Privacy notice
These documents are prepared for the invitation-only complimentary beta. Registration acceptance is not active until Sole Trader Admin enables it after owner and solicitor approval. Reading them is not consent.
The correspondence address shown is the supplier address published with these documents. Confirm with the owner before wider publication if this address should not appear on the public website.
- Trading name
- Sole Trader Admin
- Legal supplier
- James Crowe trading as Sole Trader Admin
- Correspondence address
- 99 The HolbeinsSwindonWiltshireSN5 6DT
Who we are
Controller: James Crowe, trading as Sole Trader Admin, 99 The Holbeins, Swindon, Wiltshire, SN5 6DT, United Kingdom. Email: hello@soletraderadmin.com.
We are a UK sole trader. We do not have a company registration number. We are not VAT registered.
We will publish an ICO registration number here only after the controller completes the ICO fee self-assessment and, if required, pays the fee and receives a number.
We have not appointed a data protection officer. Contact us at the email above for data protection questions.
Scope and roles
This notice covers account holders, workspace members, marketing website visitors, and people who use our platform contact form.
It does not replace your privacy notice to your own customers and website visitors. You are the controller for their data in your workspace. We are processor for that workspace data when we process it on your instructions (see the DPA).
We are controller for your account, authentication, platform contact form, optional product news preference, our security logging for our own purposes, and (when live) subscription billing to you.
Lawful bases (controller processing)
The table below describes why we use personal data about you and our lawful basis under UK GDPR. We rely on different bases for different purposes.
| Purpose | Personal data | Lawful basis |
|---|---|---|
| Create and manage your account; provide the service you request | Name, email, password hash, verification state, session data, terms acceptance record | Performance of a contract (Art 6(1)(b)) when you accept the terms; steps at your request before contract where applicable |
| Secure the service and prevent abuse | Session data (including IP address and user agent), rate-limit keys, security logs | Legitimate interests (Art 6(1)(f)) in running a secure service; balancing documented internally |
| Respond to platform contact form messages | Name, email, optional business name, message, abuse-prevention identifiers | Legitimate interests (Art 6(1)(f)) in answering enquiries; where your message is a pre-contract request, also steps at your request (Art 6(1)(b)) |
| Optional product news (if you opt in) | Email and preference record | Consent (Art 6(1)(a)); you may withdraw in Settings |
| Operate the marketing website | Server log data (IP address, browser type, request time) | Legitimate interests (Art 6(1)(f)) in operating and protecting the site |
Account and authentication
We process account and sign-in data as described in the table. Session cookies are HTTP-only, SameSite=Lax, and Secure on HTTPS, with a maximum session horizon of about eight days ahead.
If you change dashboard theme while signed in, we store a theme preference cookie (tradehub_theme) for up to 12 months.
Your workspace (processor summary)
You choose customers, diary entries, quotes, invoices, website content, media and enquiries. We store and display them under your permissions.
| Topic | What happens |
|---|---|
| CRM customers | May be archived; not fully deleted through normal app permissions alone |
| Customer notes | Cannot be edited or deleted in the app after creation |
| Draft quotes and invoices | Editable and deletable while draft |
| Sent quotes and issued invoices | Immutable snapshots |
| Business export | Owner-only zip; seven-day download window |
| Website enquiries | Stored in workspace; notification emails omit message body |
Hosting, email and subprocessors
We host the application and database on a virtual private server in the United Kingdom (IONOS; owner confirmed November 2026).
Uploads, exports and worker runtime files are stored on local disk on that server (not separate object storage on the approved production path).
Outbound email uses IONOS SMTP (smtp.ionos.co.uk). Where the mailbox provider stores messages has not been confirmed from the mail contract; we will update this notice when recorded.
TLS certificates are obtained through Let’s Encrypt via Caddy.
Stripe is not used for live subscription charging during this beta. We do not send your end-customer lists, enquiry text or invoice line items to Stripe for the beta.
Security
We use tenant isolation (row-level security), server-side permission checks, and separate database roles. We use encryption in transit (HTTPS/TLS). We do not claim full-disk encryption of the VPS unless we verify and publish that separately.
Backup files are encrypted by the operator backup process. That is not the same as encryption of the entire server disk.
Backups and retention
We take encrypted backup copies of the database and related files using operator-run jobs. Scheduled automatic production backups must be accepted operationally before we rely on them for real customer data.
Backup retention follows the operator schedule implemented in backup scripts (approximately 14 days of daily copies plus weekly retention). Exact published wording will match the accepted production schedule.
We do not operate automatic deletion jobs for most business data categories. Retention is primarily manual and product-driven:
- While your account or workspace is open, data remains available subject to product rules (immutability, archive, and so on).
- Business exports are removed automatically after seven days.
- When you use workspace closure, account deletion or customer erasure tools, we remove or restrict live data as implemented; we action valid data subject requests manually where tools do not cover a request.
- Encrypted backups are not rewritten when you delete live data; data can remain in backups until those files expire.
- Issued invoices and sent quotes may be retained because of immutability design and your legal obligations.
Your rights
You may exercise UK GDPR rights (access, rectification, erasure, restriction, objection, portability where applicable) for personal data we control about you.
Contact hello@soletraderadmin.com. We respond within one month where required. Complete automatic erasure across all systems is not available.
You may complain to the Information Commissioner’s Office (ico.org.uk) after contacting us.
International transfers
We intend to keep primary application and database processing in the United Kingdom. If we use a sub-processor that processes personal data outside the United Kingdom, we will put appropriate safeguards in place before doing so and update this notice and the DPA.
Changes
We update this notice when processing changes materially. The last updated date is shown at the top of this page.