Privacy policy

Who we are

Forgebridge Software Ltd, registered in England and Wales under company number 17472078, with its registered office at 66 Paul Street, London EC2A 4NA, operates the United Kingdom-based business software service Trade Sidekick. For personal information used to run accounts, billing, security and the service, Forgebridge Software Ltd acts as the data controller. You can contact us at tradesidekicksupport@gmail.com.

Information we collect

We collect account and profile information such as your name and email address; business and team information; subscription, invoice and payment-status information; and the customer, enquiry, quote, job, booking, invoice, payment, message, note and document records you choose to put into the app. Stripe handles full payment-card details, which Trade Sidekick does not store.

We also collect service, usage and security information needed to operate the product, including plan usage, timestamps, browser and device information, IP addresses, error information, audit records and support communications.

How and why we use information

We use information to create and administer accounts, provide the service, process subscriptions, enforce plan allowances, secure the platform, prevent fraud and abuse, investigate problems, provide support, improve reliability and meet legal, tax and accounting obligations.

Under UK data protection law, our legal bases are performance of our contract with you, our legitimate interests in operating and protecting a reliable business service, compliance with legal obligations, and consent where we specifically ask for it. You may withdraw consent at any time, without affecting processing that took place before withdrawal.

Information about your customers

Your business controls the customer and job information its members enter. For that information, your business is normally the controller and Trade Sidekick acts as its processor. Your business is responsible for having a lawful reason to collect it, giving any notices its customers need, keeping it accurate and responding to their rights requests. We use that information only to provide and secure the service, follow your authorised instructions and meet legal obligations. We do not sell personal information or use your customers' records for advertising.

The business data-processing terms form part of our contract with your business. They cover your instructions, confidentiality, security, sub-processors, assistance with privacy requests and incidents, transfers, audits, and returning or deleting information when processing ends.

Who can access information

Members you authorise can access information within your business account according to their role. Business records are separated from other Trade Sidekick businesses, and uploaded files are kept in private storage and opened through time-limited authorised links. Trade Sidekick personnel access personal information only where reasonably necessary for support, security, legal compliance or service operation, and access is limited to authorised people.

Service providers and disclosures

We use service providers to run Trade Sidekick, including Lovable Cloud and Supabase for application hosting, authentication, database and storage; Stripe for subscription billing; Google when you choose Google sign-in; and OpenAI when you choose to use Sidekick AI. Sidekick AI receives the question and limited context needed for the requested answer or draft, but uploaded document contents are not sent to it.

When phone or SMS services are enabled, Twilio supplies carrier numbers and processes caller numbers, call routing, audio and message data needed for those services. Where registration is required, the business and authorised representative details are sent to Twilio and the relevant registration providers. This can include UK number registration or US A2P messaging registration. Availability depends on the account, country and required compliance checks.

For an enabled Vapi receptionist, Vapi processes the caller number, business context, call audio, recording and transcript. Deepgram transcribes caller speech and OpenAI generates dialogue and extracts enquiry details. The selected voice provider, which may include ElevenLabs, receives the speech text needed to generate replies. The app saves transcripts, summaries and enquiry details for the business to review. Provider recordings are subject to the retention arrangements explained below.

For an owner-enabled UK pilot OpenAI receptionist call, Twilio processes caller speech into text and OpenAI receives that text and limited business context to draft replies and enquiry details. The conversation transcript and summary are saved for owner review. If legacy voicemail transcription is separately enabled, Deepgram or OpenAI receives the recording for transcription. The app requests deletion of the original Twilio recording once the private copy and any transcript are secured. This is separate from the Vapi receptionist recording path.

Where private voice creation is available and an owner chooses it, ElevenLabs receives their authorised voice sample and creates a private voice. Trade Sidekick retains the consent and voice reference but does not retain the uploaded voice sample; ElevenLabs processes speech text and voice generation usage. Removing the voice in the app requests deletion with ElevenLabs. Text and email drafts opened in your own messaging apps are sent by you; Trade Sidekick does not read replies in those apps or report a draft as delivered.

Providers acting as our sub-processors handle business customer information under contractual instructions and data-protection obligations. Some providers, including Stripe and Google, also act as independent controllers for their own payment, identity, fraud-prevention or legal purposes, as explained in their privacy policies. We may also disclose information to professional advisers, a buyer or successor to the business, or public authorities when required by law or reasonably necessary to protect rights, safety and the service.

International transfers

Some providers may process information outside the United Kingdom. Where UK data protection law requires it, we rely on an adequacy regulation or approved contractual safeguards and related security measures. Contact us if you want more information about the safeguard used for a particular transfer.

How long we keep information

We keep account and workspace information while the account is active and afterwards for only as long as reasonably needed to provide access to retained records, respond to a deletion request, resolve disputes, enforce agreements and meet legal, tax, accounting and security obligations. Retention depends on the type and sensitivity of the information, why it is needed and applicable legal requirements.

Cancelling a subscription does not itself delete the business workspace. Customer, enquiry, transcript, summary and job records may remain available with retained-record access until the business requests deletion or another applicable retention requirement ends. If you need a copy before deleting the workspace, contact us; there is currently no complete self-service workspace export.

Receptionist recordings are separate from the enquiry and transcript records saved in the app. UK pilot recordings covered by the provider-deletion schedule are queued for deletion at the configured date. US Vapi recordings currently follow the Vapi organisation's retention settings; Trade Sidekick does not yet apply a separate scheduled deletion period to those recordings. A provider recording or playback link can therefore expire before the related enquiry or transcript is deleted. Contact us for the current recording retention setting for your account.

A verified workspace deletion request includes removal of its receptionist provider calls and recordings. Active calls or provider errors can delay this cleanup; pending cleanup is tracked for retry. Audio copied into the document vault is governed by the document retention setting separately from the original provider recording.

A deleted document becomes unavailable in the app immediately and is scheduled for permanent removal after the retention period configured for the business. There is no self-service restore. Permanent removal requires the storage cleanup service to run; the configured date is not a guarantee of removal at an exact time. Backup copies and provider security logs follow the relevant backup or security retention arrangements. Records needed for legal, fraud-prevention or accounting reasons are retained only for the applicable purpose and period.

Security

We use technical and organisational safeguards designed to protect information, including account authentication, business-level access controls, private document storage, time-limited file links, encrypted network connections and audit records. No online service can promise absolute security, so account holders must also protect their sign-in details and control who they invite.

Your privacy rights

Depending on the law that applies, you may ask us to access, correct, delete, restrict or provide a portable copy of your personal information, or object to processing based on legitimate interests. You can also withdraw consent where processing relies on it. Some rights have legal limits, and we may need to verify your identity before acting. We normally respond within the period required by applicable law.

If your request concerns information held by a trade business using Trade Sidekick, contact that business first; we will help it respond where required. UK users may complain to the Information Commissioner's Office. US residents may also have rights under applicable state privacy laws. Trade Sidekick does not sell personal information or share it for cross-context behavioural advertising.

AI and automated decisions

Sidekick AI produces suggestions and drafts. It does not make decisions that have legal or similarly significant effects about people, and important communications or record changes still require an authorised person to review or approve them.

Children

Trade Sidekick is a business service and is not directed to children. Account holders must be at least 18 years old and legally able to enter into a business contract.

Changes and contact

We may update this policy when the service or law changes. We will update the date above and give additional notice where a change materially affects how we use personal information.

Postal correspondence can be sent to Forgebridge Software Ltd, 66 Paul Street, London EC2A 4NA. Email tradesidekicksupport@gmail.com with any privacy question or request.