Privacy Policy

Privacy Notice version: 1.0 — Beta

Service version at drafting: v0.0.7.4

Last updated: 4 September 2026

1. Who we are

ServiceClerk is a business-management software service for trades and other service businesses.

The operator and data controller for the processing described in section 3 is NC, trading as ServiceClerk, of Stanley Court, Olney, Milton Keynes, MK46 5NH. In this notice, ServiceClerk, we, us and our refer to that operator.

You can contact us about privacy at:

• Email: info@serviceclerk.co.uk
• Post: NC trading as ServiceClerk, Stanley Court, Olney, Milton Keynes, MK46 5NH

This notice explains how we use personal data when you visit our website, contact us, create or use a ServiceClerk account, subscribe, request support, use an integration or AI feature, or otherwise deal directly with us. It also explains our role when a ServiceClerk business customer enters information about its own customers, prospective customers, workers, suppliers and other contacts.

2. When this notice applies

This notice applies to:

• visitors to serviceclerk.co.uk;
• people who contact ServiceClerk or submit a website enquiry;
• prospective, trial, current and former ServiceClerk customers;
• account owners, administrators and authorised users;
• people included in support, security or billing records;
• people whose data a business customer places in ServiceClerk; and
• people who interact with a ServiceClerk-powered enquiry form, booking page, document, communication, customer link or job-tracking link.

The Service is intended for business use. You must be at least 18 to create or administer an account.

3. Our different data-protection roles

3.1 When ServiceClerk is the controller

ServiceClerk acts as controller when we decide why and how personal data is used for our own purposes. This generally includes:

• operating our website and handling enquiries;
• creating and administering ServiceClerk accounts;
• verifying email addresses and authenticating users;
• providing security, preventing abuse and keeping audit records;
• administering trials, subscriptions and billing;
• providing support and communicating about the Service;
• managing our own legal, tax and business records;
• understanding and improving the reliability and use of the Service; and
• sending our own marketing where permitted.

3.2 When ServiceClerk is a processor

A business customer normally decides why and how information about its customers, prospective customers, workers, suppliers and other contacts is used inside its ServiceClerk workspace. For that information, the business customer is normally the controller and ServiceClerk acts as its processor, handling the data on the customer's instructions to provide the Service.

This may include customer and property records, enquiries, bookings, jobs, calendars, quotes, invoices, expenses, timesheets, forms, certificates, photographs, signatures, communications, location information, imports, exports and AI inputs and outputs.

Our Data Processing Terms are in Schedule 1 of the ServiceClerk Terms of Service.

If you are a customer, worker, supplier or other contact of a business using ServiceClerk, you should normally direct a privacy request to that business first. It controls the relevant record and can decide how your request should be handled. We will assist that business as required. You may still contact us if you are unsure which business controls your information.

4. Personal data we collect

Depending on how you interact with ServiceClerk, we may process the following categories.

4.1 Account and identity data

• name, email address, telephone number and profile photograph;
• business name, role, organisation membership and permissions;
• account status, trial status and onboarding progress;
• password hash and email-verification status; and
• passkey public-key information, authenticator configuration and recovery or security status.

We do not store your password in readable form.

4.2 Business and subscription data

• trading and contact details supplied for a business workspace;
• selected plan, subscription status, trial and renewal dates;
• Stripe customer, subscription, invoice, payment-status and transaction references;
• billing correspondence, credits, refunds and failed-payment information; and
• records needed for accounting, tax, fraud prevention and dispute handling.

ServiceClerk does not receive or store complete payment-card details. Card and supported payment-method details are supplied directly to and processed by Stripe.

4.3 Technical, usage and security data

• IP address, approximate network location, device and browser information and user agent;
• sign-in time, session, authentication method and last-active information;
• security events, failed attempts, rate-limit information and audit records;
• pages and features used, actions taken, timestamps and error or diagnostic information;
• notification preferences, push-subscription information and delivery status; and
• cookie and similar technical identifiers required to provide and secure the Service.

4.4 Enquiry, support and communication data

• name, email address, subject, message and selected department submitted through our contact form;
• support requests, replies, internal support notes and relevant account or workspace references;
• emails and other communications exchanged with us;
• communication delivery status and limited provider references; and
• where enabled, whether a ServiceClerk email or customer link was opened or accessed.

