This policy explains what personal information TradeControl collects, why, who it is shared with, and what you can ask us to do with it. It covers the website at www.trade-control.com, the TradeControl app, and the public demo docket at /try.
Who we are
TradeControl is a product of Specdoor Ltd (Company No. 16727754, England and Wales). You can contact us about privacy at admin@trade-control.com. [Australian business details and whether TradeControl is bound by the Australian Privacy Principles as an APP entity — to be confirmed. The legal entity is registered in England and Wales, so whether UK data protection law also applies is to be confirmed.]
What we collect
When you sign up or log in
- Your name, work email, mobile number, company name and trade, and the password you choose.
- If you sign in with Google: the name and email address Google provides.
- If you sign up through /signup/site: your first job's name and site address and the builder's email.
- The page you first arrived on, recorded as a short page name (not your browsing history).
When you use the app
- Jobs and contacts: job names and site addresses, and the names, roles, emails and phone numbers of builder and contract contacts you add.
- Day dockets: the supervisor's name, workers' names and trades, hours, materials, descriptions of the work, signatures, and photos. Photos are stored as your phone took them, so they may contain location and time data that your phone added.
- Site forms: attendees' names and signatures. Incident reports can include injury details, and return-to-work forms can include medical restrictions and a photo of a medical certificate, which is health information.
- Site issues: descriptions, who reported them, photos and voice notes.
- Meetings, if your organisation uses them: audio recordings, transcripts, speaker names, and a record that the participants were told about the recording.
- Your conversations with the in-app assistants, and any feedback you give on their answers.
- Your saved signature, your display preferences, and a push-notification subscription if you allow notifications.
When you book a demo or try the demo docket
- Demo bookings: your name, company, email, phone, role and notes. We receive these by email and do not store them in our database.
- The /try demo docket: everything you type into the docket and the email address you give. We email the finished PDF to that address and keep a record of your name, email, company, docket number, job name, hours, labour cost and IP address, which we use to send a short series of follow-up emails (each with an unsubscribe link). We do not keep the signatures or photos.
Billing
Payments are handled by Stripe. We store your Stripe customer and subscription references and your subscription status. Your card details are held by Stripe, not by us.
Product events
We record product events, such as a page view on a template, a calculator being used or a trial starting, linked to your organisation and account where you are logged in. We do not store your IP address or browser details with these events. They are recorded only on the live site, and automated traffic is ignored.
How we use it
- To provide the service: create your account, store your records, and produce and send dockets, forms and reports.
- To run the AI features you use (see below).
- To bill your subscription and manage your trial.
- To send account emails, and trial and product emails about TradeControl.
- To understand how the website and app are used and to improve them.
- To keep the service secure and to meet legal obligations.
Emails sent from TradeControl on your behalf
When you submit a docket or a form, TradeControl emails it to the recipients you or your organisation choose, such as the builder's project manager. [To be confirmed before this section is published.]
Who we share it with
We use these service providers to run TradeControl. Each receives only what it needs for its part:
- Supabase: database, sign-in and file storage (everything above).
- Vercel: website and app hosting.
- Resend: sending email.
- Stripe: billing.
- Anthropic: the AI features (the docket, photo, voice, scope document and site-issue content you send them).
- Deepgram: meeting transcription, if your organisation records meetings.
- Cohere: the text of scope-of-works searches, to find matching clauses.
- Twilio: text-message invitations (the invitee's mobile number and an invitation link).
- Google: address suggestions when you type a site address, Google sign-in, and a signature font.
- Calendly: demo booking, where it is offered.
- Integrations your organisation sets up, such as a workflow that sends toolbox-talk records to another system.
Some of these providers store or process information outside Australia. [Countries for each provider — to be confirmed. Hosting statement — to be confirmed.] We do not sell personal information.
AI features and automated decisions
TradeControl uses AI to draft and summarise: docket descriptions, reading invoice photos, turning voice notes into docket fields, scope-of-works answers, notice and email drafts, meeting summaries, and assistant answers. A person reviews every draft before it is used or sent.
Two features give an advisory assessment that is shown to directors: a review of whether a docket's hours look consistent, and an assessment of who a site issue sits with commercially. Neither decides anything about a person, and neither is sent to anyone outside your organisation.
Some account rules apply automatically: when a free trial ends without a card, access is limited until a plan is chosen, and the trial's limits on jobs and team members are applied by the system. [Whether any of these, or the advisory assessments above, are decisions this policy must describe under the automated decision rules in APP 1 that apply from 10 December 2026, and how to describe them — solicitor pack item P5.]
Cookies and storage on your device
- Sign-in cookies set by Supabase keep you logged in. They are needed for the app to work.
- Your browser also stores your preferences (such as the colour theme and the job you last opened), drafts you have not yet submitted, and, if you set one, the contact detail and 4-digit PIN you use for quick sign-in on that device.
- Stripe (on the billing page), Calendly (on demo booking) and Google (address suggestions and sign-in) may set their own cookies. [Which cookies each sets — to be confirmed.]
How long we keep it
We keep your records while your organisation's account is open, because they are the record of your jobs. Meeting recordings are kept until your organisation deletes them. [Retention periods after an account closes, and for demo-docket records and product events — to be decided.]
Your choices and rights
- You can ask for a copy of the personal information we hold about you, or ask us to correct it.
- You can ask us to delete your account or your organisation's data. There is no self-service deletion yet, so email admin@trade-control.com. [Response time — to be confirmed.]
- You can unsubscribe from marketing emails using the link in each one. [To be confirmed.]
Security
Access to your organisation's records is restricted to your organisation's users, with directors seeing more than site staff. [To be confirmed before this statement is published. Data breach process — to be confirmed.]
Complaints
If you have a concern about how we handle your personal information, email us first. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (oaic.gov.au). [Complaint handling process and timeframe — to be confirmed.]
Changes to this policy
We will update this page when our practices change and show the date of the latest version at the top.