Privacy Notice

Version 2026-11-03-draft · 7 November 2026

Draft, not yet in force. Trade Quotes is in testing. These terms will be finalised before paid use opens, and you'll be asked to agree to the final version.

1. Who we are

Trade Quotes is run by [Your legal name, or company name and company number], trading as Mojo-Wikit, of [postal address] ("we", "us"). We are the controller of the personal data described in this notice. Contact us about privacy at support@quotes.mojo-wikit.com.

[ICO registration number, once registered]

2. What this notice covers

It covers the people who use Trade Quotes: tradespeople and the businesses they run, including people who ask for an invite. It also explains, in section 5, how we handle the customer details that tradespeople put into their quotes and invoices. For those, the tradesperson is in charge and we act on their behalf.

3. Information we collect

• Login details: your email address and your password, which is stored only as a scrambled (hashed) value we can't read.
• Business details you enter: business name, trade, address, phone, email, website, company and VAT numbers, your Unique Taxpayer Reference (UTR) and CIS rate if you switch CIS on, logo, accreditation details, pricing settings and terms, and the bank details or payment link you choose to print on your invoices.
• Your working data: saved parts and prices, how often you use each saved part on quotes, products you've chosen from merchant searches (the product, merchant, price and date, so they can be used again), quotes, invoices and credit notes (including any paid date you enter), job lists you type and receipt photos you upload, and your jobs diary: the dates and times of jobs, quote visits and days you're not available, site addresses, your notes on each job, which materials you've ticked as bought, when a customer said they want the work done (noted on the quote), and your weather warning settings. If you use the diary's calendar links (Settings → Diary): whether your jobs feed is on (the private link itself is kept only in a scrambled form we can't turn back into the link), and, if you link your own calendar, its private address, stored encrypted.
• Voice notes: if you use Talk it through, the recording you make and the text it's turned into. We use them once, to fill in the quote, and don't store either.
• Plan and payment information: your plan, renewal dates, credits used and bought, and the reference numbers Stripe gives us. Stripe handles your card details; we never see or store them.
• Your Stripe account for card and bank payments: if you connect a Stripe account so customers can pay your invoices online, we send Stripe your business name and login email to start setting it up, and keep the account's reference number and whether Stripe says it's ready to take payments (and why not, if it isn't). You give Stripe your business, identity and bank details on Stripe's own pages; we never see them. The account is yours, under your own agreement with Stripe.
• Invite requests: if you ask for an invite on our join page, your name, business name, trade, email address, phone number if you give it, and which business's referral link you used, if any.
• Referrals: which business referred yours, and for the business that referred you, whether you have joined. See section 4A.
• Messages you send us: what you write in Contact us or email to support@quotes.mojo-wikit.com, any files you attach, and, with a Contact us message, your business name and ID, plan, login email, the screen you were on and your browser type, so we don't need to ask.
• Usage and technical information: when you sign in, which AI features you use and their cost, your IP address and device information in security and error logs, and messages we send you.

4. How we use your information

We don't sell your data, use it for advertising, or use it to train AI models.

4A. Invite requests and referrals

When you ask for an invite, we use what you send only to decide whether to invite you and to contact you about it. It is emailed to us so we can look at it. If you came through a referral link we record which business's link it was, and we may compare your email address with theirs to stop people referring themselves.

If we invite you, your business is linked to the business that referred you. That business sees your business name once you have set up your login, and whether it has earned its reward. It never sees your plan, what you pay or anything else in your account. To work out the reward we count how many months of your plan have been paid, from the records Stripe sends us.

You don't have to give a phone number. If you don't want the referring business to know you've joined, ask for an invite without using their link.

4B. Automatic answers to support messages

When you email our support address or use Contact us, your message is sent to Anthropic, our AI provider, to check whether our user guide answers it. If it's a how-to question the guide fully answers, you get an automatic reply drawn from the guide, clearly marked as automatic. Questions about payments, refunds, cancelling, faults, complaints, your personal data or your own account, replies in an ongoing conversation, messages with attachments or pictures, and email whose sender can't be verified always go to a person and get no automatic reply. An automatic reply only goes to the address the message came from, or to your login email for Contact us. Every message also comes to a person, whether or not it was answered automatically, and replying to an automatic answer reaches a person. If a message isn't answered from the guide, you get an automatic note saying it has been passed to a person and when to expect a reply (not for replies in an ongoing conversation, automatic mail, or more than one automatic email a day). The AI gets your message, its subject and, with Contact us, your plan and the screen you were on; it doesn't get your email address or anything else from your account. We keep a short record of each message's outcome (when it came, the sender's email address, the subject, what it was about in a few words, whether it was answered, the reply we sent, and whether we told you a person would reply) for 90 days. No automatic answer has any legal or similarly significant effect on you.