4.5 Customer workspace data

A business customer or its users may enter or generate information including:

• customer and prospective-customer names, contact details, preferences and communication history;
• property, site, access and appointment information;
• enquiries, bookings, calendar entries, jobs, service history and notes;
• employee, worker, contractor, assignment, time and rate information;
• supplier, purchasing and expense information;
• quotes, invoices, payment status, job costing and reports;
• photographs, attachments, signatures, forms, certificates and test records;
• messages, tasks, reminders and notification history;
• marketing permission, objection and suppression information;
• integration identifiers and synchronised external-service data; and
• AI inputs, contextual information and AI-generated outputs.

The exact content is determined by the business customer and its authorised users.

4.6 Location data

If a business customer enables live job tracking, ServiceClerk may process a worker's device location during an active journey. The business customer controls whether the feature is enabled, who may use it and whether a short-lived tracking link is shared with a customer. Live sharing stops when the journey ends, the session expires or sharing is switched off. Related journey and communication records may remain with the relevant job record.

Workers must be told by their employer or engaging business when location tracking is used and why. ServiceClerk does not enable a business to track a worker secretly or continuously outside an active authorised tracking session.

4.7 AI data

When an authorised user invokes an AI feature, ServiceClerk may send the user's instructions and relevant contextual information to the configured AI provider. The response and related workflow information may then be returned to or recorded in the workspace.

We may also retain limited AI usage metadata, such as the organisation and user, feature purpose, model used, token counts, status, timestamps and a bounded error description. This helps us operate usage limits, troubleshoot failures and manage the Service.

4.8 Special-category and criminal-offence data

ServiceClerk is not designed as a general repository for health, biometric identification, racial or ethnic origin, political opinion, religious belief, trade-union membership, sex-life or sexual-orientation data, genetic data, or criminal-offence data.

Business customers and users must not enter these categories unless a feature expressly supports the processing and they have established a valid legal basis, an additional legal condition where required, suitable safeguards and a genuine need to use the data.

Passkeys and device biometrics are handled by the user's device or platform. ServiceClerk receives the authentication result and passkey public-key information, not the user's fingerprint or facial image.

5. Where personal data comes from

We may obtain personal data:

• directly from you when you visit, contact us, register, subscribe or use the Service;
• from the owner or administrator of your organisation's ServiceClerk account;
• from other authorised users in the same workspace;
• from a customer or other person using a public form, booking page, document or customer link;
• from Stripe in connection with subscription billing;
• from an external service that an authorised user chooses to connect;
• from the device, browser and systems used to access ServiceClerk;
• from email, push, communications and security providers; and
• from our service providers where needed to operate, secure and support the Service.

Where a business customer imports or enters information about someone else, that customer is responsible for ensuring it has authority to do so and for giving the person appropriate privacy information.

6. Why we use personal data and our lawful bases

We use personal data only where we have a lawful basis. The basis depends on the purpose and circumstances.

6.1 Contract and steps before a contract

We use account-owner, business, subscription, service-use and support data where necessary to:

• provide a requested trial or paid Service;
• create and administer an account;
• authenticate users and deliver requested functions;
• process subscription instructions and administer billing;
• provide support; and
• enforce or administer our Terms of Service.

Where a user is not personally party to our contract, this processing may instead rely on the legitimate interests described below.

6.2 Legitimate interests

We use personal data where necessary for our legitimate interests or those of a customer or third party, after considering the person's rights and reasonable expectations. Those interests include:

• operating, securing and improving a business software service;
• preventing fraud, misuse, unauthorised access and service disruption;
• maintaining auditability, service reliability and business continuity;
• managing customer relationships, support and ordinary business communications;
• understanding use of features and fixing faults;
• protecting, establishing and defending legal rights; and
• marketing ServiceClerk to relevant business contacts where the law permits.

We do not rely on legitimate interests where the person's rights and freedoms override those interests. Where required, we carry out and record a legitimate-interests assessment.

6.3 Legal obligation

We may process personal data to comply with tax, accounting, data-protection, law-enforcement, court, regulatory and other legal obligations.

6.4 Consent

We rely on consent where the law requires it, including for certain electronic marketing or non-essential cookies. Consent can be withdrawn at any time. Withdrawal does not affect processing that was lawful before withdrawal.

