Privacy policy

1. Who we are and how to contact us

The controller is Mabel HQ Ltd, a company registered in Northern Ireland with company number NI744850, of 32 Ballynorthland Park, Dungannon BT71 6DY. Our website is mabelhq.co.uk. For data protection questions and requests email support@mabelhq.co.uk; for help with your account email support@mabelhq.co.uk; for anything else email hello@mabelhq.co.uk.Our registration with the Information Commissioner's Office is in progress; the number will be shown here once issued.

Mabel is a very small business and is not required to appoint a Data Protection Officer. Questions and requests go to support@mabelhq.co.uk and are handled by our director.

The Mabel business may be transferred to another company. If that happens your data transfers with the business, the new company becomes controller or processor in Mabel's place and is bound by this notice, and we tell account holders by email and update this notice with its company number.

2. Two roles: controller and processor

Mabel is the controller of data about tradespeople who hold accounts, including billing, approval documents and live location, and of data about waitlist members, demo line users and website visitors.

For a trade's customers, the trade is the controller and Mabel is its processor. When you call or text a Mabel number, the business you were trying to reach decides why your data is used; Mabel acts on its instructions under the data processing agreement in our Terms. Customers can exercise their rights through the trade or through us: we pass any request we receive to the trade within 5 working days and help them answer it. The same applies to the scrambled phone numbers of contacts a trade switches off in the iPhone app (section 7a): the trade is the controller and we process them for it.

3. What we collect

If you hold a Mabel account:

• account details: name, email address, mobile number, and a password stored only as a bcrypt hash (cost 12), never in clear text. We text your mobile with new bookings and customer messages, and recognise your replies from it;
• business details: business name, trade, business phone and website if you give them, registration body and number, insurer and insurance expiry date, base address and its latitude and longitude, how far you travel, logo if you upload one, and your settings such as working hours, travel time, common jobs, message wording, when Mabel answers calls, Mabel hours if you set them, your urgent words and emergency number, and whether you are asked when a job's slot ends;
• your agreement to our Terms and confirmation that you have read this notice, that you are 18 or over and that you are signing up for your business: the date and the version (a date) you agreed to;
• approval documents: photo ID, insurance certificate and scheme card, or for work that needs no certificate, proof of trading, two references and photos of your work; and, where we use it, the result of the ID check with a selfie (section 5);
• billing: your Stripe customer ID, plan, subscription status and period dates. Card details and your billing address are entered on Stripe's own checkout page; Stripe holds them and we never see or store your full card number;
• calendar connection: Google or Microsoft OAuth tokens, or an Apple feed token, if you connect a calendar;
• busy times from your own calendar, if you switch that on: only the start and end of each time your Google Calendar, Outlook or iPhone calendar shows you busy over the next 60 days, and whether it was an all-day event. We never receive or store the event's name, place, notes or who is invited. We use these times for one thing: so that Mabel never offers a customer a time you already have something on, and to show you grey "Busy" bands in your own diary;
• push subscriptions: the browser endpoint and keys, or in the iPhone app the device token Apple issues, needed to send job alerts, if you turn them on (section 7b);
• live location, only if you switch it on in Settings: your phone's position while a job is on the way and Mabel is running on your phone (in the iPhone app that includes the background, with the blue location indicator showing; in a browser only while the tab is open), the latest point only (section 7);
• some of your contacts, only if you set "Who Mabel replies to" to Customised in the app and switch people off: a salted hash of each switched-off contact's phone number, never a name, never the number itself, and nothing about anyone you leave switched on (section 7a);
• diary and conversation data: the jobs, messages and customer details created through the service;
• email verification and password reset tokens while valid (24 hours and 1 hour);
• technical data: IP address, browser type and request logs held briefly by our hosting provider, and request counts per IP address or account used for rate limiting, held in memory for minutes. To stop repeated sign-in, sign-up and reset attempts, we keep a one-way fingerprint of the email address or network address used, for up to a day, never the address itself.

Providing your name, email, phone number, trade, card details and approval documents is a requirement of the contract; without them we cannot open or approve your account or assign a number. Logo, base address, calendar connection, push alerts, live location and the contacts setting are optional.

If you are a trade's customer, we hold for the trade:

• your phone number and the time you called, when you call from a UK mobile and we text you (calls are not recorded);
• the texts you exchange with the booking assistant and with the trade, and the details you give such as your name, the job, your description of the problem and your address;
• if you send a photo, the link Twilio gives us to it. The photo itself stays on Twilio's servers; the trade sees that a photo was sent but Mabel does not show the photo today;
• photos you choose to add through the private upload link in our text, up to four per link: each picture, re-encoded so the location, camera and time details your phone stored in it are removed, its size, and the result of the automatic safety check (section 5a);
• the latitude and longitude of your postcode (section 7);
• booking details, any time you confirm by replying YES, and whether you tapped "details look correct" on the booking review page;
• the delivery status of each text, and any STOP or START reply.

