Privacy Policy

1. Who We Are

Rose Labs Ltd, trading as Pricd ("Pricd", "we", "us", or "our"), is a voice-to-quote and invoicing mobile application for tradespeople operating in the United Kingdom. We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy explains how we handle personal data in two distinct roles:

• As data controller, for the personal data of the tradespeople who hold a Pricd account, and for the limited technical data we record when someone opens a quote or invoice link we host.
• As data processor, for the personal data about your customers that you enter into Pricd when preparing quotes and invoices. In that relationship you are the data controller and we process that data on your instructions. Section 5 explains what this means for you.

2. What Data We Collect

2.1 Account Information

• Your name and business name
• Email address
• Trade or business type
• Business logo and brand colours, where you upload them
• Default VAT rate and invoice numbering preferences

2.2 Financial and Payment Information

• Your bank account details, where you choose to add them so that they appear on your invoices as payment instructions. These are stored so we can render them on the invoices and shared links you generate.
• Subscription information: your subscription tier, renewal status, expiry date, and an identifier issued by our subscription management provider. Apple processes the payment itself; we never receive or store your card details.
• Connected payment account: if you enable card payments on invoices, we store the identifier of the Stripe account you connect. We do not receive or store the card details of anyone who pays one of your invoices — those are handled entirely by Stripe.
• Quote and invoice values, including subtotals, VAT and totals.

2.3 Voice Recordings and Transcripts

• Audio recordings you create in the app to describe a job. These are transmitted for transcription and then deleted automatically — see Section 7.
• The transcript produced from each recording
• The structured quote data extracted from that transcript

2.4 Quote, Invoice and Customer Data

• Your customers' names, email addresses, phone numbers, addresses and postcodes
• Descriptions of work, materials and labour
• Pricing, itemised costs, VAT and totals
• Notes you add to a quote, invoice or customer record
• Generated PDF documents

2.5 Shared Link Data

When you share a quote or invoice, we create a private link. When someone opens that link we record only that it was viewed, and whether it was subsequently accepted, declined or paid, together with the time. This is so we can show you whether your customer has seen the document. We do not record the IP address, device or browser of the person who opens a shared link.

2.6 Device and Technical Information

• Device type, model and operating system version
• A device identifier used to deliver push notifications, where you enable them
• IP address and technical logs generated by our hosting infrastructure

2.7 Support and Feedback

• Any message you send us through the in-app feedback form, and any correspondence with our support team

3. How We Use Your Data

• Providing the service — creating and managing your account, recording job details, and generating quotes and invoices.
• AI transcription and extraction — processing your voice recordings to convert spoken descriptions into structured quote data.
• Sharing and payment — generating shareable quote and invoice links, showing you when a customer has viewed one, and where you enable it, allowing your customer to pay an invoice by card.
• Notifications — sending push notifications about activity on your account, such as an invoice being paid, where you have enabled them.
• Subscription management — determining your plan, usage allowance and renewal status.
• Support — responding to your enquiries and resolving issues.
• Security and legal compliance — protecting the service against abuse and meeting our legal and regulatory obligations.

We do not use your data for advertising, we do not sell it, and we do not share it with data brokers.

4. Legal Basis for Processing

• Contract performance (Article 6(1)(b)) — processing necessary to provide the Pricd service, including account creation, voice transcription, quote and invoice generation, and subscription management.
• Legitimate interests (Article 6(1)(f)) — securing the service, preventing fraud and abuse, and recording shared-link activity so you can see whether your customer has viewed a document. We have assessed that these interests are not overridden by the rights and freedoms of the individuals concerned.
• Consent (Article 6(1)(a)) — where required, such as push notifications, access to your microphone and photo library, and any optional marketing communications. You may withdraw consent at any time in your device settings or by contacting us.

5. Your Customers' Data — Your Responsibilities

When you enter details about your customers into Pricd, or record a voice note describing a job for them, you are the data controller for that information and we act as your data processor. We process it only to provide the service to you.

This means you are responsible for:

• Having a lawful basis for entering your customers' details into Pricd
• Telling your customers how their data is used, including that it is stored in Pricd
• Responding to any requests your customers make about their data

We will assist you in meeting those obligations. If you receive a request from one of your customers about data held in Pricd, contact us using the details in Section 13 and we will help you respond.

If you are a customer of a Pricd user and want to know how your data is used, please contact the tradesperson who quoted or invoiced you in the first instance. You may also contact us and we will pass your request on.

6. Third-Party Processors

We share data with the following providers, each bound by a data processing agreement:

Voice recordings sent for transcription are processed solely to provide the service and are not used by our transcription provider to train its models.

7. Data Retention

• Account data — retained for as long as your account is open. When you delete your account, your profile, quotes, invoices, customer records and voice recordings are permanently deleted.
• Voice recordings — deleted automatically as soon as transcription is complete. We do not retain the audio.
• Transcripts — the text produced from a recording is kept alongside the quote so you can refer back to what was said, and is deleted when you delete the quote or your account.
• Quote and invoice data — retained for the life of your account. You can delete individual quotes and invoices at any time in the app. Note that you may have a separate legal obligation to retain invoice records for tax purposes.
• Shared link records — retained while the link is active and for as long as the associated quote or invoice exists.
• Support and feedback messages — retained for up to 24 months.

You can delete your account and all associated data at any time from Settings in the app.

8. Your Rights Under UK GDPR

You have the right to: access your data; have inaccurate data corrected; have your data erased; receive your data in a portable format; object to processing based on legitimate interests or for direct marketing; and request that we restrict how we use your data.

You can exercise any of these rights using the contact details in Section 13. We will respond to all legitimate requests within one month. In certain circumstances we may extend this by a further two months, in which case we will notify you.

If you are not satisfied with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

9. Data Security

• Encryption of data in transit using TLS, and at rest using industry-standard algorithms
• Secure cloud infrastructure with access controls
• Access to personal data restricted to authorised personnel who require it
• Regular review of our security practices

Shared quote and invoice links use long, randomly generated tokens that cannot be guessed. Anyone holding a link can view that document, so please share links only with the intended recipient. You can deactivate a link at any time in the app.

While we strive to protect your personal data, no method of transmission or storage is entirely secure and we cannot guarantee absolute security.

10. International Transfers

Your data may be transferred to and processed outside the United Kingdom, including in the United States, by the providers listed in Section 6. Where this happens we rely on UK adequacy regulations, the UK International Data Transfer Addendum, Standard Contractual Clauses, or another lawful transfer mechanism.

11. Children's Privacy

Pricd is a professional tool for tradespeople and is not directed at anyone under 18. We do not knowingly collect personal data from children. If we become aware that we have, we will delete it promptly.

12. Changes to This Policy

We may update this policy to reflect changes in our practices, technology or legal obligations. Where changes are material we will notify you in the app or by email before they take effect. The "Last updated" date above shows when it was last revised.

13. Contact Us

For any questions about this policy, to exercise your rights, or to raise a concern:

• Email: privacy@pricd.app
• Data Controller: Rose Labs Ltd, trading as Pricd

We aim to respond within 5 working days.