5. Your customers' details

When you add a customer's name, address or contact details to a quote, an invoice, your saved customer list or your jobs diary (with the dates you're booked to work for them, the site address and your notes), you are the controller of that information and we process it only to provide the service to you. The terms we follow are in the Schedule to our Terms of Use. You should tell your customers how you use their details, for example in your own privacy notice.

If you turn on "Add jobs to my phone's calendar", your jobs (customer names, the job, site addresses, phone numbers and quote numbers) are sent, through a private link only you have, to the calendar service you add it to, such as Apple iCloud, Google Calendar or Microsoft Outlook. That's your choice, and that provider then holds those details under its own terms with you; it isn't one of our sub-processors. Anyone you give the link to can see your jobs, so keep it to yourself; you can make a new link (the old one stops at once) or turn it off at any time.

If you link your own calendar with "Show my own calendar here", we read it from the address you give us to show your appointments in the diary and to count them when looking for a free day. Its titles are shown to you but never saved to our database: they're held only in our server's memory, for up to 30 minutes. We keep only the times you're busy, replaced at each read (at most every 30 minutes, when you open the diary) and deleted after 2 days without a read, when you remove the link, or when you close your account. The address itself is stored encrypted.

For our own monthly totals we count how many quotes are made in each postcode area, using only the first half of the postcode on the quote (for example IP14). The counts aren't linked to a customer or kept with an address, and areas with fewer than 3 quotes in a month are counted together. We also count how many businesses are in each postcode area, from the first half of the postcode in your Settings. We use these counts, for example, to see where the app is used and to plan weather warnings.

Customer names and contact details you type are not sent to AI. If you use "Bring your records in" to bring over customers, parts, quotes or invoices from another app, a spreadsheet or your old paperwork, the files are uploaded to us. For a spreadsheet, only its first few rows (its headings and a handful of example rows, with email addresses and phone numbers replaced by placeholders, but names and addresses as they are) are sent to Anthropic so it can tell which column holds what; the rest is read by our own code. A PDF or photo is sent to Anthropic whole, and a Word document as its text, including any customer details in them, so they can be read; the file's name and your business name go with it. Nothing is added to your lists until you've checked it and pressed Add. If you use Talk it through, what you say, including any customer details you say, is sent to ElevenLabs to turn into text and then to Anthropic to fill in the quote. When you ask "Why might this have lost?" on a declined or expired quote, the AI provider gets the job, notes and lines of that quote (descriptions, quantities, prices, mark-ups and hours), its totals and how long it was open, figures worked out from your other quotes, and the first half of the postcode (for example IP14) so prices can be compared locally. The customer's name, address, phone number and email are not sent, and we take them out of the job and notes if they appear there. A person whose details are in a tradesperson's quote or invoice should contact that tradesperson first; we'll help the tradesperson respond.

If you send a quote online, your customer gets a private link to a page showing the quote as you sent it, with your business details (and, if you let them pick a start date, the next free start dates in your diary and how many days the job takes; never what's booked). When they open it, we count how many times it was opened and when (not who opened it or from where). When they accept, decline or ask a question there, we keep what they type (the name they accept in, the start date they pick from your diary and whether they asked for work to start within their 14-day cancellation period, any note, their reason for declining, their question and the phone number or email they give for your reply), their signature if you asked for one, the time, their IP address and their browser, and pass it to you in the app and by email. You are the controller of all of this, as for the rest of your customers' details. We never contact your customer: nothing is emailed or texted to them by us. The record of an acceptance is kept with its quote as your record of the agreement; the IP address and browser are removed after 24 months.

If you take card and bank payments (you connect a Stripe account and choose the pay link), each invoice gets a private link to a page showing what's owed, with your business details and the invoice's number, date, job and your customer's name (never their phone number or email address). When they open it, we count how many times and when (not who or from where). When they tap Pay, we ask Stripe to start a payment on your Stripe account for the amount owed, with the invoice number and job; your customer gives their card or bank details to Stripe on Stripe's own page, and we never see them. When they've paid, we keep the amount, how they paid (card or banking app), when, Stripe's fee and Stripe's reference for it, mark the invoice paid and tell you in the app and by email. You are the controller of this, as for the rest of your customers' details; for the payment itself, Stripe acts for you and as a controller in its own right, under its own privacy policy. We never contact your customer; Stripe may email them a receipt from your Stripe account if you have receipts turned on there.