If a trade enters a job for you by hand, the same details are held, and they come from the trade rather than from you. If your text contains one of the trade's urgent words (such as leak or no heating), the trade is sent the first 120 characters of it straight away by text and, if it uses job alerts, as a notification, and the reply tells you the trade will call you back, and gives you a number to call only if the trade has set one; a text about a gas smell or carbon monoxide also gets the gas emergency number first.

We do not ask for health details, but people sometimes include them, for example that someone in the house is unwell or uses a wheelchair, or a photo shows a medicine or a mobility aid. That is special category data. It is kept only as part of the message or photo it came in, seen only by the trade, used only to do the job safely, and deleted with the message or photo. Please leave it out unless the trade needs it.

If you join the waitlist: name, email, optional phone number, trade, your answers to three questions (your main pain point, missed calls per week and what fixing it would be worth per month), and the source tag of the link you arrived from.

If you use the demo line: your phone number, your messages, the demo booking you make, and a per-number attempt record used for the 24-hour cooldown, which also notes whether the demo finished and whether you tapped the sign-up link in the closing text.

If you visit the website: our hosting provider records your IP address and request in its server logs. We use no analytics.

4. Why we use it and our lawful basis

• Running your account, answering missed calls and booking jobs: performance of a contract, Article 6(1)(b).
• Service emails, which are email verification, password reset, password changed, welcome, new booking pending, booking confirmed, trial ending reminder and payment past due: performance of a contract. We do not email your customers.
• Billing through Stripe and keeping invoices: performance of a contract and legal obligation under tax law, Article 6(1)(c).
• Checking approval documents against public registers before a number goes live: performance of a contract, since approval is a condition of the service, and our legitimate interest in confirming that a trade holds the registration and insurance it claims before we text customers in its name, and in preventing fraud.
• Security, rate limiting, abuse prevention, the content filter and the demo line's 24-hour cooldown: our legitimate interest in keeping the service secure and preventing misuse.
• The waitlist, its confirmation email and emails about the beta and launch: your consent, given when you join. Withdraw it at any time by replying to any email or writing to support@mabelhq.co.uk.
• The demo line: our legitimate interest in demonstrating the service to someone who chose to text it. Its first reply says one closing text about Mabel will follow, so that text is one you asked for, and it carries a free way to opt out.
• Showing your live position to the customer you are driving to: your consent, given by the switch in Settings and withdrawn by turning it off, Article 6(1)(a).
• Recording when you agreed to our Terms and to which version: performance of a contract, and our legitimate interest in being able to show what was agreed. Asking you to confirm you have read this notice is a record that you were told; it is not consent and it is not the basis on which we use your data.
• Matching callers against the hashes of contacts you switched off (section 7a): we act as your processor and your lawful basis applies, normally your legitimate interest in keeping personal calls and messages apart from customer bookings.
• The safety check on customer photos (section 5a): we act as the trade's processor, and it is also our legitimate interest in never storing or showing intimate, violent or harmful images taken in someone's home.
• Responding to rights requests and complaints: legal obligation.
• Establishing or defending legal claims: our legitimate interest in protecting the business.
• Processing a trade's customer data: we act as processor and the trade's lawful basis applies, normally that the customer contacted them about a job. Where a customer volunteers health details, the trade is responsible for having a condition under Article 9 for using them, and they are used only to do the job safely.

We do not sell personal data and we use nobody's data for advertising.

5. Approval documents

Before we assign a number, a trade uploads in Get approved photo ID (passport or driving licence), a public liability insurance certificate and the scheme card its trade requires: Gas Safe Register, NICEIC, NAPIT, ELECSA or STROMA, OFTEC, HETAS or MCS, with WaterSafe or CIPHE optional for plumbing. Files are PDFs or photos, up to 3MB each and twelve in total, stored as data on the document record in our database in London, encrypted at rest, with access limited to our director.

A person at Mabel checks the documents against the public registers within 2 working days, and records the outcome and a short note. This means some information about you comes from the public registers rather than from you. The decision is made by a person, not by software. Our director views them on Mabel's review page, which only they can open; no copies are kept elsewhere. Approved documents stay on record while the account exists because they are the record of what was approved; they cannot be deleted in the app, so email support@mabelhq.co.uk to update one. Until approval you can delete them yourself in Settings. They are deleted within 30 days of account closure unless the law requires us to keep them longer. If an account is never approved and you do not go on to use Mabel, ask us and we delete the documents within 30 days.

