JobPlain.Sign in
Back to JobPlain

JOBPLAIN · LEGAL

Privacy Policy

Your business records deserve clear, responsible handling. This notice covers personal information used by JobPlain and your rights under UK data protection law.

Version 2026-11-final-2 · Effective 13 November 2026

On this page

  1. 01Who we are and our role
  2. 02Information covered
  3. 03Purposes and lawful bases
  4. 04Trials, subscriptions and Stripe
  5. 05Providers and international transfers
  6. 06Security and account responsibilities
  7. 07Retention and deletion
  8. 08Your rights and requests
  9. 09Cookies, storage and updates

01. Who we are and our role

JobPlain is operated by Paul Hardman, trading as JobPlain, a UK sole trader, as a subscription service for tradespeople to manage customers, quotes, jobs and invoices. This notice explains how personal information is handled in connection with the website, accounts and service, under the UK GDPR and Data Protection Act 2018, as amended.

Paul Hardman, trading as JobPlain, is the data controller for account administration, subscription management and its own service operations. A tradesperson normally acts as the controller of personal information about their own customers; JobPlain acts as their processor when storing and handling those records on their instructions.

Business and legal correspondence address:

Jobplain
First Floor, Swan Buildings
20 Swan Street
Manchester
M4 5JW
GB

This address is provided by Virtually There for JobPlain’s business use and legal correspondence.

Contact JobPlain at support@jobplain.co.uk for privacy enquiries.

Paul Hardman, trading as JobPlain, is registered with the Information Commissioner’s Office (ICO) under registration number ZC299449.

02. Information covered

  • Account information: sign-in email, user identifier, authentication information and any business details supplied.
  • Customer records: names, contact details, addresses and information entered into quotes, work orders, invoices and payment records.
  • Subscription information: trial dates, subscription status, Stripe customer and subscription identifiers, and payment or billing status.
  • Technical and support information: device or request information needed to operate the service, and information supplied when reporting an issue.
  • Advertising measurement (only if you accept advertising): when a new account completes its first agreement, a pseudonymous reference used to prevent duplicate counting, and the page address without query details other than a Google ad-click identifier. When Google’s tag runs in your browser, Google also receives online identifiers (including cookie identifiers), ad-click information, your IP address and browser and device information.

Only enter information necessary for your work. Do not use JobPlain to store special-category data, criminal-offence information or sensitive identity documents unless appropriate processing arrangements have first been agreed.

If the app hits a technical error, the page address, error message and related technical context may be sent to our hosting provider so we can diagnose the fault. Avoid putting personal information in URLs or support descriptions.

03. Purposes and lawful bases

For account holders, providing accounts and agreed subscription services is generally necessary to perform the contract. Complying with applicable accounting, tax or other legal requirements relies on legal obligation. Security, fraud prevention, troubleshooting and handling legal claims may rely on legitimate interests, after assessing necessity and the effect on individuals.

Where processing requires consent, including any optional marketing or non-essential tracking where applicable, consent must be obtained separately and can be withdrawn without affecting earlier lawful processing. Customer-record processing is carried out on the business account holder’s documented instructions; that business must identify its own lawful basis and provide its customers with a privacy notice.

Lovable visitor analytics remain switched off. Only if you choose Accept advertising, we use Google Ads conversion measurement to learn which of our Google ads lead to new JobPlain accounts. This relies on your consent. It is optional, separate from agreeing to our terms, and you can withdraw it at any time through Cookie settings; refusing or withdrawing does not affect your use of JobPlain. JobPlain’s tag is set with ad personalisation turned off, and we do not use this measurement for remarketing or use Google’s Enhanced Conversions.

04. Trials, subscriptions and Stripe

JobPlain offers an original 14-day free trial, followed by a £9.99 GBP monthly subscription if you confirm a subscription. The operator is not VAT registered and no VAT is charged on the JobPlain subscription. Saving a card or confirming during the trial does not restart or shorten it. The subscription renews automatically until cancelled through Plan & billing.

Stripe processes card setup and subscription payments on its hosted pages. Card details entered there are handled by Stripe, not entered into JobPlain’s customer-record forms. JobPlain uses payment identifiers and status information to manage billing and access. Stripe processes these payments on JobPlain’s behalf, and acts as an independent controller for its own fraud prevention, compliance and legal obligations, as described in its Privacy Policy.

Cancelling renewal does not itself delete your account or customer records. Read the Terms of Service for billing, grace periods and cancellation.

