Privacy Policy

Last updated: 10 July 2026

Summary

Pherox Technologies Ltd runs a quoting and job-management tool for UK tradespeople. This policy explains how we look after your personal data when you use Pherox.

The most important thing to understand is this: when you (a tradesperson) use Pherox to quote a job for one of your customers (a homeowner), there are two sets of personal data involved. We treat them differently.

Your data, as a Pherox user. We are the data controller. This policy covers what we do with it.
Your customer's data, which you enter into Pherox. You are the data controller. We are your data processor; we process that data only on your instructions to provide the service to you. Our Data Processing Agreement governs that relationship.

If you have any questions about either set of data, email us at [email protected].

1. Who we are

Pherox Technologies Ltd is a company registered in England and Wales (company no. 17181975). Our registered office is at 195 Manchester Road, London E14 3DR.

We provide the Pherox service ("Pherox", "the service"), a mobile-first quoting and job-management platform for UK tradespeople, available at pherox.co.uk and app.pherox.co.uk.

In this policy, "we", "us" and "our" mean Pherox Technologies Ltd. "You" means anyone who uses Pherox or visits our websites.

If you want to contact us about your personal data, including to exercise any of your rights under UK data protection law, email [email protected].

We are registered with the UK Information Commissioner's Office (ICO) under registration number ZC133994.

We are not required by law to appoint a statutory Data Protection Officer. Denis and Artour Kvasnei, co-founders of Pherox Technologies Ltd, are jointly accountable as our Data Protection Leads. You can reach them at the email address above.

2. The two data relationships, in plain English

Pherox sits between you (a tradesperson running a business) and your customers (the people you are quoting for, usually homeowners).

For your personal data, the data we hold about you because you have a Pherox account, we are the data controller. We decide why and how we use it. The rest of this policy explains how.

For your customers' personal data, the data you enter into Pherox when you quote a job (their name, address, the work you are doing for them, the price you are quoting), you are the data controller. We are your data processor. We hold that data on your behalf to run the service for you. We do not use it for our own purposes. Our Data Processing Agreement (Schedule A to the Terms) sets out the terms of that arrangement, including security measures and what happens if your customer asks about their data.

If you are a homeowner and you have received a quote produced using Pherox, the tradesperson who sent it to you is the data controller for your data. Contact them directly to ask about it. We can pass requests to them on request, but we cannot act on them ourselves.

3. What personal data we collect about you

We collect only the personal data we need to run Pherox for you.

When you create a Pherox account, we collect:

Your name
Your business name (if different)
Your email address
Optionally, your phone number, business address, trade type, and any registration numbers you choose to add to your account (for example a Gas Safe number)

When you log in, we collect:

The email address you ask the magic-link to be sent to
The IP address and approximate location of the device you log in from
The time of login and basic device information (browser, operating system)

We do not use passwords. We send a one-time magic link to your email address to log you in.

When you pay for a paid tier, we collect:

Your billing details, processed entirely by Stripe. We do not see or store your card details.
Records of your subscriptions, invoices and payments. These are needed for accounting and tax purposes.

While you use Pherox, we collect:

Records of what you do in the service (which jobs you create, which features you use), so we can run the product, fix bugs, and improve it
Standard technical logs (IP, timestamp, page or screen, error messages)
Anonymised aggregated usage statistics

If you contact us, we collect:

The contents of your message and any reply, so we can support you and improve the service

If you fill in a form on our website, we collect:

Your email address
Any other information you give us in the form (for example, the trade you have asked to be notified about when it launches, or a question you have sent via our contact form)

We do not knowingly collect any special category data (such as health, religion, political opinions, or biometric data). Please do not enter any into Pherox; the product is not designed for it.

4. Why we use your personal data, and our lawful basis

UK data protection law requires us to have a lawful basis for everything we do with your personal data. Here is what we do, why, and under which lawful basis.

What we do	Why	Lawful basis (UK GDPR)
Run your account, give you access to features you have paid for	To provide the service you signed up to	Contract performance (Art. 6(1)(b))
Take payment	To deliver the service you bought	Contract performance
Send you essential transactional emails (sign-in links, billing notices, security alerts, service-affecting notices, trial reminders)	To run the service	Contract performance
Send you a notification email when a trade or feature you opted in to becomes available	To deliver what you asked for	Consent (Art. 6(1)(a)); you can withdraw at any time
Detect, prevent and respond to fraud or abuse of the service	To protect Pherox and other users	Legitimate interest (Art. 6(1)(f))
Keep accounting and tax records	To comply with UK law	Legal obligation (Art. 6(1)(c))
Defend ourselves against legal claims	To protect our rights	Legitimate interest

You can object to any processing we do on the basis of legitimate interest. Email us at [email protected] and we will respond.

We do not currently operate any analytics. If we introduce analytics in the future, we will update this policy with the relevant lawful basis and, where required, ask for your consent first.

5. AI features and the Builder tier

Pherox does not use AI features in the Tradesman tier, which is the only tier available at the time this policy was published.

The Builder tier, which is not yet generally available, will include an AI-assisted feature. We will update this policy with full details before that tier ships.

6. Who we share your personal data with

We share personal data only with carefully chosen third parties who help us run the service. We never sell personal data. We never let anyone use your personal data for their own marketing.

The third parties we use ("sub-processors") fall into these categories:

Payment processing: Stripe.
Database and backend hosting: Supabase (data residency London, eu-west-2 UK region), holding your account data and all of your customers' personal data that you enter into Pherox.
Application hosting: Fly.io (London, LHR).
Frontend and marketing-site hosting, plus edge protection: Cloudflare (CDN, WAF, and bot protection). Cloudflare does not host our application database or our backend code.
Transactional email delivery: Resend.
Phone verification (anti-abuse sign-up gate): Twilio Verify.
Team mailbox: Google Workspace (for the [email protected] inbox where you can reach us).
Error monitoring: Sentry, EU region (Frankfurt).