Where we use it, the ID check with a selfie is run by Stripe (Stripe Identity), our processor for ID checks. Stripe holds the photos of your document and your selfie under its own terms; we keep only the result, the name read from your document and whether it shows you are 18 or over.

If your work needs no certificate, we ask for your UTR, company number, trade membership or Google business profile, two customer references and photos of your work. We contact each reference once to verify the job, and delete their details and the work photos once your account is approved. We keep the record of the decision: what was checked, by whom and when.

We record your insurance and certificate expiry dates. We email you 30 and 7 days before they expire, and new bookings pause on expiry until we have checked the new one. We may pause new bookings on an account while we look into a complaint.

5a. Customer photos

Our phone numbers cannot receive picture messages, so when a photo would help with a job the booking text can include a private link where the customer can add up to four photos. The link works for 7 days or until four photos are in. Anyone holding the link can add photos to it, so it should not be passed on. We do this as the trade's processor (section 2). Sending photos is optional.

When a photo arrives we re-encode it, which removes all the details a phone stores inside a photo, including its GPS location, the camera and the time; we store the re-encoded copy in our database in London, encrypted at rest; and we send that copy to OpenAI's moderation service, an automatic safety check for sexual content, graphic violence, self-harm and threats. A photo the check flags is deleted straight away and the customer is told only that one photo could not be accepted; we keep a record of the check's result, without the image, for 30 days. A photo the check has not cleared is never shown to anyone, and if it is still unchecked after 72 hours it is deleted. Until then the check is tried again every few minutes.

Only the trade the photos were sent to can view them, signed in to Mabel, and only after the check. They open from a "View photos" button, are never shown in lists and are never cached. Please keep people out of photos: the boiler, pipe or problem is all the trade needs.

Photos are deleted 30 days after the job is completed, or 30 days after they were sent if the job is cancelled or never booked, by a deletion run every day. The trade can delete a photo sooner from the job. OpenAI processes each image in the United States as our sub-processor (section 9). OpenAI states that data sent to its API is not used to train its models, and its published data controls list the moderation service as keeping no copy for abuse monitoring and storing nothing after it answers; see OpenAI's privacy policy and how OpenAI handles API data.

6. Calls, texts and the booking conversation

A call to a Mabel number, either one the trade missed or, if the trade has chosen "straight away", every call, is answered by one short spoken message and the line ends. The message is synthesised speech generated by Amazon Polly through Twilio. If you call from a UK mobile we text you straight away and store your number and the time of the call so the assistant can text back. A landline or non-UK number is not texted, and the trade is told you rang. A withheld number is not recorded. Calls are not recorded and there is no voicemail. Twilio keeps its own log of every call (numbers, time and length). Mabel does not offer call recording; a trade that records calls by other means is responsible for that itself.

If you reply PERSONAL to that text, Mabel stops replying: your number and the time are sent to the trade by notification and text, and any further texts you send to that number are forwarded to the trade's own phone. These texts are kept with the conversation for the same period as other conversations (section 10).

The trade can mark your number as a known contact from that conversation. It is then stored only as a salted hash, as in section 7a, and your calls go straight to the trade.

The text conversation follows fixed rules written by Mabel. No person is reading your messages live and no artificial intelligence is involved, though the trade can see the thread and step in. New bookings, and messages the assistant passes on, are also sent to the trade's own mobile by text and, if the trade uses job alerts, as a phone or browser notification. Mabel identifies the trade in its messages. Once a trade's registration has been checked, its registration number may appear in confirmation texts and on the booking review page. The assistant may stop replying where messages are abusive, threatening or sexual towards the service; the thread stays visible to the trade and your opt-out rights are unaffected.

The first text Mabel sends you ends with one line saying that Mabel handles texts for the business and linking to section 13 of this notice. If the trade has set Mabel hours, outside them Mabel does not reply: your texts and calls go straight to the trade. Texts from a Mabel number are service messages you started by phoning or texting the trade, or about a job you gave the trade your number for. They are not marketing and Mabel never sends marketing texts to a trade's customers; a trade that wants to send you offers or ask you for a review must follow the marketing rules itself. If the trade applies a suggested new running order for its day, you are texted the new time and asked to reply YES; nothing changes without your reply, so no automated decision is made about you.

