Effective: 15 May 2026 · Last updated: 15 May 2026 · ICO: ZC133896
This Sub-Processors Policy explains the third-party service providers used by Trades Office Limited ("TradesOffice") to operate the TradesOffice platform and related services.
Company Number: 17181500 · ICO Registration Number: ZC133896
TradesOffice is an operational administration platform designed for UK trades businesses.
The Service assists users with operational administration tasks including:
TradesOffice is not:
A Sub-Processor is a third-party provider engaged by TradesOffice to process personal data in connection with providing the Service.
Sub-Processors may provide:
Each sub-processor is engaged under a contract that includes data protection obligations consistent with UK GDPR Article 28. International transfers are covered by the transfer mechanism shown below.
We will update this page when we add or remove sub-processors. Where a change involves a new transfer of personal data to a third country, we will provide 30 days' notice by email before the change takes effect.
| Sub-processor | Purpose | Location | Transfer basis |
|---|---|---|---|
| Twilio Inc. | WhatsApp and SMS message delivery | USA | UK-US Data Bridge / IDTA |
| Anthropic PBC | AI message processing and image analysis | USA | IDTA |
| OpenAI LLC | Voice note transcription | USA | IDTA |
| Supabase Inc. | Database infrastructure and authentication | USA (EU-hosted) | IDTA |
| Vercel Inc. | Application hosting and deployment | USA | IDTA |
| Vercel Inc. (Analytics) | Page view analytics and web performance metrics | USA | IDTA |
| Resend Inc. | Transactional email delivery | USA | IDTA |
| Upstash Inc. | Rate limiting (IP addresses only, retained max 1 hour) | USA | IDTA |
| Google LLC | Distance and postcode calculation (postcode data only) | USA | IDTA |
| Stripe Inc. | Subscription billing and Stripe Connect payment facilitation | USA | IDTA |
| PostHog Inc. | Product analytics (memory-only, no cookies set) | EU | UK adequacy decision |
| Functional Software Inc. (Sentry) | Error monitoring and crash reporting | USA | IDTA |
TradesOffice uses third-party AI providers to support operational administration functionality. These providers may process:
AI providers are used solely to provide operational classification, drafting and transcription functionality. Customer data submitted through the Service is not used by TradesOffice to train general-purpose AI models.
Some Sub-Processors process personal data outside the United Kingdom. Where international transfers occur, TradesOffice implements appropriate safeguards including:
The transfer basis for each sub-processor is shown in the table above. TradesOffice will provide at least 30 days' notice before appointing a new Sub-Processor involving new international transfers of personal data.
TradesOffice selects Sub-Processors based on operational, security and reliability considerations. Sub-Processors are expected to maintain appropriate technical and organisational security measures.
TradesOffice uses managed commercial cloud providers and does not currently operate self-hosted production infrastructure.
The following notes explain what each key provider receives.
May process: WhatsApp messages; SMS messages; uploaded images; and voice note audio. WhatsApp messages route via Twilio's US infrastructure (US1 region). Voice routes via EU (IE1).
May process: raw voice note audio submitted for transcription only. Transcribed text is returned to TradesOffice; audio is not retained by OpenAI beyond the API request.
May process: transcribed message content; receipt images; invoice information; customer names; and operational business records submitted through the Service.
May process: subscription billing information and payment metadata for TradesOffice subscriptions. Where builders use Stripe Connect, Stripe also facilitates payments from the builder's customers directly to the builder's Stripe account. TradesOffice does not hold customer funds.
May process: IP addresses only, for rate limiting purposes. IP addresses are retained for a maximum of 1 hour and are not used for any other purpose.
May process: product usage events and page interactions. PostHog is configured using memory-only session persistence — no cookies are written to the user's device. PostHog is not used for advertising or remarketing. Data is processed on PostHog's EU Cloud infrastructure.
May process: technical error metadata including stack traces and runtime context. Sentry does not receive message content or customer business records.
May process: anonymised page view data and web performance metrics. No persistent identifiers or cookies are used.
TradesOffice may update this Sub-Processors Policy from time to time. Updated versions will be published on this page. Where a change involves a new transfer of personal data to a third country, at least 30 days' notice will be provided by email before the change takes effect.
Questions relating to this policy or data protection matters may be directed to: [email protected]
Trades Office Limited
Company No. 17181500
Hexham, Northumberland, United Kingdom
ICO Registration Number: ZC133896