Legal · Privacy

Privacy Policy

Last updated: 15 October 2026

1. Who is responsible for your data

This notice describes processing by Sindri Páll Benediktsson and Birgir Sveinn Benediktsson, trading as TradieDial. The operators are based in Iceland and are responsible as controllers for this website, customer administration, billing, security, product improvement and TradieDial's own sales and marketing.

For call, message, booking and job data processed for a trade business using TradieDial, that trade business is normally the controller and TradieDial is its processor. Our Data Processing Addendum governs that processing.

2. Who this policy covers

This policy covers website visitors, customers and authorised users, callers and message senders, business contacts who receive TradieDial sales communications, and authorised users of configured communication integrations. The service is intended for business use and is not directed to children.

3. Data we process

Website, demos and accounts

• name, work contact details, business name, trade, service area and enquiry details;
• account role, authentication records, settings and product activity;
• subscription identifiers, plan, invoice/payment status and refund records. Payment providers handle full card or bank details; TradieDial does not store them;
• support messages, complaint records and evidence needed to resolve them; and
• security logs, IP address, request time, browser/device information and abuse signals.

Calls, messages, jobs and bookings

• caller name, telephone number, address/postcode, requested service and access notes;
• call audio, transcript, AI summary, urgency flags and the actions Sam said would happen;
• SMS replies, corrections, callback notes, voluntarily uploaded photos and job outcome/value;
• appointment time, booking status and calendar reference; and
• technical identifiers needed to join a call, message, booking or recovery case safely.

Sales and outreach

• company identity, legal/entity type, trade, services, public locations, website and company-size indicators;
• business contact name, role and work contact details;
• the source, URL, observation date, confidence and evidence for each discovered fact;
• email verification, suppression, eligibility and frequency-control results;
• communications, replies, objections, meetings and customer outcomes; and
• commercial-fit and confidence scores used to prioritise review. Deterministic legal and safety rules always run before any AI score.

Business identity, a working contact, service instructions and payment information are needed to provide a paid account. If these are not supplied, we may be unable to set it up. Photos, additional job notes and optional integrations are not required for basic message-taking.

Sales staff may prepare setup details, send requested private payment links and see payment status. Restricted sales accounts are not given full payment credentials or unrestricted customer-dashboard access. Payment approval happens with the payment provider; a demonstration payment uses synthetic data only.

Payment providers during the transition

Existing subscription links use PayPal. Creem checkout is being prepared and is not yet available for live payments. If you later purchase through Creem, Creem (Armitage Labs OÜ) will collect the checkout information needed for the sale, such as your name, email, billing address, business/tax information and payment details. It handles payment, invoicing, transaction tax, fraud checks and refunds as Merchant of Record under its own Privacy Policy.

TradieDial receives the subscription, customer and transaction references, plan, payment/refund status and billing contact information needed to provide and support the account. We do not receive full card details, and we do not send caller recordings, transcripts or job notes to Creem for billing. Creem's independent payment processing is distinct from TradieDial processing caller data for a trade business. No customer data is sent to Creem merely because this planned provider is described here. Contact the relevant payment provider about its independently controlled payment data, or us for help identifying the provider.

Owner texts and maps

When enabled, we send short post-call summaries to the business's approved mobile, with email as an available fallback. These can contain a caller's name, number, job location, urgency and next step. The business should use a phone only authorised people can access and consider lock-screen previews and shared devices. SMS is not an end-to-end encrypted channel.

A maps link may include the job address or postcode. Opening it sends that location and normal device/request information to the selected mapping service under its own privacy notice. An external map is optional and does not verify that the supplied address is correct. Avoid forwarding customer links or summaries to unauthorised people.

4. Why we use data and our lawful bases

• Contract and steps before contract: to provide demos, accounts, call handling, bookings, support and billing requested by customers.
• Legitimate interests: to operate and secure the service, prevent misuse, support genuine callers, improve reliability, keep business records and market TradieDial to relevant corporate businesses. We use a documented three-part assessment where this basis applies.
• Consent: where a feature or communication legally requires it, including marketing to an individual subscriber when no other PECR exception applies.
• Legal obligations: tax, accounting, regulatory requests, data-protection rights and claims.
• Vital interests: only in exceptional circumstances where processing is necessary to protect someone's life.

Where we act as processor, the customer determines the lawful basis and purpose. We process only on documented instructions, subject to the DPA and applicable law.

5. AI, call recording and human review

Sam is an AI assistant. At the beginning of a handled call, Sam identifies itself as an AI assistant and says that the call may be recorded. Live audio must be processed to recognise speech and respond; stored recordings, transcripts and summaries depend on the enabled service. Customers must publish their own caller privacy information and determine a lawful basis for their use. An announcement alone is not consent. Ask us about available recording controls before using Sam for calls that must not be recorded.

AI is used to transcribe speech, extract details, summarise a call, flag urgency, draft communications and assist business users. It can be wrong. It does not make decisions that produce legal or similarly significant effects about callers or sales prospects. Safety flags and important details must be reviewed by the relevant business, and people may ask for human review or correction.

We do not ask callers for health, biometric, political, religious or other special-category information. If a caller volunteers sensitive information, we limit use to handling the immediate enquiry and the customer must identify any additional Article 9 or Article 10 condition required for its continued use. We do not use sensitive information for sales targeting.

6. Outreach mailbox and email data

TradieDial uses Mailforge infrastructure for its outreach mailboxes. Mailforge handles mailbox and domain provisioning, SMTP delivery and IMAP access to replies, bounces and other inbound messages. It therefore processes sender and recipient addresses, message headers and content, and delivery, bounce and reply metadata.