To stop all texts from a trade's number, reply STOP, STOPALL, UNSUBSCRIBE, CANCEL, END or QUIT, in any case and with or without punctuation. Reply START, UNSTOP or YES to resume. The opt-out is recorded and honoured immediately. A stopped number receives no booking or on-the-way texts either, so if you have a live booking please ring the trade. If you send CANCEL with a live booking, the trade is alerted so a person can check whether you meant to cancel the appointment. A sentence such as "cancel my booking" is a normal message, not an opt-out.

7. The tracking page and location-derived data

When a job is created, the postcode in the address is sent to postcodes.io, a UK open-data service, which returns latitude and longitude that we store on the job. Only the postcode is sent, never a name, street or phone number, so nothing links it to you. This lets Mabel estimate travel time and suggest a running order for the trade's day.

When the trade taps "On the way", the customer is texted a link to a tracking page showing an estimated arrival time, the customer's first name, the job and address, the trade's first name and business name, and a route map from the trade's previous job or base address to the customer's address. The start of that route is an approximate point, rounded to about a kilometre, near the trade's last finished job that day or its base; no name, street or exact position from the previous job or the base is shown. The trade's position is inferred from its diary, not from GPS, and no device location is collected. A trade can switch on live location in Settings. Then, while a job is on the way and Mabel is running on their phone (in the iPhone app that includes the background, with the blue location indicator showing; in a browser only while the tab is open), the phone sends us its position every twenty seconds or so and the tracking page shows it moving; we keep only the latest point, overwrite it each time, show it only to the customer of that one job, stop showing it three minutes after the last fresh fix, and clear it when the phone reaches the customer's address (within about 100 metres), when the job is marked done, moved or cancelled, when the switch is turned off, or when the trade signs out. If the trade forgets to mark the job done, sharing stops by itself about an hour and a half after the promised arrival and the last point is no longer shown; it is deleted the next time the phone checks in. Customers' device location is never collected. We use the trade's live position on the basis of its consent and keep it to the latest point for one job. If anyone else carries the trade's phone while sharing is on, the trade must tell them first. The link contains an unguessable 32-character token; anyone who has the link can see the page, it keeps working after the job and then shows that the trade has arrived, so do not forward it. The trade can add 15 minutes to the estimate and you are texted the update. Arrival times are estimates.

The map tiles load in your browser from tile.openstreetmap.org, so the OpenStreetMap Foundation sees your IP address and the map area around the address under its own privacy policy, and the map library loads from cdnjs.cloudflare.com, so Cloudflare sees your IP address too. The same map draws the trade's own travel circle on the sign-up and Settings screens, so the trade's browser fetches tiles around their base postcode in the same way. The tracking page sets no Mabel cookies. A confirmation text may also link to a booking review page where you check what was taken down; the same token rules apply.

7a. Your contacts list (the app)

In the iPhone app the row "Who Mabel replies to" is set to Everyone or Customised. On Everyone, and by default, every text and call to the business number is met by the booking assistant, contacts included. On Customised the trade sees their contacts and switches off the people who should reach them directly (a partner, a supplier, a mate); everyone they leave switched on is still met by the booking assistant. For each switched-off contact, and only those, the app takes the phone number, puts it in a standard form, and scrambles it with a one-way hash (SHA-256) and a secret value unique to that account. Only the scrambled values are sent to us and stored; we never receive a name, an email address or the number itself, and nothing at all about contacts left switched on. The scrambling is one-way, but because the secret value is held with the account, the scrambled values are pseudonymised, not anonymous: we treat them as personal data, use them only to recognise a sender, and delete them with the account or when the trade forgets the list. When a text or call arrives we scramble the sender's number the same way and check for a match. A matching text is passed to the trade and the booking assistant does not reply; a matching call is put through to the trade's mobile, or, where that is not possible, the caller is told so and, if the trade uses job alerts, the trade gets a notification with the caller's number. For each passed-on text we keep only a short record (a hash of the sender, Twilio's message reference and the time) so a repeated delivery is not passed on twice and so the number of forwarded texts an hour is bounded; records older than a day are deleted the next time a text is passed on for that account. The scrambled values are used for this check and for nothing else. We do this for the trade as its processor; the trade's lawful basis is its legitimate interest in keeping personal calls and messages separate from customer bookings. The contacts themselves are processed only as salted hashes, used for this check and nothing else. On the phone, the app remembers which contacts are switched off, and their hashes, so the list survives a restart; names are read from the phone's contacts each time and are not stored by the app, and signing out makes the phone forget its list; after signing in again, or on a new phone, the app reads the stored hashes back to show the same people switched off. We keep the server list until the trade forgets it in Settings on the web, switches everyone back on in the app, or their account closes. Choosing Everyone stops the matching at once but keeps the list, so choosing Customised again works without another sync. Contacts access is optional and can be withdrawn in the iPhone's own Settings at any time.

