoices, reminders) | Contract performance |
| Transcribing and enhancing voice notes | Legitimate interests |
| Diagnosing crashes and improving performance | Legitimate interests |
| Managing your subscription and entitlements | Contract performance |
| Letting you see when an invoice or quote email has been opened | Legitimate interests |
| Complying with legal obligations | Legal obligation |
Email open tracking: Invoice and quote emails we send on your behalf may include a small tracking pixel that lets you see when the recipient has opened the email, so you can follow up at the right time. This relies on our legitimate interests (UK GDPR Art. 6(1)(f)) in helping you manage your business correspondence; it is never used for advertising.
We do not use your data for advertising, profiling, or any automated decision-making that produces legal effects.
We share data with the following trusted service providers solely to operate HandyTrack. All processors are contractually bound to handle data in accordance with UK GDPR.
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Supabase | Database, authentication, and file storage | All app data | EU (AWS eu-west-2) |
| Brevo (Sendinblue) | Transactional email and SMS delivery | Recipient name, email, phone; message content | EU |
| Stripe | Payment processing | Name, email, invoice amounts | USA (SCCs / adequacy) |
| OpenAI | Voice transcription (speech-to-text) | Voice audio (processed, not retained) | USA (SCCs / TRA) |
| Anthropic | Voice enhancement, quote generation, scheduling suggestions, supplier-invoice reading | Voice transcripts, job context, schedule data, supplier-invoice images (processed, not retained for training) | USA (SCCs / TRA) |
| Expo / EAS | Push notification delivery | Push token, notification content | USA (SCCs / adequacy) |
| Google (Firebase) | Android push notifications (FCM) | Push token | USA (adequacy) |
| Apple (APNs) | iOS push notifications | Push token | USA (adequacy) |
| RevenueCat | Managing app subscriptions (Pro / Team) | A pseudonymous subscriber ID and subscription status — no name, email, or contact details | USA (SCCs / adequacy) |
| Apple App Store / Google Play | In-app subscription payments | Payment handled by the store; HandyTrack does not receive card or bank details | USA (adequacy) |
| Sentry | Crash and error monitoring, including native operating-system crashes, so a faulty release can be detected and reverted | Error message and stack trace, device model, OS version, app and release version, and an anonymous session identifier. User-identifying information is disabled — no name, email, phone or account details | EU (Germany) |
| Trello (Atlassian) | Internal bug and crash ticket management | Sanitised crash diagnostics — error messages, stack traces, and app version, with email, phone, and postcode automatically redacted before sending | USA (SCCs / adequacy) |
For transfers to the USA, we rely on Standard Contractual Clauses (SCCs) or UK adequacy decisions as applicable.
When you store your customers' contact details and job records in HandyTrack, you are acting as a data controller for that personal data. You are responsible for having a lawful basis to hold that information and for informing your own customers about how it is used.
HandyTrack acts as a data processor on your behalf for customer records. We process this data only to provide the service to you and do not access it for any other purpose.
| Data Type | Retention Period |
|---|---|
| Account and business data | For the life of your account, plus 30 days after deletion request |
| Job, quote, and invoice records | 7 years after the financial year end (UK tax record requirements) |
| Photos and voice recordings | Deleted within 30 days of account deletion or manual removal |
| Crash logs and error data | 90 days |
| Backup copies | Up to 30 days after account deletion |
Financial records (invoices, quotes) are retained for 7 years to comply with HMRC requirements, even after account deletion. All other data is deleted within 30 days of a verified deletion request.
When you delete your account in the app, we send one last email to the account’s address to confirm the deletion, so that you would find out if someone else had done it. It is sent by our email provider, Brevo (listed in the table above), which keeps its usual delivery record. We do not use the address for anything else.
After your account is deleted, we keep a one-way cryptographic hash of its email address (not the address itself), so that the address can’t be used to sign up again and reconnect to records a tradesperson still holds. We do this on the basis of our legitimate interest in honouring the deletion. If you’d like to use the address again, contact support@handytrack.co.uk and we can lift this on request.
As a UK resident, you have the following rights:
To exercise any of these rights, email privacy@handytrack.co.uk. We will respond within 30 days. You will not be charged for reasonable requests.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
We take the security of your data seriously:
HandyTrack is a business management tool intended for adults (18+). We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us at privacy@handytrack.co.uk and we will delete it promptly.
We may update this policy when we add new features or change how we process data. We will notify you of material changes via the app or by email at least 14 days before they take effect. The "last updated" date at the top of this page reflects the most recent revision.
Continued use of HandyTrack after changes take effect constitutes acceptance of the updated policy.
For any privacy-related questions, data requests, or complaints:
We aim to respond to all enquiries within 5 business days.