We do not currently use any analytics or A/B-testing sub-processors. Analytics tools (a cookieless tool such as Plausible, and consent-gated tools such as Google Analytics or Microsoft Clarity) and A/B testing (GrowthBook) are planned for the future. If and when we introduce them, we will add them to this list and to our Sub-processor List, and where they require cookies they will load only after you consent.

Our full, current sub-processor list, with locations and transfer mechanisms, lives at pherox.co.uk/sub-processors. We give 30 days' notice on that page before adding or changing a sub-processor.

We may also share personal data with:

Our professional advisers (lawyers, accountants, auditors, insurers) when we genuinely need to, under confidentiality
Public authorities, regulators, or courts where we are legally required to
Any successor business if Pherox is sold or restructured (you would be notified)

7. International data transfers

Pherox is based in the UK. Some of our sub-processors are based outside the UK, including in the European Economic Area (EEA) and the United States.

Where personal data leaves the UK, we make sure it is protected by an appropriate safeguard:

For transfers to the EEA, we rely on the UK's adequacy decision for the EEA.
For transfers to the United States, we rely first on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified. Where that is not available, we use the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum.
For transfers to anywhere else, we use the UK IDTA or equivalent ICO-approved safeguards, and we carry out a Transfer Risk Assessment.

You can ask us for a copy of the transfer safeguards in place for any sub-processor by emailing [email protected].

8. How long we keep your personal data

We keep personal data only for as long as we need it.

Data	Retention
Active account data	While your Pherox account is active
Closed account data	30 days after closure (in case you want it restored), then deleted or anonymised
Backups	Daily backups, retained on a rolling basis for up to 7 days; no point-in-time recovery
Billing records and invoices	6 years from the end of the accounting period (HMRC requirement)
Web form submissions (notify-me, contact form)	12 months from your last engagement, or until you ask us to delete it
Customer support tickets	2 years from closure
Server and security logs	30 days

When the retention period ends, we delete the data or anonymise it so it can no longer identify you.

If a longer retention is required by law (for example to defend a legal claim, or because of a specific regulatory obligation), we may keep the data for that longer period.

9. Your rights

Under UK data protection law, you have the following rights about your personal data. You can exercise any of them by emailing [email protected].

Right of access: ask us for a copy of the personal data we hold about you.
Right to rectification: ask us to correct anything that is wrong or incomplete.
Right to erasure ("right to be forgotten"): ask us to delete your data, where there is no good reason for us to continue holding it.
Right to restrict processing: ask us to pause processing your data, for example while we look into a correction or objection.
Right to data portability: ask us to give you a copy of your data in a machine-readable format, or to transfer it directly to another service where this is technically possible.
Right to object: ask us to stop processing your data where we rely on legitimate interest, including objecting to direct marketing.
Right to withdraw consent: where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.
Rights about automated decisions: we do not make any solely automated decisions that have a legal or similarly significant effect on you.

We will respond to your request within one calendar month. If your request is complex, we may extend that by up to two further months, in which case we will tell you why.

If we cannot do what you have asked (for example because we have a legal obligation to keep the data, or because the request is manifestly unfounded or excessive), we will tell you why.

You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would prefer the chance to put things right first, but you do not have to come to us before going to the ICO. See section 12 for our complaints process.

10. Cookies and similar technologies

When you use our websites and the Pherox app, we use a small number of strictly necessary cookies to make the service work and keep it secure (for example to keep you logged in). We do not currently use analytics or tracking cookies, and we do not show a cookie banner. If we introduce optional cookies in the future, we will ask for your consent first.

Our Cookie Policy at pherox.co.uk/cookies explains each cookie in detail.

11. Security

We take the security of personal data seriously and use industry-standard measures including:

Encryption in transit (HTTPS / TLS)
Encryption at rest for sensitive data
Access controls and least-privilege principles for our team
Passwordless authentication for users (magic-link)
Regular security review and patching
Sub-processor due diligence

No system is completely secure. If we ever experience a personal data breach that is likely to risk your rights and freedoms, we will tell the ICO within 72 hours of becoming aware of it, and we will tell you directly without undue delay if the risk to you is high.

If you find a security issue in Pherox, please report it under our Responsible Disclosure policy at pherox.co.uk/security.

12. Complaints

If you are unhappy with how we have handled your personal data, please tell us. We would like the chance to put it right.

Email [email protected] with the word "Complaint" in the subject line. Our Data Protection Complaints Procedure at pherox.co.uk/complaints explains how we handle complaints. In short:

We will acknowledge your complaint within 30 days.
We will investigate and respond as quickly as we reasonably can.
If you are not satisfied with our response, you can escalate to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

13. Children

Pherox is a B2B tool for working tradespeople. You must be at least 18 years old to create a Pherox account. We do not knowingly collect personal data from anyone under 18. If you think we have done so by mistake, email [email protected] and we will delete the data.

14. Changes to this policy

We will update this policy when our practices, the law, or our service change. The "last updated" date at the top of this document always shows the current version.

If we make material changes (for example we change what we use your data for, or we add a significantly different sub-processor), we will tell you by email at least 30 days before the change takes effect, where we reasonably can. You will be able to close your account if you do not want to continue under the new terms.

We keep an archive of previous versions of this policy. Email [email protected] if you want a copy of an earlier version.

15. How to contact us

By email: [email protected]

By post:
Data Protection Lead
Pherox Technologies Ltd
195 Manchester Road
London E14 3DR