7b. The iPhone app

The Mabel iPhone app is free to download and is for trades who already hold a Mabel account: you sign in with the same email and password. Accounts are opened and paid for on the website; nothing is sold in the app. The app is built only with Apple's own frameworks. It contains no third-party code, no advertising, no analytics and no crash reporting, and it does not track you across other companies' apps or websites. Its privacy manifest and its App Store privacy answers describe the same data as this section.

• Signing in: the app keeps the same mabel_token session cookie as the website (section 12) in the phone's own storage. Mabel does not store your password on the phone.
• Stored on the phone: a short copy of your account (an account reference, your name, your business name and whether live location is on) so the app opens without signal; the list of contacts you switched off (section 7a); this phone's device token for job alerts and whether you switched alerts off on it; any Job done taps waiting for signal (the job reference and the time); and whether the permissions screen has been shown. Your email address, mobile number, address and coordinates are not saved on the phone. So the app works with no signal, it also keeps the next seven days of jobs, with each customer's name, number and address, in a file protected by iOS data protection, excluded from backups and deleted at every sign-out; nothing in it leaves the phone.
• Location, optional: asked for only when you switch live location on. The app asks for "Always" so sharing keeps going with the phone locked, and so an on the way sent from the website can start it: we send the phone a silent notification that wakes the app. If iOS closes the app during the drive, a significant change in location can reopen it so the customer's page does not go blank. The blue location indicator shows whenever the app uses location in the background, and nothing is sent when no job is on the way (section 7). You can change the permission to While Using or Never in the iPhone's Settings.
• Show me on my map, optional and off by default: your phone's position is drawn as the blue dot on the app's own map of your day, by Apple's MapKit, on the phone. The position is never sent to us or to anyone else, and switching this on does not switch on live location for customers. It uses While Using only, and you can change the permission in the iPhone's Settings.
• Contacts, optional: read on the phone only, as described in section 7a.
• Notifications, optional: if your plan includes job alerts and you allow them, the app sends us the device token Apple issues. Alerts travel through Apple's push service, which sees the device token and the alert text, such as a customer's name, the job, the time and the start of a message.
• Signing out: the app stops location sharing and we delete the live point, we delete this phone's device token, and the phone forgets its contacts list. Deleting the app removes what it stored on the phone. To delete your account, use Delete my account in Settings; see section 10.

Suggested route: on the Pro plan the app and the dashboard may show a shorter running order for a day, worked out from the job addresses already in your diary; no new data is collected for it. If you apply it, each customer whose time would change is sent one text with the new time asking them to reply YES (section 5), and customers whose time does not change are not texted.

8. No profiling, no automated decisions, and one safety check

The text conversation does not use artificial intelligence, machine learning or large language models, and Mabel does no profiling. The conversation follows fixed rules written by Mabel; it offers slots from the trade's own diary and settings, and the trade can change or cancel any booking. Account approval is decided by a person.

The one place a machine-learning model is used is the safety check on customer photos (section 5a): OpenAI's moderation model looks at each photo and says whether it shows sexual content, graphic violence, self-harm or threats. It decides only whether that photo is kept and shown to the trade. It makes no decision about the person who sent it, has no effect on their booking, and is not used to profile anyone. No decision with legal or similarly significant effects is made about anyone solely by automated means, so the UK GDPR rules on automated decision-making do not apply.

9. Who receives your data and transfers outside the UK

(a) Sub-processors. These providers process data for us under their own data processing terms, which give the protection Article 28 UK GDPR requires: Twilio (with Amazon Polly for greeting speech), Stripe, Resend, Vercel, Neon, OpenAI and Ideal Postcodes. Apple carries alerts to the iPhone app under its developer terms.

• Twilio: texts, calls and phone numbers, and Amazon Polly speech for the greeting. A United States company; UK data may be processed in the United States.
• Stripe: payments and subscription billing, including your card and billing address on its checkout page. We never see full card numbers. When you change the email on your account we tell Stripe, so its receipts go to the new address. Where we use it, Stripe Identity also runs the ID check with a selfie for approval (section 5). United States and Ireland.
• Resend: service emails and the waitlist email. United States.
• Vercel: hosting and serverless functions. The default function region is in the United States, so requests are processed there in transit.
• Neon: our Postgres database, hosted on AWS eu-west-2 in London and encrypted at rest. Customer photos are stored here. Neon is a United States company, so its staff may reach the data from the United States for support and administration.
• OpenAI: the automatic safety check on customer photos (section 5a). It receives each photo after we have removed its location and camera details, and nothing else about the customer. United States. OpenAI states that data sent to its API is not used to train its models.
• Ideal Postcodes (Ideal Postcodes Ltd): the address list on the booking form. When a customer types a postcode on the form, we send that postcode, and nothing else, to find the addresses at it. United Kingdom.
• Apple, only for the iPhone app: job alerts, and the silent notification that starts live location (section 7b), are delivered through Apple's push service, which receives the device token and the text of the alert.