05. Providers and international transfers

Information needed to run JobPlain may be handled by its hosting, authentication and technical service providers, including Lovable Cloud, and Stripe for payments. Access should be limited to what each provider needs. Information may also be disclosed where legally required, to protect legal rights, or to professional advisers subject to suitable confidentiality protections.

The database is in AWS eu-west-1 — Europe (Ireland). Daily full database snapshots are held in the same region. These facts do not mean all provider processing or remote access occurs in Ireland. The site loads Google-hosted fonts, causing browser requests with normal network/request information. No customer file-storage buckets were found in the current configuration.

Lovable Labs Incorporated is the processor under JobPlain’s obtained Lovable DPA. Lovable Labs Sweden AB acts as controller of account data under Lovable’s Privacy Policy. Current subprocessors, their purposes and locations are listed at Lovable’s subprocessor register. Authentication and transactional email delivery is not individually identified beyond that published list.

Section 8.2 of the Lovable DPA provides EU Standard Contractual Clauses, Module Two, for transfers outside the EEA. For ex-UK transfers, the UK SCCs apply, incorporating the UK Addendum to the EU SCCs. Lovable assesses destination-country laws and maintains those assessments. Lovable does not rely on Data Privacy Framework adequacy.

Restricted international transfers must comply with UK GDPR Chapter V. The recorded Lovable DPA provisions supply the UK contractual safeguards described above; Ireland database storage does not mean all provider processing or remote access occurs there.

Google Ads. If you accept advertising, your browser loads Google’s tag from Google’s servers. When a new account completes its first agreement, the tag tells Google that a sign-up happened, with a pseudonymous reference used to prevent duplicate counting. JobPlain sends no name, email address, phone number, business details or payment amount. Google also receives online identifiers, ad-click information, your IP address and browser and device information. Google uses this to link the sign-up to an ad click and report results to us.

For this standard conversion measurement, Google acts as an independent controller under its published Google Ads Controller-Controller Data Protection Terms (https://business.safety.google/adscontrollerterms/; services covered: https://business.safety.google/adsservices/). Google decides how it uses information it receives in that role, as described in its Privacy Policy (https://policies.google.com/privacy).

Google may process this information outside the UK, including in the United States. Google states that it relies on UK adequacy regulations where they apply; in certain circumstances, on the UK Extension to the EU–US Data Privacy Framework, under which Google LLC is certified, for transfers from the UK to the US; and, where it has not adopted such a framework, on standard contractual clauses under its data protection terms, where applicable. Google describes these safeguards at https://business.safety.google/adsdatatransfers/.

06. Security and account responsibilities

JobPlain uses authenticated accounts and database access controls designed to separate each business’s private records. No online service can guarantee absolute security. Use a strong, unique password, keep sign-in details private, sign out on shared devices and report suspected unauthorised access promptly.

The operator must assess suspected personal-data breaches and meet applicable notification duties, including informing the ICO within 72 hours of becoming aware of a notifiable breach, and affected individuals without undue delay where legally required. When acting as processor, JobPlain must notify the business controller without undue delay.

07. Retention and deletion

Personal information should be kept only as long as needed for the stated purpose, applicable legal duties and legitimate legal claims. Account and operational records are used to provide the service; subscription and accounting records may need to remain after cancellation. Suspending access does not itself delete saved customer records.

Deletion requests are assessed individually. Information subject to a legal retention duty or necessary legal hold may be retained with restricted use rather than deleted immediately. Daily full database snapshots are held in Ireland in the same region as the database. Lovable publishes no fixed maximum backup retention or expiry. Retention follows the criteria in Section 13 of Lovable’s Privacy Policy, including operational and security need, followed by deletion or anonymisation; no fixed expiry is promised. Removal from backups may take longer than removal from active systems; retained backups must not be used to restore deleted information into ordinary use without appropriate controls.

Customer work records are held for provision of the service on the business’s instructions, not under JobPlain’s own tax retention. Necessary JobPlain subscription accounting evidence follows applicable tax duties. JobPlain’s retention schedule is:

