Privacy policy

Draft: to be checked by a solicitor before PlasterPal is offered to customers.

Last updated 7 October 2026

This explains what personal information PlasterPal keeps, why, who else sees it and what you can do about it. We keep it short and plain on purpose. If anything is unclear, email us at [contact email].

Who we are

PlasterPal is run by [Company name] Ltd (company number [company number]), [registered address]. We are registered with the Information Commissioner's Office (ICO) under number [ICO registration number].

For your own account (you, the tradesperson using PlasterPal), we are the "controller": we decide how your details are used.
For your customers' details (the people you quote for), you are the controller and we are your "processor": we only store and use them to run PlasterPal for you, as set out in our terms.

What we keep

Your account: your name, business name, email address, password (stored scrambled, so nobody can read it, including us), trades, prices, quote and invoice settings, and bank details you add for invoices.
Your work: contacts, quotes, jobs, invoices, payments you record, and costs.
Your customers: the names, addresses, phone numbers and emails you enter, and any message they send when they accept a quote online.
Subscription: whether you're on a free trial or subscribed, and the date of your next payment. Card details are held by Stripe, never by us.
Card payments from your customers (if you switch them on): the link between your PlasterPalaccount and your own Stripe account, and how each job was paid. Your customers' card details go straight to Stripe, never to you or us.
Technical: your internet address, kept for a short time to stop people guessing passwords, and error reports when something breaks (these don't include your customers' details).
Feedback: any message you send us from the app, with your name and email so we can reply.
Usage: the dates you used PlasterPal (just the date, not which pages, when or where), and counts of how many quotes you've made, sent and had accepted. We use these to see whether PlasterPal is helping and what to improve. We don't use tracking tools or share these numbers with anyone.
Referrals: your referral code, who referred you (if anyone), and the referral credits you've earned. The person who referred you sees only how many people signed up with their code and how many pay, never your name or details.

Why we keep it

To provide PlasterPal to you, under our contract with you (your terms with us).
To take subscription payments and keep tax records, which the law requires.
To keep PlasterPal secure and working (stopping password guessing, fixing errors), and to improve it (reading feedback, counting how much it's used). This is our "legitimate interest".
To email you about your account, such as password resets and when a customer accepts a quote.

We never sell your data, never use it for advertising, and never send you marketing without asking first.

Who else sees it

We use a few trusted companies to run PlasterPal. Each only gets what it needs:

Supabase: stores the database and logins, in London.
Vercel: runs the website. Pages pass through its servers, which may be outside the UK.
Stripe: takes subscription payments and holds card details. If you take card payments from customers, your own Stripe account handles them, under Stripe's terms with you.
Resend: sends emails (quote links, password resets).
Sentry: receives error reports so we can fix problems.

Where any of them handles data outside the UK, they do so under the UK's approved safeguards (such as the International Data Transfer Addendum).

Your customers only see what you send them: a quote link shows that quote and your business name, never your notes, costs, other jobs or bank details.

How long we keep it

While your account is open, we keep your data so you can use it.
If you delete your account (Settings, then "Delete my account"), your account and everything in it are deleted straight away. Copies in backups are overwritten within 30 days.
Subscription and payment records are kept by Stripe for as long as tax law requires (usually 6 years).
Internet addresses used to stop password guessing are deleted within a day.

Your rights

You can:

Get a copy of your data: Settings, then "Download all my data".
Correct it: change anything in the app, or ask us.
Delete it: Settings, then "Delete my account".
Object to or limit how we use it, by emailing us.

If your customers ask you about their data, you can find, change, download or delete it in PlasterPal. If they ask us, we'll pass the request to you.

If you're unhappy with how we've handled your data, please tell us first. You can also complain to the ICO at ico.org.uk or on 0303 123 1113.

Cookies

PlasterPal uses one kind of cookie: the one that keeps you logged in. It's essential for the app to work, so the law doesn't require us to ask first. We don't use advertising or tracking cookies, so there's no cookie banner. Customer quote links don't set any cookies.

Changes

If we change this policy in a way that matters, we'll tell you by email or in the app before it takes effect.