Privacy Policy
Last updated: 14 June 2026
1. Data Controller
Coral Services LTD (Company No. 11640691) ("we", "us", "our") is the data controller for personal data processed through the TradesMan Quote platform at tradesmanquote.co.uk and app.tradesmanquote.co.uk. For privacy-related enquiries, contact us at: contact@tradesmanquote.co.uk
2. Data We Collect
Account data: When you register, we collect your name, email address, and a hashed (bcrypt) version of your password. Your company name, trading name, phone number, address, postcode, company logo, and trade codes are collected if you choose to provide them in your profile.
Client data: Names, addresses, email addresses, and phone numbers of clients you add to the platform. You are responsible for having a lawful basis to provide client data to the platform.
Job and quote data: Job descriptions, scope-of-works notes, quote line items, prices, and notes. This data is processed to provide the quoting service and is retained indefinitely unless you request deletion.
Uploaded files: Videos, photographs, and PDF drawings you upload for job analysis. These are stored temporarily (see section 5) and are processed by our intelligent media analysis system (see section 4).
Billing data: Your Stripe customer ID, subscription status, and billing history. We do not store card numbers - all payment data is held by Stripe.
Usage data: Platform calls made, credits consumed, system usage for billing and cost monitoring. IP addresses and browser information in server access logs (retained for up to 90 days).
3. Legal Basis for Processing
Contract: Processing your account data, job data, and files is necessary to perform the service you have contracted for.
Legitimate interests: Usage analytics, fraud prevention, and service improvement.
Legal obligation: Retaining billing records as required by HMRC and applicable tax law.
Consent: Where we send you marketing communications (you may withdraw consent at any time).
4. Data Processors (Third Parties)
We use the following third-party services to provide the platform. Each acts as a data processor under our instructions:
5. Data Retention
Uploaded job files: Retained for 14 days after upload, or 14 days after quote approval, whichever is later. Automatically deleted by a Cloudflare R2 lifecycle rule after 30 days from upload as a hard safety net.
Generated PDF quotes and materials PDFs: Retained permanently in R2. Never automatically deleted.
Account and quote data: Retained for the lifetime of your account and for 30 days after account closure.
Billing records: Retained for 7 years as required by HMRC.
Server access logs: Retained for up to 90 days.
6. Your Rights Under UK GDPR
As a data subject you have the right to: access your personal data; correct inaccurate data; request deletion of your data (where no legal retention obligation applies); restrict or object to processing; data portability; and withdraw consent where processing is consent-based.
To exercise any of these rights, contact us at contact@tradesmanquote.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
7. Security
We use httpOnly secure cookies for authentication tokens, bcrypt password hashing (minimum cost factor 12), rate limiting on all API endpoints, file type validation using magic bytes, and encrypted connections (HTTPS) for all data in transit. Files are stored in a private Cloudflare R2 bucket with no public access. Pre-signed URLs with 15-minute expiry are used to serve files on demand.
8. Cookies
We use essential cookies for authentication (httpOnly JWT access and refresh tokens) and analytics cookies (Google Analytics). See our Cookie Policy for full details.
9. Updates to This Policy
We may update this Privacy Policy. Material changes will be notified by email to your registered address with 14 days' notice before they take effect.