Data processing terms

1. Who is who

For the personal data you add about your clients, their property and your workers, you are the controller and JobGuard (Wedalo Ltd, company no. 17499535) is your processor. For your own account, billing, security and app-use records JobGuard is the controller - see the Privacy notice.

2. What we process for you

• Purpose: running the features you use - quotes, projects, photos, extra work and approvals, client pages, weekly updates, invoices and emails to your clients - and making your document in free tools used without an account (for example the free invoice generator, where the details are only turned into the PDF and not stored).
• People: your clients (and anyone acting for them), your workers, and people visible in site photos.
• Data: names, email addresses, phone numbers, site addresses and postcodes, photos of the property, notes and voice notes, prices, approvals with signatures, time and device, invoices and messages.
• Duration: while your account is open, until you delete the data or the account (then as in section 8).

Please don't add special category data (for example health details) unless it is needed for the job.

3. Your instructions

We process this data only to provide JobGuard to you, as set by these terms and the choices you make in the app - for example sending an email to your client when you ask. We don't sell it or use it for our own marketing. If we are required by law to process it otherwise, we will tell you first unless the law forbids it. We will tell you if we think an instruction breaks data protection law.

4. Confidentiality and security

Only people who need it to run and support JobGuard can access the data, and they are bound to keep it confidential. We protect it with:

• encrypted connections (HTTPS) and encrypted storage at our hosting providers;
• database rules that let each account see only its own projects and the jobs it was invited to;
• client pages that open only with a 6-digit PIN, with limits on wrong attempts;
• limits on logins, emails and other actions, and a record of important events;
• service keys kept on the server only, and access for our team limited to what support needs.

5. Subprocessors

You allow us to use the providers listed in section 4 of the Privacy notice (Supabase, Vercel, Sentry, OpenAI, Resend, Stripe, Google, Twilio, Open-Meteo, postcodes.io, Ideal Postcodes, and, once announced, Cloudflare for encrypted backup copies), each only for its part of the job and under a written contract with data protection terms. We stay responsible for them.

Before we add or replace a provider that handles your clients' data, we will update that list and tell you in the app or by email at least 14 days ahead. If you object on reasonable data protection grounds, tell us; if we can't resolve it, you can download your data and close your account.

6. Transfers outside the UK

Our main database and hosting are in the EU (Frankfurt). Some providers process data in the United States; those transfers are covered by the UK's adequacy arrangements or standard data protection clauses.

7. Helping you

• Requests from your clients: you can view, correct, export (Download my data) and delete their data in the app. If a client contacts us, we pass the request to you and help where you need it.
• Breaches: if we become aware of a breach affecting this data, we will tell you without undue delay, with what we know, so you can meet your own duties.
• Other duties: we give reasonable help with your security, impact assessments and questions from the ICO, as far as they concern JobGuard.
• Checks and audits: we give you the information you reasonably need to show these terms are met, and allow for and contribute to audits, including inspections, by you or an auditor you appoint. We first answer with written information and our providers' own certifications; if that isn't enough, we agree a reasonable time and scope with at least 30 days' notice, under confidentiality and without access to other customers' data. Ask via contact.

8. When it ends

You can download your data at any time (Profile → Your data and account → Download my data). When you delete a project or your account, we delete the data straight away, apart from provider backups (up to 30 days) and what the law requires us to keep, as described in the Privacy notice. What you added to someone else's job as a worker stays with that job, without your name.