Privacy Policy
Last updated: 17 September 2026
SecondFix ("we", "us", "our") is committed to protecting your personal data. This policy explains what data we collect, why, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
SecondFix is a trade business management platform operated in the United Kingdom.
Contact: hello@secondfix.build
Controller or processor
Which one we are depends on whose data it is.
- For data about you as a SecondFix user (your account, your business profile, your team, how you use the app), we are the data controller.
- For data a trade business puts into SecondFix about its own customers (names, addresses, job notes, photos, messages in a project), that business is the controller and we are its processor. We handle that data on their instructions to run the service. If you are a customer of a SecondFix user and you want your data corrected or deleted, ask them first. You can still contact us and we will help.
2. What data we collect
Marketing site (secondfix.build)
- Email address: when you join the waiting list
- Trade: the trade you select on the signup form
App (app.secondfix.build)
- Account data: email address, used to sign you in by magic link or by Google sign-in. We never see or store a password.
- Profile: your name, profile photo, notification settings, and display preferences
- Business profile: business name, contact name, address, phone, VAT number, logo
- Bank details: if you choose to show them on your invoices, we store the account name, sort code, account number, bank name, and any payment note you add
- Job data: job titles, customer names, customer emails, addresses, job stages, notes
- Financial data: quotes, invoices, payment schedules, line items, amounts
- Media: photos, videos, and documents uploaded to a project or attached to a quote
- Communications: the message thread on a project, including internal notes, messages between you and your customer, and snags raised with photo evidence
- Team data: team member names, emails, phone numbers, trades, roles
- Subcontractor data: the name, email, phone, and trade of any subcontractor you add, plus a record of the access link they hold and the stage updates they send back
- Quote acceptance records: when a customer accepts a quote, we record the name they sign with, the time of acceptance, their IP address, and their browser identifier, kept as evidence of the agreement
- Subscription: which plan you are on, whether you pay monthly or yearly, your subscription status and renewal date, and the customer reference Stripe holds for you. We never see or store your card number.
Customer portal (for your customers)
When a trade gives a customer access to a project, we hold:
- Portal contact: the customer's name and email address, and whether they are the main contact or a guest
- Sign-in codes: a hashed six-digit code sent by email to prove the address belongs to them
- Sessions: a hashed sign-in token, when it was created, when it was last used, and when it expires
- Guests: the email address of anyone the customer invites to the project, and a record of who invited them. A customer can invite up to five people.
- Messages and media: anything the customer writes or uploads in the project thread
We store only the hash of a sign-in code or session token, never the value itself.
We do not collect or store payment card numbers. Card payments are processed entirely by Stripe, our payment processor. Your own bank details are different: we store those only if you ask us to put them on your invoices, and only the customer holding a real invoice link can see them.
3. Why we collect it (legal basis)
| Data | Legal basis | Why |
|---|---|---|
| Waiting list email & trade | Consent | To notify you when early access opens |
| Account email | Contract performance | To provide the service and authenticate you |
| Business profile, job data, financial data | Contract performance | To deliver the core service (job management, quoting, invoicing) |
| Bank details | Contract performance | To show your customer where to pay an invoice |
| Photos, videos, documents | Contract performance | To enable project updates and customer sharing |
| Portal contacts, sign-in codes, sessions | Contract performance | To let a customer prove who they are and see only their own project |
| Project messages and snags | Contract performance | To keep one record of what was agreed and what needs putting right |
| Subscription and billing status | Contract performance | To run your subscription and tell you where you stand |
| Team member data | Legitimate interests | To enable team management features |
| Subcontractor data | Legitimate interests | To let a subcontractor see the stages they are booked for |
| Quote acceptance records | Legitimate interests | To give both sides evidence of what was agreed and when |
4. How we use your data
- To provide, maintain, and improve the SecondFix service
- To send transactional emails (magic links, portal sign-in codes, quote and invoice notifications, message and snag notifications)
- To send waiting list communications (early access notifications)
- To display your business branding on quotes, invoices, and customer portals
- To generate invoice PDFs
We do not sell your data to third parties. We do not use your data for advertising.
5. Third-party processors
We use the following services to deliver SecondFix. Each processes data on our behalf under appropriate agreements:
| Service | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | EU / US |
| Vercel | App and website hosting | Global (edge network) |
| Resend | Transactional email delivery | US |
| Stripe | Subscription billing and card processing | US / EU |
Google sign-in. If you choose to sign in with Google rather than a magic link, Google confirms your identity and passes us your email address and basic profile details. Google is not acting for us when it does that: it runs your Google account under its own privacy policy, and what it records about your sign-in is between you and Google. We only receive the result.
6. International transfers
Some of our processors may process data outside the United Kingdom. Where this happens, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or equivalent protections recognised by UK data protection law.
7. How long we keep your data
- Waiting list: until you unsubscribe or we launch (whichever is first), then deleted within 30 days
- Account data: for as long as your account is active
- Billing records: kept for 7 years after your last payment, to meet UK tax and accounting requirements
- Job data, quotes, invoices: for as long as your account is active, plus 7 years after deletion (to meet UK tax record-keeping requirements)
- Media (photos, videos, documents): for as long as your account is active, deleted within 30 days of account deletion
- Project messages and snags: for as long as the project exists, then with the job data above
- Portal sign-in codes: they expire after 10 minutes and are cleared once used
- Portal sessions: 30 days, or until the customer signs out or the trade revokes their access
- Subcontractor records: until you delete the subcontractor. Revoking their link cuts off access straight away.
8. Your rights
Under UK GDPR, you have the right to:
- Access: request a copy of your personal data
- Rectification: ask us to correct inaccurate data
- Erasure: ask us to delete your data (subject to legal obligations)
- Portability: receive your data in a structured, machine-readable format
- Restriction: ask us to limit how we use your data
- Objection: object to processing based on legitimate interests
- Withdraw consent: where processing is based on consent, withdraw it at any time
To exercise any of these rights, email hello@secondfix.build. We will respond within 30 days. If the data belongs to a project run by a SecondFix user, we will pass your request to them, because it is their record to change.
9. Complaints
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113
10. Changes to this policy
We may update this policy from time to time. If we make significant changes, we will notify you by email or by displaying a notice in the app. The "Last updated" date at the top of this page will always reflect the most recent version.