This list is the sub-processor schedule for the data processing agreement in our Terms. We give trades at least 30 days' notice by email before adding or replacing a sub-processor.

(b) Services with no contract with Mabel that receive limited data:

• postcodes.io: a free public open-data service in the United Kingdom. When a job is created we send it the postcode from the address, and nothing else, so nothing it receives links the postcode to a person.
• OpenStreetMap Foundation and Cloudflare cdnjs: on the tracking page, and on the sign-up and Settings screens where a trade sets how far they will travel. Your own browser fetches the map tiles and the map library from them, so they see your IP address under their own privacy notices (section 7).
• Browser push services: if a trade turns on job alerts in a browser, the alert travels through the push service run by that browser's maker (for example Google for Chrome, Mozilla for Firefox or Apple for Safari). The alert text is encrypted so that only the trade's browser can read it.
• Maps apps: if a trade taps to open a job's address or directions, the address opens in Google Maps from the website or Apple Maps from the iPhone app, under the trade's own use of those services.

(c) Calendar providers, only if a trade connects its calendar:

• Google: if you connect Google Calendar, we send each confirmed job to it, move it when the job moves, and remove it when the job is cancelled or deleted (the job, the customer's name, the address and the customer's description of the problem) under your own Google account and Google's terms. With "Block my personal events" on, we also ask Google's free/busy service when you are busy; Google answers with times only, never event details. Mabel asks Google for permission to add and update events and to view your availability, and never for permission to read your events. Our use of Google user data complies with the Google API Services User Data Policy, including its Limited Use requirements.
• Apple: if you connect Apple Calendar, your calendar app reads a private feed from us, with the same job details, under your own Apple account. Anyone holding the feed link can read it, so keep it private.
• Apple, iPhone calendar: if you switch on "Block times from my iPhone calendar" in the Mabel app, the app reads the calendars you pick on your phone and sends us only the start and end of each busy time. Event names and details stay on your phone, and Apple receives nothing from us.
• Microsoft: if you connect Outlook, we send each confirmed job to your Outlook calendar, move it when the job moves, and remove it when the job is cancelled or deleted, under your own Microsoft account and Microsoft's terms, and with "Block my personal events" on we read when you are busy, asking Microsoft for the times and the free or busy marking of each event and nothing else.

Data is also shared with the trade's own customers in confirmation and on-the-way texts, with our professional advisers where needed, and with public authorities where the law requires.

Twilio, Resend, Vercel and OpenAI process data in the United States, and so may Stripe, Neon (for support and administration) and, for the iPhone app, Apple. For each transfer we rely either on the UK Extension to the EU-US Data Privacy Framework (the UK and US data bridge), where the provider is certified under it, or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement, within the provider's data processing terms, supported by a transfer risk assessment. Ask support@mabelhq.co.uk for a copy of the safeguard we rely on for any provider.

