Privacy Policy

This Privacy Policy explains how TradeShot ("we", "our", "us") collects, uses, stores, and shares your personal data when you use our iOS application and related services (the "Service"). TradeShot is operated as a sole trader business based in the United Kingdom.

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU GDPR where applicable. By using the Service, you agree to the processing of your information as described in this policy.

1. Who We Are

TradeShot is a mobile application that helps tradespeople generate AI-powered before/after visualisations of construction, renovation, and home-improvement projects to share with their customers.

The data controller for the purposes of UK GDPR is the operator of TradeShot, contactable at cosminfisher2001@gmail.com.

2. Information We Collect

2.1 Account information

• Email address (used for sign-in and account recovery)
• Password (stored as a salted hash by our authentication provider — we never see or store your raw password)

2.2 Business profile information

• Trading name / business name
• Contact phone number
• VAT registration number (optional)
• Profile or business logo image (optional)

2.3 User-generated content

• Photos you upload or capture in-app (e.g. of customer spaces)
• Project descriptions and prompt text you enter
• AI-generated visualisations produced from your inputs
• Jobs, quotes, calendar entries, and customer details you add to the app

2.4 Subscription and payment information

All subscription payments are processed by Apple Inc. through the App Store. We do not receive or store your payment card details. We receive only an anonymised subscription status (active, expired, cancelled) from Apple.

2.5 Technical and diagnostic information

• Device type, operating system version, and app version
• Crash logs and basic usage diagnostics (used to fix bugs)

3. How We Use Your Information

4. Third-Party Processors We Share Data With

We only share data with the processors below, and only the minimum amount needed to operate the Service. Each processor is bound by its own privacy and security commitments.

4.1 Supabase Inc.

Provides our authentication, database, and photo storage infrastructure. Your account data, profile information, photos, and app-generated records (jobs, quotes, etc.) are stored on Supabase servers. Data is encrypted in transit and at rest.

See Supabase's Privacy Policy.

4.2 Fal AI, Inc. (fal.ai)

Processes the photos and prompts you submit in order to generate AI visualisations. When you tap "Generate", your photo and prompt text are sent to fal.ai's API, processed by their AI model infrastructure, and the resulting image is returned to the app. fal.ai acts as a processor on our behalf and does not use your photos to train their models.

See fal.ai's Privacy Policy.

4.3 Apple Inc.

Handles all subscription payments as the merchant of record for the App Store. Apple receives your payment details directly; we receive only your subscription status.

See Apple's Privacy Policy.

We do not sell your personal data to anyone, and we do not share it with advertisers or marketing networks.

5. International Data Transfers

Some of our processors (notably fal.ai and Apple) operate servers outside the UK and EEA, including in the United States. Where data is transferred internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, Standard Contractual Clauses, or equivalent mechanisms approved under UK GDPR.

6. Data Retention

• Account data: kept while your account is active. Deleted within 30 days of account deletion.
• Photos and visualisations: kept while your account is active or until you delete them from the in-app gallery.
• Diagnostic logs: kept for up to 90 days, then automatically purged.
• Records we are legally required to retain (e.g. financial records for tax purposes): kept for the minimum period required by law (typically 6 years in the UK).

7. Your Rights

Under UK and EU GDPR you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten")
• Restrict or object to processing
• Portability — receive a copy of your data in a machine-readable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority

To exercise any of these rights, email cosminfisher2001@gmail.com. We will respond within 30 days.

You can also delete your account directly from the app by going to the Profile screen and tapping "Delete Account". This permanently removes your account, profile, photos, jobs, quotes, and visualisations.

8. Children's Privacy

TradeShot is intended for business use by adult tradespeople. We do not knowingly collect personal data from anyone under 18 years of age. If you believe a child has provided us with personal information, please contact us and we will delete it.

9. Security

We take reasonable technical and organisational measures to protect your data, including:

• Encryption in transit (HTTPS/TLS) for all data exchanged between the app and our servers
• Encryption at rest for stored data and photos
• Hashed and salted passwords (we never store raw passwords)
• Row-level security policies to ensure users can only access their own data
• Restricted administrative access on a need-to-know basis

No system is 100% secure. If we ever discover a data breach affecting your personal data, we will notify you and the relevant supervisory authority within 72 hours where required by law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will also notify you via email or an in-app message.

11. Contact Us