  • Business records (customers, quotes, jobs and invoices): kept while you use the service or as you instruct. Cancelling does not delete them. If you close your account, you will normally have 30 days to retrieve your data, unless you give an earlier verified deletion instruction or a legal deadline applies.
  • JobPlain subscription and payment accounting records: only the minimum needed for tax, normally five years after the relevant Self Assessment filing deadline. This does not cover your own work invoices.
  • Support correspondence: reviewed 12 months after the case closes, then deleted or minimised unless selected evidence is needed for a documented claim or legal hold.
  • Agreement records: kept during the contract and ordinarily six years after it ends, subject to applicable limitation rules and lawful erasure review.
  • Billing processing records: reviewed monthly and kept only while payment recovery or reconciliation needs them.
  • Deletion and restore records: minimal identifiers reviewed after 90 days and then monthly, kept only while needed to stop deleted information being restored.
  • Diagnostics and security records under JobPlain’s control: 30 and 90 days respectively, unless an incident or legal need requires longer. Provider copies follow the provider criteria described above.
  • Data exports sent to you: JobPlain’s working copies are cleaned up within seven calendar days after sending. This is an operational target, not a guarantee that provider backups or recoverable copies are erased.
  • Advertising choice and Google data: your choice is stored in your browser — an acceptance for up to 12 months (then we ask again), a refusal until you change it. Google’s _gcl_ cookies normally last 90 days. Separately, Google keeps the information it collects for different periods depending on what it is and why it is collected, under its retention policy (https://policies.google.com/technologies/retention). JobPlain does not set those periods and cannot give a single date by which Google deletes conversion data.

Any legal hold names its purpose, the minimum information kept and its own expiry, and is reviewed monthly. Reviews are carried out manually; these periods do not mean automatic deletion and do not override statutory duties. Verified deletion requests are carried out manually for the requesting business only, normally within one month.

08. Your rights and requests

Subject to the conditions in law, you may request access to your personal information, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent where used. These rights are not absolute: for example, legal accounting duties may prevent immediate deletion of some records.

You can withdraw advertising consent at any time using the Cookie settings link at the foot of every page. Because Google acts as an independent controller for this measurement, you can also exercise your rights directly with Google.

Send a request to support@jobplain.co.uk, identify the account or information involved, and state what you need. Only proportionate identity checks should be requested; do not send your password or full card details. Requests are normally answered without charge and without undue delay, generally within one month; lawful extensions or exceptions must be explained.

If you are a tradesperson’s customer and your information is in that business’s records, contact that business first. JobPlain should assist its business customer in responding, rather than independently overriding their lawful instructions.

Postal requests can be sent to the business and legal correspondence address in “Who we are and our role” above.

You may complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, if you are concerned about how your information is handled.

09. Cookies, storage and updates

JobPlain uses authentication session storage for sign-in and security: local browser storage on the public site and brokered platform storage inside the editor preview. It persists across visits until removed by sign-out or applicable session/browser handling; no fixed local-storage expiry is claimed. App query data is cached in memory and cleared during sign-out. The current app does not use the available sidebar-preference cookie utility. Lovable visitor analytics remain switched off for JobPlain. Published hosting still uses necessary cookies such as __cf_bm and __dpl for hosting/security; the analytics session-id cookie does not apply while Lovable visitor analytics are off. Google-hosted fonts and Stripe-hosted billing make third-party requests. Advertising cookies are optional and JobPlain asks every visitor first. Until you choose Accept advertising, and after you choose Reject, Google’s advertising tag is not loaded. If you accept, Google may set _gcl_ cookies (such as _gcl_au, and _gcl_aw when you arrived from a Google ad) on JobPlain’s domain; Google states these normally last 90 days (https://policies.google.com/technologies/cookies). Google may also use its own cookies on Google domains. Your choice is saved in your browser’s local storage. Browsers sending Global Privacy Control are treated as refusing advertising. This notice is not a claim that all storage is exempt from consent.

If you withdraw consent in Cookie settings, JobPlain immediately tells the Google tag that consent is refused, sends it no further sign-up events and removes the _gcl_ cookies it can remove on its own domain. Google code that has already loaded in an open page stays in your browser’s memory until that page is reloaded or closed; after that, JobPlain does not load it again. Cookies on Google’s domains are controlled through your browser or Google’s settings.

Production request logs include the URL and query string, method, caller IP, response status and timing, and coarse location. Headers and request bodies are not retained in these request logs. Avoid placing personal information in URLs. Under Section 13 of Lovable’s Privacy Policy, logs are retained according to operational and security need, then deleted or anonymised; no fixed numeric log-retention period is claimed. These request-log facts do not establish the contents or retention of separate application error reports.

The operator should update this notice when processing changes and communicate material changes appropriately. This version is effective from 13 November 2026.

JobPlain.

Made for the people who get the job done.

Sign inStart free trial
© 2026 JobPlain
Privacy PolicyTerms of ServiceCustomer Data Processing Terms
Quotes. Jobs. Invoices. Sorted.