10. How long we keep data

• Account and business data: while the account is active, then deleted within 7 days of a deletion request, once we have checked it. If a subscription ends without a deletion request (cancelled, unpaid or ended by us), we keep the account closed but intact for 30 days so the trade can download its data or come back, then delete it in the same way.
• Invoices and payment records, which Stripe holds for us, and the billing details on your account: 6 years after the end of the tax year, as tax law requires.
• Your agreement to the Terms and this notice (date and version): kept with your account and deleted with it.
• Customer conversations and bookings, including links to photos: while the trade's account is active, then deleted with the account, or earlier on the trade's instruction. A trade can delete a booking from its diary at any time; conversations are deleted by us on request. We do not yet delete old conversations automatically while an account stays open.
• Customer photos (section 5a): 30 days after the job is completed, or 30 days after they were sent if the job is cancelled or never booked. A photo the safety check flags is deleted at once and the record of the check 30 days after; a photo the check never cleared, after 72 hours. All deleted with the account if it closes first.
• Approval documents: while the account exists, deleted with it as above unless the law requires longer. For an account that is never approved, on request (section 5).
• Waitlist entries: until you ask us to remove you or the beta outreach ends.
• Demo line: demo bookings are cleared by a maintenance run we carry out by hand, and the same run deletes demo conversations and attempt records older than 30 days.
• Email verification and password reset tokens: valid for 24 hours and 1 hour respectively; the used or expired token record stays with your account and is deleted with it.
• Calendar tokens and push subscriptions: until you disconnect or turn them off, or the account closes. An iPhone's device token is also deleted when you sign out of the app, change your password or log out everywhere, and when Apple tells us the token no longer works.
• Busy times from your calendar: replaced each time we check, deleted as soon as each one has passed, and deleted at once for that calendar when you disconnect it, switch "Block my personal events" off, or switch "Block times from my iPhone calendar" off in the app or press "Forget iPhone busy times" on the web.
• Live position: the latest point only, overwritten every twenty seconds or so while sharing and cleared when the phone reaches the customer's address, when the job is marked done, moved or cancelled, when the switch is turned off, or when you sign out. We keep no history of positions beyond our database provider's short backup window.
• Switched-off contact hashes: until you forget the list in Settings on the web, switch everyone back on in the app, or the account closes. Each sync replaces the whole list (section 7a). Records of passed-on texts: deleted once older than a day, the next time a text is passed on for that account.
• Server logs at Vercel: a short period under Vercel's default retention. Twilio keeps its own logs of calls and texts, including message content and photos, as part of its service to us; we have not yet set a shorter period there, and we delete them on request or when the account closes. Stripe keeps its own records under its own notice.

One scheduled deletion job runs every day, for customer photos. Some data is deleted as the service runs (the live point, passed-on text records and dead device tokens, as above); the demo clear-down, the deletion of closed accounts and every other deletion is done by a person, on request or at closure. To delete your account, choose Delete my account in Settings, on the website or in the iPhone app, or email support@mabelhq.co.uk from your account address. The request comes to us and nothing is deleted straight away: we check it came from you, stop your Stripe subscription, export your customers' data to you if you ask first, then delete your account, conversations, bookings, customer photos, documents, calendar tokens, busy times, push subscriptions, device tokens and contact hashes, and the matching call and text logs at Twilio, within 7 days of the request, keeping only invoices and payment records and anything needed for a live legal dispute. You can withdraw the request in Settings until then.

11. Security and breaches

Our measures are: TLS on every connection with HSTS; passwords hashed with bcrypt at cost 12 and never stored in clear; a single httpOnly session cookie; security headers; rate limiting on login, signup and public endpoints; signature checks on every webhook from Twilio and Stripe; a password change or "log out everywhere" ending every other session at once; the database encrypted at rest in London; secrets held in Vercel; no analytics scripts; and access to approval documents and customer data limited to our director. We make no claim to any certification, and no system is unbreakable, so keep your password strong and private and tell us at once at support@mabelhq.co.uk if you suspect misuse.

If a personal data breach affects data we control and is likely to risk people's rights, we report it to the ICO within 72 hours of becoming aware and tell affected people without undue delay where the risk is high. For customer data we process for a trade, we tell the trade without undue delay, and within 48 hours of becoming aware, so it can make its own assessment. We keep a breach register.

12. Cookies and local storage

Mabel sets one cookie, mabel_token, an httpOnly session cookie that keeps a trade logged in. It lasts 7 days from the last time they open Mabel on that device, and signing out, changing the password or email, or Sign out of every other device ends it at once. It is strictly necessary for the service you asked for, so consent is not required and no banner is shown; if you block it you cannot log in. We use no analytics, advertising or tracking cookies, and the tracking page sets no Mabel cookies. When a trade opens the sign-in page or the dashboard, the browser registers a small service worker that stores one offline page, so the app shows a Mabel message rather than a browser error when there is no signal, and that receives job alerts. It caches no diary data and nothing about you, is strictly necessary for the app the trade signed in to use, and can be removed by clearing the site's data in the browser. Visitors to the rest of the site, and customers opening a tracking, booking or photo link, do not get it. On the Settings page the browser also remembers, until the tab is closed, which sections a trade has open; it holds nothing else. We store nothing else in your browser. The iPhone app keeps the session cookie and the few items listed in section 7b on the phone. Push notifications use your browser's own permission prompt; we store the subscription and delete it when you turn alerts off or close the account. If we ever add analytics we will update this section and ask for consent first.

