Your privacy in TradePot
How the app and website use your information during private testing.
Updated 1 October 2026 · Operated by Nicholas Taylor, trading as TradePot.
Your account and business records
We use the information you provide to run your account, create business documents, organise expenses and payments, calculate supported estimates and provide support. This can include your name and contact details, business and customer details, addresses, invoice payment details, tax settings, invoices, estimates, expenses, attachments and saved activity.
Signed-in accounts use Supabase for authentication, database records and file storage, and Vercel to host TradePot's web services. If you choose Apple or Google sign-in, that provider supplies the authorised account information; TradePot does not receive your Apple or Google password. Technical connection and service information is processed to deliver and protect the service.
TradePot also keeps account state and records on your device so the interface can remember your work. Demo records stay in local app or browser storage and do not create a cloud account. Loading the website still contacts our hosting service.
Website enquiries
When you contact us through the website, we privately store your name, email, enquiry type, message and optional trade or business name to review and respond. We also keep keyed hashes of connection and message details to prevent abuse and duplicate submissions. The enquiry form does not subscribe you to marketing emails or automatically enrol you in early access.
Enquiries use the same Supabase and Vercel services as the app. Unhandled requests remain available for follow-up. Once a request is closed, our retention process can remove it after 90 days. Contact help@trade-pot.com if you want to ask about or remove an enquiry.
If enquiry email notifications are enabled, Resend processes a copy to send to our support mailbox. Removing a database enquiry does not automatically remove email copies; you can contact us about those copies too.
Receipts, photos and your logo
Receipt reading runs on your device in the browser or in-app web view. The reading step does not send your receipt to an external AI service. You review or edit the results before saving. In a connected account, confirming an expense uploads its original receipt to private business storage. Demo mode keeps the expense details but cannot retain the receipt file.
Optional invoice and estimate photos are stored privately and can be included in the previews, PDFs and customer links you choose to share. Business logos use public image URLs so they can appear on your documents; only upload a logo you intend to make public. Keep your own copies of original evidence.
Documents you share with customers
A customer link contains the saved invoice or estimate, including its customer details, document photos and the contact or payment details you included. Anyone with the full link can open it, so share it only with the intended recipient. You can revoke a link from the document's sharing controls.
When a recipient chooses to view a document, TradePot records the link's first opening so the business can see that it was used. For an estimate response, we also record the accepted or declined response, the entered name and the response time. This does not identify every person who may use or forward a link. Revoking a link cannot retrieve a copy someone has already downloaded.
Optional HMRC services
You can invoice, record expenses and track your business without connecting HMRC. If you authorise an available HMRC service, TradePot stores encrypted connection credentials, the relevant taxpayer reference, retrieved business information and obligations. Your Government Gateway password stays with HMRC. Reviewed submission figures, responses and receipts are saved as filing history, including after disconnection.
HMRC requests include the fraud-prevention information its service requires: a random device identifier, browser and screen details, time zone, connection information, and your TradePot account identifier and sign-in email or phone number. Availability is shown in HMRC connections; a test connection does not send a real return. You can disconnect a service in TradePot and manage its authorisation in your HMRC account.
Optional device notifications
When delivery is available and you enable it, we store the browser push subscription or iPhone push token, associated account, business and notification preferences. Browser notifications use your browser's push service. iPhone notifications use Expo and Apple Push Notification service (APNs). These providers process the delivery token and notification payload.
Notification text is general: it does not include tax amounts, customer names or taxpayer references. A technical business identifier helps open the right workspace. Delivery records help us check failures; provider acceptance is not proof that you saw a message. You can disable notifications in TradePot settings or your device or browser controls. Unavailable delivery is shown in Settings, and demo mode does not register for device reminders.
Retention and deletion
Saved business records and filing evidence remain available while your account is in use. Disconnecting HMRC, logging out or uninstalling the app does not delete your cloud account or filing history.
You can request deletion of your account and associated personal data. Requests are reviewed manually; submitting one is not immediate erasure. We check account ownership and which records can be removed. If a specific legal or security requirement means information must be retained, the response must explain what is retained, why and the applicable period. TradePot cannot delete records held independently by HMRC or copies already downloaded by your customers.
Request account or data deletionYour choices and questions
You can edit business details in Settings and download supported records from the Export Centre. Contact us about access to your data, corrections, deletion or other privacy rights. If a customer has entered your details on a document, include the business name or document reference so we can identify the relevant record; do not send passwords or tax identifiers.
Contact Nicholas Taylor at help@trade-pot.com. You can also raise a concern with the Information Commissioner's Office (opens in a new tab).