Privacy Policy

Two different groups use Blue-Trades, and the distinction matters throughout this policy.

• Contractors — the businesses that subscribe to Blue-Trades, and their employees who sign in. We are the controller of this information.
• A contractor's own customers— homeowners and businesses whose details a contractor records in order to do work for them. We process that information on the contractor's behalf. They decide what is collected and how long it is kept; requests about it should go to the contractor, not to us.

• Account information — name, email address and password for each person who signs in, plus the organization they belong to and their role.
• Business records — jobs, quotes, work orders, invoices, purchase orders, inventory, equipment and the customers they relate to.
• Time and location — clock-in and clock-out times, and where a punch was made ifthe worker's device shares its position. Location is captured at the moment of a punch only; Blue-Trades does not track a device continuously or in the background, and a refused permission never prevents someone clocking in or out.
• Photos and files uploaded against a job, which may carry coordinates recorded when the photo was taken.
• Technical information — IP address, browser and error diagnostics, used to keep the service running and secure.

To provide the service, bill for it, support it, keep it secure, and improve it. We do not sell personal information, and we do not use a contractor's business records or their customers' details to train machine-learning models.

Only the processors needed to run the service, each handling a specific job:

• Supabase — database, authentication and file storage.
• Vercel — application hosting.
• Stripe — subscription billing. Card details go directly to Stripe and are never stored by Blue-Trades.
• Resend — outbound email, such as a quote or invoice a contractor sends to their customer.
• Sentry — error reporting, so faults can be diagnosed.
• QuickBooks Online — only if a contractor connects it, and only then to send their own invoices and customers. The connection is one-way and can be withdrawn at any time from the portal.

We may also disclose information where legally required, or as part of a merger or acquisition, in which case this policy travels with it.

Each contractor's data is isolated at the database level. Access is enforced by row-level security on every table, evaluated on each request against the signed-in user's membership, rather than by application code that could be bypassed. One contractor cannot read another's records.

Data is encrypted in transit and at rest. Access to production systems is limited to staff who need it. Credentials for connected third-party accounts are held where no browser session can read them and are cleared when a connection is withdrawn.

No system is perfectly secure, and we do not claim otherwise. If a breach affects your information we will notify you as required by law.

Business records are kept for as long as a contractor's account is active, because they are the contractor's operating history — job costs, timesheets and invoices that payroll and tax obligations depend on.

A contractor may request deletion of their organization and its records. Some information may be retained where the law requires it, such as billing records for tax purposes.

Depending on where you live you may have the right to access, correct, export or delete personal information, and to object to certain processing.

If you are a contractor's customer, exercise those rights with the contractor who holds your details — they decide what is kept. We will assist them in responding.

Blue-Trades is a tool for businesses and is not directed at children. We do not knowingly collect information from anyone under 16.

We will update this page when this policy changes, and change the date at the top. If a change materially affects how we handle personal information, we will tell account owners directly.

Questions about this policy can be sent to support@blue-trades.com.