6.5 Customer instructions

When ServiceClerk acts as processor, we process Customer Personal Data on the business customer's documented instructions and under our Data Processing Terms. The customer is responsible for selecting and documenting its own lawful basis and, where applicable, any additional condition for sensitive information.

7. Artificial intelligence and automated processing

ServiceClerk uses artificial-intelligence and automated systems in parts of the Service. Depending on the available feature, they may help draft or summarise text, organise or extract information, suggest content, populate records or assist with a workflow.

AI outputs are probabilistic and may be inaccurate, incomplete or unsuitable. They are intended to assist an authorised user, not replace meaningful human review. Users must verify an output before relying on it, sending it externally or using it in a quote, invoice, certificate, safety record, employment matter or other significant context.

The current text-generation integration uses the OpenAI API. ServiceClerk sends only the instructions and bounded context needed for the request, together with a pseudonymous safety identifier. Requests are configured with storage disabled at the API application-state level. OpenAI may nevertheless retain limited API content and metadata for a restricted abuse-monitoring period under its applicable API terms and data controls. OpenAI's published API data policy states that API data is not used to train its general-purpose models unless the API customer expressly opts in. ServiceClerk does not authorise identifiable Customer Personal Data to be used for general-purpose model training.

More information is available in OpenAI's API data-controls documentation.

ServiceClerk does not itself use AI to make solely automated decisions about account holders that have legal or similarly significant effects. A business customer must not configure or use ServiceClerk to make such a decision about another person without a valid lawful basis, appropriate safeguards, required information, a way to obtain human intervention and a way to contest the decision.

We may change AI models or providers during the beta. We will update this notice before a materially different use of personal data begins.

8. Who we share personal data with

We share only what is reasonably necessary for the relevant purpose. Recipients may include:

• hosting, database, storage, backup, security and technical-support providers;
• email, support-mailbox, SMS and push-notification providers where those channels are enabled;
• Stripe for ServiceClerk subscription payments and billing administration;
• OpenAI for invoked AI features;
• Microsoft/Outlook, Xero, QuickBooks and Mailchimp when an authorised user enables and uses the relevant connection;
• professional advisers, insurers, accountants, auditors and legal advisers;
• courts, regulators, law-enforcement bodies or public authorities where disclosure is required or lawful;
• a prospective purchaser, successor or incorporated company if the ServiceClerk business is reorganised, transferred or sold, subject to appropriate confidentiality and data-protection safeguards; and
• other people where you or the relevant business customer instructs or authorises the disclosure.

External services are governed by their own terms and privacy information when you hold and connect an account with them. You can review information from Stripe, Microsoft, Xero, and Intuit, including QuickBooks and Mailchimp.

We do not sell personal data. We do not disclose Customer Personal Data for third-party advertising.

9. International transfers

ServiceClerk is operated from the United Kingdom, but some providers and connected external services may process personal data in other countries. The laws in those countries may differ from UK law.

Where ServiceClerk makes a restricted transfer of personal data outside the United Kingdom, we use a lawful transfer mechanism. Depending on the destination and recipient, this may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved EU Standard Contractual Clauses, or another mechanism permitted by UK data-protection law. Where required, we also assess the protection available in the destination and apply additional safeguards.

You may contact us for further information about the safeguard relevant to a particular provider or transfer.

If a business customer chooses to connect an external service, it is also responsible for considering transfers caused by its instructions and configuration.

10. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the relevant purpose, including contractual, security, tax, accounting and legal requirements. The period depends on the nature and context of the information.

Our current retention approach is:

• Trial workspaces: for the trial and up to 30 days after it ends where no paid subscription begins, allowing time to request an available export, after which active workspace data may be deleted or de-identified.
• Paid workspaces: while the subscription operates and ordinarily for up to 30 days after it ends, allowing time to request an available export, after which active workspace data may be deleted or de-identified.
• Integration credentials: until the integration is disconnected, access is revoked, the workspace is deleted or the credentials are replaced; limited connection and audit records may be kept longer.
• Live location: current location sharing is limited to an authorised active or unexpired tracking session. Related job, journey, access and communication records follow the workspace's retention.
• Account security and audit information: for as long as reasonably required to secure accounts, investigate incidents, demonstrate authorised activity and protect legal rights. Expired credentials and sessions may be removed or irreversibly invalidated sooner.
• Website enquiries and support records: for as long as needed to answer the request, manage the relationship, improve support and deal with disputes or legal claims.
• Subscription, transaction and tax records: normally for at least six years where needed for tax, accounting, fraud prevention, disputes or legal compliance.
• Marketing preferences: until you opt out or we no longer have a purpose to contact you. We may keep a minimal suppression record after an opt-out so that we honour it.