If you pay subcontractors and switch on "Paying subcontractors", you can keep their details here too: name, trading name, address and contact details, Unique Taxpayer Reference (UTR), National Insurance number or company number, the CIS rate and verification number HMRC gave you, and the payments you make them with the CIS taken off. You are the controller of that information as well, and we process it for you on the terms in the Schedule. UTRs and National Insurance numbers are stored encrypted. None of it is sent to AI or to HMRC: you verify subcontractors and file returns on HMRC's own service. If you use the monthly return reminders, the reminder email gives totals only, not subcontractors' names.

5A. If a business sent you a quote online

If a tradesperson sent you a link to a quote, the page is shown for them by Trade Quotes. They are responsible for how your details are used (they're the controller); we host the page and keep the records for them. When you open the quote we count that it was opened and when (the page keeps a random number in your browser tab, deleted when you close it, so one visit is counted once). The quote and its PDF show your name and address as the business wrote them, but not your phone number or email address. If you accept, decline or ask a question, what you type (and your signature, if they asked for one), the time, your IP address and your browser are recorded and passed to the business, so they have a record of what you agreed and can reply to you. We don't contact you, and we don't use your details for anything else. The page sets no cookies. For anything about your details, contact the business that sent you the quote; if you can't reach them, contact us at the address in section 1 and we'll pass your request on.

5B. If a business sent you a link to pay an invoice

If a tradesperson sent you a link to pay their invoice, the page is shown for them by Trade Quotes. They are responsible for how your details are used (they're the controller); we host the page for them. When you open it we count that it was opened and when (the page keeps a random number in your browser tab, deleted when you close it, so one visit is counted once). The page and the invoice PDF show your name and address as the business wrote them, but not your phone number or email address. You pay on Stripe's own page, into the business's own Stripe account: you give your card or bank details to Stripe, never to us or the business, and Stripe uses them under its privacy policy. We're told only that you paid, how much, how (card or banking app) and when, and we pass that to the business. We don't contact you. The page sets no cookies (Stripe's page may set its own). For anything about your details, contact the business that sent you the link; if you can't reach them, contact us at the address in section 1 and we'll pass your request on.

6. Who we share information with

We use these service providers (sub-processors) to run Trade Quotes. Each may only use the data to provide its service to us.

Stripe also uses payment data for its own purposes, such as fraud prevention and regulatory checks, as a controller in its own right, under its privacy policy.

If weather warnings are switched on, the forecast for an outdoor job comes from the Met Office. We send it only the position of the middle of the job's postcode area (the first half of the postcode, for example IP14, which covers thousands of homes), never an address, a full postcode, a name or anything else about you or your customer. That isn't personal data, so the Met Office isn't one of our sub-processors; we list it here to be open about it. One area's forecast is shared by every business with jobs there, and kept for 7 days.

Merchant searches go to builders' merchants' websites using product descriptions only, never your personal data. A lost-quote review searches the web for typical UK prices for the job, using a description of the work and at most the first half of the postcode. We may also share information if the law requires it, to protect our rights, or with a buyer if the service is transferred to someone else (we'd tell you).

7. Transfers outside the UK

Some providers in section 6 are based in, or process data in, the United States. When personal data goes outside the UK, we rely on UK adequacy regulations, such as the UK–US data bridge for certified US companies, or on the UK International Data Transfer Agreement or Addendum built into our providers' contracts.

8. How long we keep information

9. Cookies

Trade Quotes uses one cookie, which keeps you signed in for up to 6 months. It is strictly necessary for the service, so it doesn't need your consent. We don't use analytics, advertising or tracking cookies. Stripe sets its own cookies on its checkout and billing pages.

10. Security

Data is encrypted in transit, passwords are stored only as hashes, each business can see only its own data, and sign-in attempts are limited. Our providers keep data in secure data centres. No system is completely secure; if a breach puts your rights at risk, we'll tell you and the ICO as the law requires.

11. Your rights

You have the right to:

• get a copy of your personal data;
• have inaccurate data corrected;
• have your data deleted, or its use restricted, in some circumstances;
• object to our use of your data based on legitimate interests;
• receive data you gave us in a commonly used format, and have it sent to someone else.

You can download a copy of your data, and close your account, yourself in Settings under Your data. In the first 30 days of your first paid plan you can also use Start fresh there, once, to delete what you made while trying the app (quotes, invoices, customers, the diary and the rest you tick): it's deleted straight away, not after 30 days. To use any of these rights in another way, email support@quotes.mojo-wikit.com. We'll reply within one month. It's free unless a request is clearly unfounded or excessive.

12. Complaints

Please contact us first so we can try to put things right. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

13. Changes to this notice

We'll update this notice when how we use data changes, and email you about important changes before they apply. This version is dated 7 November 2026.