Privacy Policy

Who we are

Trame is a job management tool for UK tradespeople. We are the data controller for the personal data you provide when using Trame. Trame Software Ltd is registered in England and Wales, company number 17181192. Registered office: 66 Paul Street, London, EC2A 4NA. We are registered with the Information Commissioner's Office (ICO), registration number CSN5164567. If you have questions about this policy, contact us at privacy@trame.co.uk. For security vulnerabilities, email security@trame.co.uk.

What data we collect

Contractors (registered users): name, email address, phone number, company name, trade, and any information you add to your Trame account such as price book items, job notes, and quote details.

Homeowners (enquiry submitters): name, email address, phone number, property postcode, and the job details you provide when filling in a contractor's intake form. This data is processed on behalf of the contractor you contacted.

Usage data: standard server logs including IP addresses, browser type, and pages visited.

Why we collect it

We process contractor data to provide the Trame service, including managing jobs, quotes, and invoices. The lawful basis is contract performance (UK GDPR Article 6(1)(b)).

We process homeowner data to enable contractors to respond to job enquiries. The lawful basis is legitimate interests (UK GDPR Article 6(1)(f)), specifically the homeowner's interest in receiving a quote and the contractor's interest in managing their pipeline.

How long we keep it

Contractor account data is kept for as long as your account is active. If you delete your account, we remove your data within 30 days, except records we must retain to meet legal or financial obligations.

Homeowner data submitted via intake forms is kept for as long as the associated contractor account is active. Contractors can delete individual jobs and associated data at any time.

Assistant conversations: We store conversations, including messages and replies, for 90 days from their last activity. You can delete your own conversations sooner. Other members of your company cannot view them. Deleting a conversation does not undo actions you confirmed or delete the resulting business records. We retain a minimal record of completed actions and usage while the company account exists, to identify what happened and manage the service. This record contains identifiers, action details, dates and usage counts, without the deleted conversation text or confirmation preview.

Who we share it with

We use Supabase to store data (servers in the UK, London region) and Vercel to host the application (servers in the UK, London region). We use PostHog for product analytics (servers in the EU); this records page visits and feature usage to help us improve the product. With your consent, we use the Meta Pixel (operated by Meta Platforms Ireland Ltd) to measure the effectiveness of our advertising on Facebook and Instagram, and Google Ads tags (operated by Google Ireland Ltd) to measure conversions from our Google advertising. We do not sell your data or share it with third parties for marketing purposes beyond this.

Enquiry processing: We send job descriptions, answers to enquiry questions and uploaded photos to Anthropic through its Claude API to generate follow-up questions and job summaries. We remove the dedicated name, email, phone and postcode fields before generating a summary. Personal information included in written answers or photos may still be sent.

Assistant: When you send a message to the Assistant, we send your message, relevant conversation history and the records needed to answer your request to Anthropic. You can attach the enquiry, job, client, quote or invoice you are viewing. Record lookups can include customer names, the first part of a postcode, saved job descriptions, enquiry descriptions, summaries and answered questions, quote and invoice line descriptions, statuses and financial amounts. We exclude dedicated email, phone and full-address fields, internal notes and enquiry photos from these lookups. Personal details written in descriptions, answers or your messages may still be sent. We save the attached record reference with each message. The Assistant runs when you ask it to. It is enabled by default, and the company owner can turn it off in Settings.

Anthropic API processing for enquiry summaries and the built-in Assistant: Anthropic does not use commercial API inputs and outputs to train its models by default. Its separate policies cover feedback or other permission to use data. Anthropic normally deletes API inputs and outputs within 30 days, with exceptions including legal requirements, enforcement of its usage policy, and services or agreements with different retention periods. Deleting a conversation in Trame does not control Anthropic's separate retention. Read Anthropic's commercial training policy and retention policy.

International processing for these API features: Anthropic stores data in the United States and may process it in other countries. Its Data Processing Addendum includes standard contractual clauses and a UK Addendum for applicable international transfers. See its processing locations.