Protected residual copies may remain in backups until overwritten through the ordinary backup-rotation cycle. Backup copies remain restricted and are not restored except for legitimate recovery, continuity or security purposes.

We may retain information for longer where required by law, a regulator, litigation hold, fraud or security investigation, or the establishment, exercise or defence of legal claims. We may retain aggregated or de-identified information that no longer identifies an individual.

A business customer may need to keep its own customer, employment, tax, safety or professional records for longer. It controls retention of its workspace data while the account is active and should configure and operate its own retention procedures accordingly.

11. Security

We use technical and organisational measures intended to protect personal data. Depending on the data and feature, these include access controls, tenant separation, authentication controls, passkeys and multi-factor authentication, encryption in transit, protection of stored credentials and sensitive values, private file storage, audit logging, rate limiting, security monitoring, backups and controlled support access.

No internet service can guarantee absolute security. Customers and users must protect their credentials and devices, use appropriate permissions, keep authorised-user access current and tell us promptly if they suspect unauthorised access.

Please report a suspected security or privacy incident to info@serviceclerk.co.uk.

12. Cookies and similar technologies

ServiceClerk uses cookies and comparable browser storage where needed to operate and secure the website and Service. These may support session management, authentication, form security, user preferences and remembered security choices.

We will request consent before using a non-essential cookie where UK law requires it. You can control cookies through your browser and any consent controls we provide, although blocking strictly necessary cookies may prevent sign-in or other requested functions from working.

See our Cookie Policy for the current cookie list, purposes and durations.

13. Marketing

We may send product news or offers to relevant business contacts where we have consent or another lawful permission. You can opt out at any time by using the unsubscribe method in the message or emailing info@serviceclerk.co.uk.

Service and security messages, such as verification, billing, incident, account and material product notices, are not marketing and may still be sent where necessary.

A business customer is independently responsible for marketing it sends to its own contacts using ServiceClerk or Mailchimp, including consent, the soft opt-in where applicable, transparency, suppression lists and objections.

14. Your data-protection rights

Depending on the processing and lawful basis, you may have the right to:

• be informed about how your personal data is used;
• ask for access to your personal data and related information;
• ask for inaccurate data to be corrected and incomplete data completed;
• ask for personal data to be erased in certain circumstances;
• ask us to restrict processing in certain circumstances;
• receive personal data you provided in a structured, commonly used and machine-readable form where the right to portability applies;
• object to processing based on legitimate interests;
• object at any time to processing for direct marketing;
• withdraw consent where processing relies on consent; and
• obtain information, make representations, request human intervention and contest a solely automated significant decision where the law provides those safeguards.

Your right to object: you may object to processing based on legitimate interests where your circumstances justify it. We will stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. We will always stop using your personal data for direct marketing if you object.

Rights are not absolute and exemptions may apply. We may ask for proportionate information to verify identity and authority before acting on a request.

To exercise a right concerning data ServiceClerk controls, email info@serviceclerk.co.uk. We normally respond within one month. A complex request or multiple requests may lawfully require more time, in which case we will tell you.

If the request concerns information entered by a business customer about you, contact that business first where possible. We will support it in responding to valid requests.

15. Complaints

Please contact us first at info@serviceclerk.co.uk so that we can investigate and try to resolve your concern.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority. Information about making a complaint is available from the ICO website.

You may also seek a remedy through the courts.

16. Changes to this notice

ServiceClerk is beta software and its features and providers may change. We will review this notice and update it when our processing materially changes or the law requires it.

We will publish the updated notice on this page and change the “Last updated” date. Where a change is material, we will take reasonable steps to bring it to the attention of affected account holders before the new processing begins.

17. Contact

Questions, requests and complaints about privacy may be sent to:

• Email: info@serviceclerk.co.uk
• Post: NC trading as ServiceClerk, Stanley Court, Olney, Milton Keynes, MK46 5NH