Privacy policy
This notice explains how PayProof Trades, operated by BrainCapital AI Technologies Inc., uses personal information when you use our mobile app, backend API, public legal pages or support services.
Who we are and how to contact us
BrainCapital AI Technologies Inc. operates PayProof Trades, a service that helps tradespeople manage private agency relationships, bookings, shifts, work records, pay and invoices.
For privacy questions or to exercise your rights, email support@payprooftrades.co.uk. Do not send passwords, one-time passcodes, identity documents, tax identifiers or bank information by ordinary email.
Information we process
- Account and security data: your verified mobile number, user and session identifiers, authentication and refresh tokens, sign-in challenges and security records.
- Referral data: an optional referral code and the resulting partner attribution.
- Work data: private agency or client relationships and contact details you enter; sites and postcodes you enter; bookings, shifts, shift days, clash state, work logs, hours, notes, pay rates and comparisons.
- Financial data: invoices, invoice lines, generated PDFs, payment records, gross-pay records, VAT and CIS calculations, and UTR or VAT numbers when you supply them.
- Device and notification data: notification preferences and, when push is enabled, an installation identifier, device platform, app version and push token.
- Purchase data: subscription, entitlement and purchase status when store billing and RevenueCat are enabled.
- Support and rights data: support-consent and access-audit information, portable-export activity, and the phone number, optional contact email, reference and administration evidence associated with a public deletion request.
- Early-access data: the email address you submit, the consent wording version and the time you consented to receive information about app testing or availability.
- Diagnostics: crash, performance, app, device and delivery diagnostics only when the relevant Sentry, Firebase or infrastructure service is enabled.
Public deletion-form data is used only to receive, verify, administer and evidence the request. We do not use it to confirm publicly whether an account exists. Early-access data is used only to administer your request and contact you about PayProof Trades testing or availability; it is not consent to general marketing.
Information the current app does not collect
The current PayProof Trades app contains no advertising feature, advertising-ID access, cross-app tracking or sale of personal information. It does not request device GPS, contacts, camera, microphone, photos/media or broad device-storage access. Site names and postcodes are work records that you enter; they do not come from device location.
Why we use information and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Provide the account, synchronisation, scheduling, work, pay, invoice, export and support features you request. | Performance of our contract with you and steps taken at your request. |
| Verify mobile-number control, secure accounts, prevent misuse, diagnose faults and protect service integrity. | Performance of our contract and our legitimate interests in operating a secure, reliable service. |
| Manage subscriptions, payments and financial records. | Performance of our contract and compliance with applicable legal obligations. |
| Send optional notifications or collect optional diagnostics where a choice is offered. | Your consent where consent is required; you may withdraw it through the relevant app or device setting. |
| Record an early-access request and contact you when a suitable testing or download route becomes available. | Your consent. You may withdraw it at any time by contacting us. |
| Respond to rights requests and establish, exercise or defend legal claims. | Legal obligations and legitimate interests, as applicable. |
Who processes or receives information
We use service providers only for the functions enabled in the deployed service. These may include hosting, PostgreSQL database, encrypted backup, object storage and transactional-email providers; AWS End User Messaging for sign-in codes; Firebase Cloud Messaging for push; Sentry for diagnostics; and RevenueCat, Google Play or Apple for purchase and subscription status.
When you choose SMS, WhatsApp or another destination through your device, PayProof Trades hands the content you reviewed to that destination at your direction. The app does not send chase messages automatically. We may also disclose information where law requires it or to establish, exercise or defend legal claims.
International transfers
The production design places primary PayProof application data in AWS's London region. Some enabled providers or their subprocessors may process information outside the UK. Where UK data-protection law requires it, the operator must use an applicable adequacy decision or approved contractual safeguards. The precise production provider list and transfer safeguards are reviewed before release and when providers change.
How long we keep information
Live account and work information is kept while the account is active. After a verified deletion request is accepted, a 30-day grace period begins. When it expires, ordinary account and work data is hard-deleted from live systems.
Only issued invoices, their invoice lines and related payments may be copied into a separate, access-restricted financial archive where needed for tax, accounting or legal obligations. Draft invoices are deleted and never archived. Archived records currently have an expiry of up to 6 years and are deleted by a separate expiry process.
Shorter schedules apply to one-time passcode challenges, temporary exports and unclaimed uploads. Security, support, diagnostic, processor and encrypted-backup records follow their approved schedules. When immediate removal from a backup is not technically possible, the data must be put beyond normal use and overwritten under the backup schedule; restored systems must re-apply completed deletions.
An early-access request is kept for no more than 365 days from your latest submission and is then automatically deleted. You may ask us to remove it sooner.
Security
We use account isolation, access controls, encrypted transport, restricted secrets, private object storage and additional controls for the separated financial archive. Mobile credentials use platform secure storage, while offline records rely on the operating system's private app sandbox and device protections. No storage or transmission method is completely secure.
Your rights
Depending on the circumstances, you may have rights to access, correct or erase your information; restrict or object to processing; receive portable information; and withdraw consent without affecting earlier lawful processing. We may need to verify your identity before acting.
You may complain to the UK Information Commissioner's Office. We encourage you to contact us first so we can try to resolve the issue.
Delete your account
Request deletion of your PayProof Trades account and associated data. The page explains the 30-day grace period and the narrow financial-record exception.
Strictly necessary web storage
The public deletion and early-access forms use a session and CSRF-protection cookie to keep the forms secure and display validation or confirmation messages. It is strictly necessary for the service. These public pages do not add advertising or analytics cookies.
Changes to this policy
We may update this notice when PayProof Trades, applicable law or our service providers change. We will update the date on this page and use an appropriate in-app or service notice for material changes.