Requested emails: We use Resend to deliver emails, including quotes and invoices you ask Trame to send. It receives the recipient address, message content, links and any attached quote or invoice PDF needed for delivery.

We may share data with law enforcement if required by law.

Connecting ChatGPT or Claude

Where available, you can choose to connect your Trame account to ChatGPT, operated by OpenAI, or Claude, operated by Anthropic. These connections are separate from the Assistant inside Trame. You sign in with Trame and review the requested access before connecting. The connection uses access tokens, not your Trame password, to make requests. Access is limited by the connection permissions and your current Trame account permissions.

What is shared: When the connected service calls a Trame tool, we receive the request and return the records or action results needed to handle it. Depending on the request and permitted tools, this can include customer names, job and enquiry descriptions, saved answers, saved prices, quote and invoice lines, notes, dates, statuses and financial amounts. A delivery review can include the saved recipient email address. Downloaded quote and invoice PDFs can include customer addresses, your business contact details and payment details shown on the document. Personal information written into descriptions, notes or answers may also be shared. Do not assume the field exclusions described for the built-in Assistant apply to these connections.

What Trame receives and stores: The provider can send your instructions, document details or relevant conversation context as part of a tool request. Connecting does not give Trame general access to your other chats. We store the account and company linked to the connection, its permissions, authentication and token records, private document preparations, review snapshots and action results. For requested emails and enquiry photo copying, we also keep the delivery or copying records needed to complete the action and check its outcome. We use these records to provide the connection, continue unfinished work, prevent duplicate actions and investigate failures.

Connection usage: Where connection analytics are enabled, we send PostHog the connected service, tool or action used, timing, outcome and retry information, together with account and company identifiers and hashed connection or document references. These events do not contain chat text, customer names, document contents or financial amounts. They are linked usage records, not anonymous data.

How long connection records are kept: Saved quotes, invoices, jobs and customers follow the account-data retention described above. A preparation or review can expire before its stored details are removed. During the current limited pilot, automatic age-based deletion of connection history is not enabled. We retain connection and operation history while the associated company account exists, unless removed following a deletion request, subject to records we need for unresolved actions, security or legal obligations. Disconnecting does not itself delete this history. Contact privacy@trame.co.uk about access or deletion.

Disconnecting: Use Settings, Integrations, Connected apps in Trame to disconnect a connection and revoke its future access. Removing it only in the other service may not revoke its Trame access. Disconnecting does not undo saved or issued documents, retract emails, cancel actions already committed or remove information already shared with the provider. Manage or delete that provider's chat history separately.

The provider's handling: ChatGPT and Claude process the information they receive under the terms, privacy policy and controls for your account with them. Storage locations, retention and use for model improvement depend on the service, plan and settings. The commercial API rules described above for Trame's built-in features do not apply automatically to your ChatGPT or Claude chats. Read OpenAI's privacy policy or Anthropic's privacy policy before sharing customer information.

Your rights

Under UK GDPR you have the right to access, correct, or delete your personal data; to object to or restrict processing; and to data portability. To exercise any of these rights, email privacy@trame.co.uk. We will respond within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Reporting a security issue

If you believe you've found a security vulnerability in Trame, please email security@trame.co.uk. We aim to acknowledge reports within two working days. Please do not publicly disclose the issue until we've had a chance to investigate and respond.

Cookies

Trame uses session cookies required for authentication. These are strictly necessary and do not require your consent.

With your consent, we set additional cookies. Analytics: PostHog records page visits and feature usage to help us improve the product. Advertising: the Meta Pixel records conversions and page visits to measure the effectiveness of our advertising on Facebook and Instagram. Google Ads tags record conversions to measure the effectiveness of our Google advertising; Google Consent Mode v2 is active, meaning no advertising cookies are set without your explicit consent. You can accept or decline these when you first visit the site, and change your choice at any time via the cookie settings link in the footer.

Changes to this policy

We will update this policy as the product evolves. Material changes will be communicated by email to registered users. Continued use of the service after changes constitutes acceptance.