13. If you texted a Mabel number

You phoned or texted a tradesperson whose phone is answered by Mabel, a text-message booking service run by Mabel HQ Ltd. No person is reading your messages live; the replies follow fixed rules so the trade can book you in. The trade can read the conversation and reply itself, and if it has set Mabel hours, outside them your texts go straight to the trade. We keep your number, your name, the job, your address and these messages for the trade, who decides how they are used and is the controller of your data; Mabel is its processor. The trade uses them to answer you and do the job, on the basis that you contacted it about the job. If you use the booking form we text you, you give the same details there as you would by text: the job, your name, your address, a description of the issue, photos if the trade asks for them, and a time. The postcode you type is looked up to list the addresses at it; you only ever see addresses at the postcode you typed. If your text or the form mentions something urgent, such as a leak, the trade may be alerted at once with the start of your message. Your postcode is looked up to work out travel time. If you get an "on the way" link, anyone with the link can see the arrival estimate, the destination and, if the trade has chosen to share it, the trade's live position, so keep it to yourself. If you were the trade's previous job that day, the next customer's map may start from your postcode area, without your name or address. Calls are not recorded. A photo you send stays with Twilio, our phone provider. If you add photos through the link in our text, only the trade can view them, after an automatic safety check by OpenAI; we remove the location details and delete the photos 30 days after the job (section 5a). Please do not send health details or card numbers by text. Your messages are kept while the trade uses Mabel, unless the trade or you ask for them to be deleted sooner (section 10). Some of our providers are in the United States (section 9). These are not marketing texts. Reply STOP at any time to stop all texts from this number; reply START to resume. You have the rights in section 14, including to see, correct or delete your information and to object: contact the trade or support@mabelhq.co.uk and we will pass it on and help. You can complain to the ICO at ico.org.uk.

14. Your rights and how to complain

You have the right of access (Article 15), to rectification (16), to erasure (17), to restriction (18), to portability (20), to object, including to processing based on legitimate interests (21), to object at any time to direct marketing (21(3)), and to withdraw consent at any time, for the waitlist or for live location (7(3)). Withdrawing consent does not affect what was done before. No decisions with legal or similarly significant effects are made about you by automated means (22). Email support@mabelhq.co.uk. We respond within one month, extendable by two months for complex requests, and we tell you if we need the extension. There is no fee unless a request is manifestly unfounded or excessive. We may ask for enough information to confirm who you are, using your existing login where we can rather than asking for identity documents. A trade can ask for their account to be erased in Settings, on the website or in the app, and we complete it within 7 days of the request after checking it (section 10). Customers of a trade may contact the trade or us; we pass the request on and assist.

If you are a trade: Your customers are yours. We never sell their details or share them with another trade, and you can download your customers, jobs and messages from Settings at any time. On the website, Settings, Profile, Download my data gives three spreadsheet files (CSV): your customers with their name, phone and address, your jobs, and every text in your conversations. It costs nothing, needs no request to us, and sits alongside your right to portability above.

You can complain to us first at support@mabelhq.co.uk; we acknowledge within 30 days and tell you the outcome. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, Wycliffe House, Water Lane, Wilmslow SK9 5AF, telephone 0303 123 1113.

15. The waitlist and the demo line

Waitlist details are used only to send one confirmation email and then to tell you about the beta and the launch. Every email we send you says how to unsubscribe: reply to any of them and we remove you. We delete your entry on request or when the beta outreach ends.

When switched on, a public demo number runs the real booking flow under an account Mabel controls. Your number, messages and the demo booking are stored; demo bookings are cleared by a maintenance run we carry out by hand, and a per-number attempt record keeps a 24-hour cooldown so one phone cannot repeat the demo endlessly. When a demo booking completes you receive one closing text that says Mabel is free while we launch with a link, ending "Reply STOP to opt out". We send it only in the conversation you started and do not text you again afterwards without your consent.

16. Children

Mabel is for business use by people aged 18 or over. We refuse accounts to anyone younger and close any account we learn belongs to someone under 18. The service is not aimed at children and we do not knowingly collect children's data. A young person under 18 might call or text a trade's number, or add a photo through an upload link; that data is processed for the trade as controller, limited to what is needed to book the job, and deleted on request by the young person, a parent or the trade. The photo safety check (section 5a) refuses sexual and harmful images whoever sends them.

17. Changes to this notice

We may update this notice. The date at the top is kept current and a short list of changes is available on request. Material changes are emailed to account holders, and we aim to do so at least 30 days before they take effect, using the same channel as price changes; a change that makes this notice more accurate or more protective of you, or that the law requires, may take effect when posted. Each version is identified by its date. When it changes in a way that affects you, account holders are asked to confirm the new version in the dashboard or the iPhone app before carrying on, and we record the date and version confirmed (section 4). If a change means we want to use data for a new purpose that needs your consent, we ask for it separately.