Privacy notice

Who we are

Pink Hardhat Ltd is registered in England and Wales, company number 17575962. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We trade as Pink Hardhat and are responsible for the personal data described in this notice.

Contact: hello@pinkhardhat.co.uk. ICO registration number: [TO CONFIRM: ICO registration number].

What we collect

• Account details: your name, email address and password. Passwords are stored by our sign-in service in a form we cannot read.
• Business details: business name, trade, VAT registration answer, CIS status, and the names and email addresses of team members you invite.
• Job records: clients, contacts, agreed terms, variations, payment applications, assessments, invoices, payments received, costs, notes and reminders you enter. These can include names, email addresses and phone numbers of people you work with.
• Uploaded files: photos, PDFs, Word, Excel and email files you add to a job (up to 20 MB each).
• Assistant requests: what you ask the assistant, the job records it used, its reply and whether you used the result. Each request is logged.
• Expert help: the requests you make, the items you choose to share with an adviser, booking times and the adviser's notes.
• Payments: card details are entered on Stripe's pages and handled by Stripe. We do not see or store your card number. We store the Stripe customer and subscription references, plan, status, amounts and dates.
• Interest registrations: your name, email, business name (optional), the service and your message, if you register interest in expert help.
• A history of changes: who changed which commercial record, what it was before and after, and when.
• Technical data: error reports from your browser, and site visit statistics (see below).

Site visit statistics

Our hosting provider's analytics uses no cookies, stores nothing on your device, does not keep IP addresses and does not identify visitors. Lovable collects this data for us. Lovable's privacy policy explains how it handles it.

It records the pages visited, where visitors came from, their country, browser, operating system and device type, how long they stay, how fast pages load, errors, and which buttons and links are clicked. Detailed data is kept for 90 days and daily summaries for a year. This is recorded for every visitor.

What is stored on your device

When you sign in, your browser stores a sign-in session so you stay signed in. While you fill in a form, your browser keeps a draft copy so you do not lose your typing; it is cleared when you save or sign out. Fonts are loaded from Google Fonts, which receives your IP address when the page loads.

Why we use it and our lawful basis

• To provide the service you signed up for: your account, business, job records, files, assistant, reminders and expert help. Basis: performance of our contract with you. [TO CONFIRM WITH SOLICITOR: lawful basis]
• To take payment and keep billing records. Basis: contract, and our legal obligation to keep accounting records. [TO CONFIRM WITH SOLICITOR: lawful basis]
• To keep the service secure, prevent misuse (for example hourly limits on uploads and the assistant) and keep a change history. Basis: our legitimate interests in running a secure, reliable service. [TO CONFIRM WITH SOLICITOR: lawful basis]
• To email you when expert bookings open, if you registered interest. Basis: your consent, given by ticking the box on the form. You can withdraw it at any time by emailing us.
• Personal data of people named in your job records: your business decides what to enter and is responsible for that data (the controller). We process it only on your behalf, to provide the service (as your processor).

Who we share it with

• Lovable (hosting, database, sign-in and file storage, through Lovable Cloud). Your records are stored in the Europe region.
• Stripe (payments, subscriptions and the billing portal).
• The AI model provider: assistant requests, with the job records needed to answer, are sent through Lovable's AI service to OpenAI. [TO CONFIRM: AI provider terms on retention and training use]
• Email: [TO CONFIRM: email sending provider]. Reminder and expert-help emails are not yet being sent.
• Calendly (booking expert calls): your name, email and the call time you choose.
• Advisers: only the items you choose to share for a request, for as long as the share lasts.
• Google Fonts (font files; receives your IP address).
• We do not sell your data and we never send anything to your clients.

Transfers outside the UK

Our database and files are stored in the European Union (France). Stripe and OpenAI may process data in the United States. [TO CONFIRM: transfer safeguards for each provider, such as the UK International Data Transfer Addendum or UK–US data bridge]

How long we keep it

• While your account is active, we keep your records so you can use them.
• If your trial ends or you cancel, your records stay readable and exportable for 12 months. After that they are deleted.
• If the owner deletes the business in Settings, the business, its jobs, files and change history are deleted straight away, apart from billing records kept for 6 years. [TO CONFIRM: backup retention period]
• Assistant request logs are kept for 90 days, then deleted.
• Billing and payment records are kept for 6 years, as UK law requires, even if the business is deleted. Stripe also keeps payment records under its own obligations.
• Interest registrations: kept until bookings open for that service, plus 3 months, then deleted.
• Site visit statistics: 90 days detailed, one year in daily summaries.

Your rights

You can ask to see, correct, delete or restrict the use of your personal data, object to its use, or ask for a copy in a portable format. Email us and we will reply within one month.

The owner of a business can download each job's variations, applications, assessments, receipts, costs, locked applications and documents, and the full change history, from the app. The owner can delete the business under Settings by typing its name. You can change your name, email and password under Settings.

How to complain to the ICO

Please contact us first so we can try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

How to contact us

Email hello@pinkhardhat.co.uk, or write to us at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.