Privacy Policy
PainterPal ("we", "our", the "App") is operated by Julan Raveendran (sole trader, England & Wales). This policy explains what we collect, why, who else sees it, and how to delete it. It is written for UK GDPR and the Data Protection Act 2018.
1. What we collect
We only collect data you give us by signing up and using the app:
- Email address - for sign-in and account recovery.
- Account identifier - a UUID we generate on first sign-in.
- Business profile - business name, day rate, hourly rate, payment terms, and the logo image you upload.
- Job briefs - the plain-English text you type into the Assistant, or voice recordings if you use voice capture. Recordings are transcribed to text and the audio is not stored.
- Estimates - the AI's structured output, stored on your account.
- Quotes and clients - the records you create yourself, which may include your customers' names, phone numbers, and addresses. You are responsible for having a lawful basis to enter your customers' details.
- Subscription status - whether your account is on the Free or Pro plan, managed via RevenueCat and your app store.
- Diagnostic data (optional) - crash reports, performance metrics if Sentry is enabled.
- Product analytics (optional) - pseudonymous interaction events (sign-in, brief submitted, quote saved) linked to your PainterPal account identifier, used for analytics and product improvement, if PostHog is enabled. These are not used for advertising and never track you across other apps or websites.
We do not collect:
- Location data
- Contacts from your address book
- Tracking IDs across other apps or websites
- Card or payment details (payment is handled entirely by Apple or Google; we never see your card)
2. How we use it
| Purpose | Data used | Lawful basis |
|---|---|---|
| Provide the service (sign-in, save your work) | Email, profile, quotes, clients | Contract |
| Generate AI estimates | Job briefs, business profile, your past edited estimates | Contract |
| Diagnose crashes and bugs | Diagnostic data | Legitimate interests |
| Improve the product | Analytics events | Legitimate interests |
| Comply with legal requests | Any of the above | Legal obligation |
We do not sell your data. We do not use it to train third-party AI models for other companies.
3. Third parties (data processors)
We use these services to run the app. Each is a data processor under our instructions, with their own privacy policies.
| Provider | Role | Data they process | Region |
|---|---|---|---|
| Supabase Inc. | Auth, database, file storage, edge functions | Everything you save | EU |
| OpenAI | AI estimate generation and voice transcription | Job briefs, voice recordings (transcribed, not stored), business profile, recent quote summaries | US |
| RevenueCat | Subscription management | Account identifier, purchase history | US |
| Sentry (optional) | Crash reporting | Crash logs, device info | US/EU |
| PostHog (optional) | Product analytics | Pseudonymous interaction events linked to your account identifier | EU |
OpenAI specifically: when you tap "Generate estimate", the brief plus your last 5 quote summaries and last 3 edited estimates are sent to OpenAI's API. If you record a voice brief, the audio is sent to OpenAI's transcription API, converted to text, and the audio is not retained. OpenAI does not retain this data for model training under their API terms.
4. International transfers
OpenAI, RevenueCat, and Sentry may process data outside the UK and EU. Transfers rely on the UK International Data Transfer Agreement, EU Standard Contractual Clauses, and adequacy decisions where applicable.
5. Your rights (UK GDPR)
- Access - request a copy of the data we hold on you.
- Rectification - correct inaccurate data; you can also do this yourself via the avatar (top-right) > Settings > Business profile.
- Erasure - delete your account and all data immediately via the avatar (top-right) > Settings > Account > Delete account. This wipes your auth record, profile, clients, quotes, and logo files.
- Portability - request your data in a machine-readable format.
- Object - to processing based on legitimate interests (analytics, crash reporting).
- Complain - to the ICO (ico.org.uk) if you believe we've mishandled your data.
To exercise any of these, email us at the address below. We respond within 30 days.
6. Data retention
- Active accounts: held for as long as you use the app.
- Deleted accounts: erased immediately when you tap Delete account. Backups containing your data are overwritten within 30 days.
- Diagnostic data: retained for 90 days, then deleted.
7. Children
PainterPal is for working tradespeople aged 18 and over. We do not knowingly collect data from anyone under 16.
8. Security
-
Auth tokens are stored on-device in iOS Keychain / Android Keystore
via
expo-secure-store. - All Supabase access is scoped per-user with Row Level Security; one user cannot read another user's rows.
- Edge functions verify the caller's JWT before running.
We don't claim our system is unbreakable. If we discover a breach affecting your data, we'll tell you and the ICO within 72 hours.
9. Changes
If we make a material change, we'll update this page and bump the version. The current version is shown at the top.
10. Contact
Email: julanraveendran2@gmail.com (subject line "Privacy" reaches us fastest).