TradieDial stores the mailbox identity, encrypted SMTP/IMAP credentials, provider and message identifiers, and the sent or received content needed to apply suppression, classify replies, maintain conversation history and investigate delivery. Mailforge is infrastructure only: TradieDial controls sequencing, eligibility, frequency, suppression, reply handling and booking logic.

Relevant message content may be sent to a configured AI provider only for the selected classification, drafting or executive-assistant task. We do not sell message data, use it for advertising or train a general-purpose model on it. Human access is limited to support, security, legal compliance or an authorised operational need.

7. Business-to-business marketing

Our detailed Marketing and Outreach Notice explains our sources, targeting rules and opt-out controls. UK unsolicited email is restricted to verified corporate subscribers unless valid consent or the soft opt-in applies. Unknown entities, sole traders and ordinary partnerships fail closed. We provide our identity, a privacy link and a working unsubscribe method in the first communication.

We rely on legitimate interests only after considering necessity, relevance, reasonable expectations and impact. The right to object to direct marketing is absolute: object or unsubscribe once and we stop. We keep the minimum suppression record needed to ensure the address, number, company or domain is not re-imported and contacted again.

8. Where prospect information comes from

Prospect facts may come from the business's own website, official corporate registers, public business listings, a person who supplied the information, referrals, or a provider whose terms and our source policy permit that specific use. We do not authorise unrestricted scraping. Each automated source must be explicitly approved with permitted markets, fields, uses, retention, daily volume and spend limits. The recorded source for a specific fact is available on request.

We use deterministic eligibility checks for entity type, source permission, suppression, email validity, verification, frequency and mailbox safety. AI fit scoring cannot override those checks. We contact no more than one person at a company at a time through the automated system.

9. Sharing and sub-processors

We disclose data only to personnel who need it, the customer responsible for the relevant caller/job, professional advisers or authorities where legally required, and providers that help operate TradieDial. We do not sell personal data. Our current categories and provider purposes are listed in the Sub-processor Notice.

10. International transfers

TradieDial is operated from Iceland, within the EEA. The UK recognises Iceland as adequate for UK data transfers. Some providers process data in the UK, EEA, United States or other countries. A restricted transfer must have an applicable adequacy decision or appropriate contractual safeguards, such as EU Standard Contractual Clauses with the UK Addendum where needed, supported by the required risk assessment. A supplier's name alone does not establish a lawful transfer or Data Privacy Framework coverage. Contact us for the applicable recipients, processing locations and a copy of relevant safeguards, with confidential information redacted where necessary.

11. Retention

• Call recordings and caller-uploaded photos: a 90-day retention window, followed by scheduled deletion. Failed provider deletions are retried; removal from provider systems can take longer than expiry of dashboard access. Ask support about an earlier deletion request.
• Transcripts, summaries, job details, messages and outcomes: while the customer account is active, then returned or deleted under the DPA and termination process, subject to backups and legal retention.
• Account and billing records: for the relationship and the applicable accounting, tax or legal-claim retention period afterwards. The period depends on the record and governing law; contact us for the period applicable to your request.
• Unconverted prospect records: our retention policy calls for a review at least annually and deletion or anonymisation within 12 months of the last meaningful interaction unless a fresh lawful reason applies. This review can require manual action; it is not a claim that every prospect record has an automatic deletion timer.
• Source evidence and verification: expires under the approved source policy and must be refreshed before reuse.
• Suppression records: a minimal email, phone, company or domain record may be retained for as long as reasonably necessary to honour an objection permanently.
• Security and rate-limit data: raw IP-based rate-limit entries are normally removed within 24 hours; necessary security/audit records may be kept longer for incident investigation.

12. Website telemetry and cookies

We use essential, secure, HTTP-only session cookies for authenticated areas. Public pages use Vercel Web Analytics and Speed Insights for aggregate page-view and performance information such as route, referrer, approximate country, browser, device and web vitals. These services do not use third-party advertising cookies or give us an identifiable cross-site browsing history. TradieDial excludes dashboards and token-bearing customer, subscription and unsubscribe routes from this telemetry. See our Cookie Notice.

13. Your rights

Depending on the law that applies, you may have rights to be informed, access, correct, delete, restrict or object to processing, receive portable data, withdraw consent and obtain human review of certain automated decisions. You always have the right to object to use of your personal data for direct marketing.

For caller/job data, contact the trade business first because it is normally the controller; we will assist it. For data controlled by TradieDial, email hello@tradiedial.com. We may need proportionate identity checks. We normally respond within one month; where a lawful extension applies, we explain it within that period. Withdrawing consent does not affect earlier lawful processing.

14. Privacy complaints

Email hello@tradiedial.com with “Privacy complaint” in the subject. We will acknowledge a UK data-protection complaint within 30 days, investigate it, keep you informed where appropriate and provide an outcome without undue delay.

Our complaints page explains what to include and how to ask for a review. You do not need to finish our process before contacting a regulator.

You may also complain to the regulator where you live or work. UK complaints can be made to the Information Commissioner's Office. Icelandic/EEA complaints can be made to Persónuvernd, the Icelandic Data Protection Authority.

15. Security

Measures include encryption in transit, provider encryption at rest, encrypted mailbox and integration credentials, least-privilege service access, tenant-scoped queries, private object storage, signed expiring customer links, suppression and frequency controls, append-only audit records for defined automation and provider events, rate limiting, backups and incident procedures. No internet service is risk-free. If a breach affects customer-controlled data, we notify the customer without undue delay and provide the information reasonably needed for its own duties.

16. Changes and contact

We may update this policy when the product, providers or law changes. Material changes will be highlighted or notified to affected customers where appropriate. Questions and legal notices may be sent to hello@tradiedial.com.