Privacy Policy

This Privacy Policy explains what personal data SeamlessJobs (“we”, “us”, “our”) collects through our web dashboard and mobile applications (the “Service”), how and why we use it, who we share it with, and the choices and rights available to you. We are a UK business and this policy is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Our role: controller and processor

SeamlessJobs is used by field-service businesses (“Organisations”) to run their own operations. Where we process personal data about an Organisation’s own staff or clients (“Your Clients”) to provide the Service, the Organisation is the data controller and we act as a data processor on its instructions, as set out in our Terms of Service. Where we process personal data to run our own business with an Organisation and its users — for example account administration, billing, support, marketing to prospective customers, and improving the Service — we act as the data controller. This policy covers both roles.

2. Information we collect

• Account details: name, email address, phone number, role, and organisation, plus a securely hashed password.
• Business data: client and property records, quotes, invoices, credit notes, payments, timesheets, materials, checklists, and receipt/expense images your Organisation enters or captures, including personal data about Your Clients where your Organisation records it.
• Location data: GPS position captured during clock-in/out and while a visit is in progress, used for attendance and route/dispatch features. This is only collected while a team member is actively clocked in or on an active visit.
• Device and usage data: app version, device type, IP address, and basic diagnostic/error logs, used to keep the Service secure and working correctly.
• Payment data: Subscription payments are handled directly by Apple through the App Store; we never see or store your card details for a Subscription. Where your Organisation accepts payments from Your Clients through its own connected Stripe account, card and bank details are handled directly by Stripe — we store only the resulting transaction records (amount, status, reference), not full card or bank account numbers. If your Organisation adds its own bank account details (account name, account number, sort code) to show on invoices for bank transfer, we store those details encrypted at rest, separately from the rest of your account data; an administrator must re-enter their password and a one-time code sent by email (and SMS, where enabled) to view or change them.
• Communications: support emails and in-app messages you send us.

3. How and why we use it

We use this information for the following purposes, and on the following legal bases under UK GDPR:

• To provide the Service — scheduling and dispatch, invoicing, timesheets, receipt/expense capture, the client portal, notifications and support — necessary to perform our contract with your Organisation.
• To process billing for Subscriptions and to prevent fraud — necessary to perform our contract and for our legitimate interests in being paid and keeping the Service secure.
• To maintain, secure and improve the Service, including diagnostics, analytics (generally on anonymised or aggregated data) and testing new features — our legitimate interest in running a reliable, secure product, balanced against your rights.
• To comply with legal obligations, such as tax, accounting and regulatory record-keeping, and responding to lawful requests from authorities.
• To send you marketing about the Service, only where you have consented or, for existing customers, where permitted under PECR’s “soft opt-in” for similar products — you can opt out at any time.

We do not sell your personal data, and we do not use it for third-party advertising.

4. Your organisation’s own clients

If your Organisation uses SeamlessJobs to manage its own clients, those clients’ details (name, contact details, address, invoices, quotes, and similar) are entered by your Organisation and are controlled by your Organisation, not by us — see Section 1. Where we provide a client portal or a shared quote/invoice/statement link so a client can view or act on their own records, we process that client’s data only to operate that feature on your Organisation’s instructions. If you are one of Your Clients and have a question about how your data is used, please contact the business that provided it to us (your Organisation) in the first instance.

5. Sharing your information

We share personal data with the following categories of sub-processor, solely to provide the Service, and only to the extent needed for their function:

• Hosting and database providers, to run the Service and store Customer Data.
• Cloudflare, for file storage (photos, documents) and encrypted database backups.
• Stripe, where your Organisation connects its own Stripe account to accept payments from Your Clients.
• QuickBooks (Intuit), where your Organisation connects its own QuickBooks account for accounting sync.
• Email and SMS delivery providers, to send invoices, quotes, reminders, one-time codes and notifications on your behalf.
• Mapping and geocoding providers (Google), to look up addresses, show maps, and plan routes.
• Apple, to process App Store Subscriptions and sign-in.

We also disclose personal data where required by law, to enforce our Terms of Service, or to protect the rights, property or safety of SeamlessJobs, our users, or others. We do not sell personal data to third parties.

6. International transfers

Some of the providers listed in Section 5 may process data outside the UK, including in the United States. Where that happens, we rely on an appropriate safeguard recognised under UK GDPR — such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the provider’s participation in the UK Extension to the EU-US Data Privacy Framework — to protect your data to a UK standard wherever it is processed.

7. Data retention

We retain Organisation data for as long as the account is active, plus a reasonable period afterwards to allow for export requests and to meet our own legal and accounting obligations. In line with our “no hard deletes” design, business records (invoices, quotes, jobs, and similar) are generally soft-deleted (marked closed/archived, excluded from lists) rather than immediately erased, so audit history is preserved; a specific request to erase personal data is handled under Section 9. Encrypted nightly database backups are kept for a limited retention window and then deleted.

8. Security

Passwords are stored using industry-standard hashing (argon2), never in plain text. Access to the Service requires authentication, data in transit is encrypted (HTTPS), nightly database backups are encrypted before leaving our infrastructure, and access to Customer Data is restricted to what is needed to provide the Service and support. Your Organisation’s own bank account details (see Section 2) receive an extra layer of protection beyond this: they are individually encrypted at rest, masked everywhere in the Service by default, and can only be revealed or changed after re-authenticating with a password and a one-time code. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a personal data breach that poses a risk to your rights, we will notify affected Organisations and, where legally required, the Information Commissioner’s Office (ICO), without undue delay.

9. Your rights

Subject to applicable law, you have the right to:

• be told how your personal data is used (this policy);
• access a copy of the personal data we hold about you;
• have inaccurate personal data corrected;
• have your personal data erased, subject to our legal retention obligations and the records your Organisation needs to keep (e.g. invoice history);
• restrict or object to certain processing;
• receive your data in a portable format; and
• withdraw consent at any time where processing is based on consent.

You can access and update most of your information directly within the Service. Location tracking only occurs while clocked in or on an active visit, and can be discussed with your organisation administrator. To exercise any other right, contact us using the details in Section 14. If a request concerns data your Organisation controls (Section 1), we may need to direct it to your Organisation, or act on your Organisation’s instructions. You also have the right to complain to the ICO (ico.org.uk), the UK’s data protection regulator, at any time.

10. Cookies and local storage

Our web dashboard uses browser local storage, not cookies, to keep you signed in — it stores your session token on your own device so the app can recognise you between visits. We do not use advertising or cross-site tracking cookies. If this changes, we will update this policy and seek your consent where required under PECR.

11. Automated decision-making

We do not use your personal data for any automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

12. Children

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal data from children, and will delete any such data if we become aware of it.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email at least 30 days ahead of taking effect where reasonably practicable.

14. Contact

Questions about this policy, or requests regarding your data, can be sent to our support address shown in the Service, or in writing to Saffer Stretch Ltd, Greetwell Place, Lincoln, LN2 4US. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.