Privacy Policy

Treetask is a job management application for tree surgery businesses, operated by Treetask Ltd (“we”, “us”). This policy explains what data the Service handles, why, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).

1. Who we are

Treetask is operated by Treetask Ltd, a company registered in England and Wales under number 17401472, the data controller for the account and technical data described below.

Registered office: Holly Tree, Sidmouth, Devon EX10 0BZ

We have not appointed a Data Protection Officer — the Service does not meet the tests in UK GDPR Article 37 that require one. Data questions go to hello@treetask.app.

2. The data we handle

Account data — your name, email address and encrypted login credentials.

Business records — data your business enters into the Service: customer names and contact details, site addresses, surveys, quotes, jobs, invoices, photographs, risk assessments and related documents. For this data, your business is the data controller and we act as a processor on your instructions — our processor commitments are set out in the Data processing section of our

.

Support messages — when you use the “Get in touch” form in the app, we keep what you wrote, the email address you asked us to reply to, and the screen and browser you sent it from, so we can answer you and fix what you reported. We are the controller for this correspondence. Please don’t include customer details in it unless they are part of the problem.

Technical data — authentication session cookies (required for login) and standard server logs. If the app hits an error, a technical report of what went wrong (the error and where in the app it happened) is sent to our error monitoring service; these reports are configured not to include your IP address or the content of your business records. We do not use advertising or cross-site tracking cookies — everything we store on your device is listed on our cookies page.

3. How we use it

Solely to provide the Service: storing and displaying your business records, generating quote and invoice documents, sending emails you initiate, and operating the integrations you connect. We do not sell data, use it for advertising, or use it to train AI models.

4. Our lawful basis

Contract — for your account and everything needed to deliver the Service you signed up for: signing you in, storing and displaying your records, producing documents, and sending the Service’s own emails such as sign-in, password reset and the weekly summary.

Legitimate interests — for keeping the Service working and secure: server logs, technical error reports, and aggregate counts of which screens are used. Our interest is in running a reliable service; the data involved is technical rather than personal detail about you, and you can object at any time.

Legal obligation — where we have to keep records, for example for tax.

For the business records your account holds, your business decides the purpose and the lawful basis; we act on its instructions. There is no automated decision-making or profiling that produces legal or similarly significant effects.

5. Where it’s stored and who processes it

We use a small number of infrastructure providers to run the Service:

Supabase (database and authentication, hosted in the EU), Vercel (application hosting), Cloudflare (photo and document storage), PowerSync (syncs your business records to your own devices so the app works offline), Resend (delivers the Service’s emails — sign-in, password and weekly summary emails), and Sentry (error monitoring, technical error reports only).

Data is shared with the following only when you actively use the relevant feature:

Intuit QuickBooks — receives customer and invoice data when you connect QuickBooks and press push. Microsoft — receives job schedule details when you connect an Outlook calendar. Anthropic — receives photos of handwritten notes when you use the transcription feature, and the questions you type into the in-app help chat, in each case for the sole purpose of returning the answer; this data is not used to train models.

Connecting or disconnecting an integration is always your choice, from Settings. Disconnecting stops all further data exchange and revokes stored credentials.

6. Transfers outside the UK

Our database, file storage, sync, email and error monitoring providers hold data in the UK or the European Union. Some providers — and the optional integrations you may connect — are based in the United States. Those transfers rely on the UK Addendum to the EU Standard Contractual Clauses, or the UK extension to the EU–US Data Privacy Framework where the provider is certified under it. Each provider, what it does and where it holds data is listed on our subprocessors page.

7. Retention

We keep your data for as long as your account is active. If you close your account, we delete your data within 30 days of your request, except where a legal obligation requires longer retention. You can request an export first.

Support messages are kept for up to two years so we have a record of faults reported and what was done about them. They are not part of your account export, because they are our correspondence with you rather than your business records.

Questions typed into the in-app help chat are kept for 90 days, along with which screen they were asked from, so we can see where the app isn’t explaining itself and improve it. They are deleted automatically after that.

8. Security

All data is encrypted in transit (TLS) and at rest. Access within the application is restricted per business at the database level — one business can never read another’s records. Integration credentials are stored server-side only and are never exposed to the browser.

9. Your rights

Under UK GDPR you can request access to, correction of, or deletion of your personal data, object to or restrict processing, and request portability. If your data is in the Service because a tree surgery business you dealt with entered it, that business is the controller — contact them first, and we will support their response. You can complain to the Information Commissioner’s Office (ico.org.uk) if you are unhappy with how data has been handled, though we would rather you came to us first so we can put it right. Where we rely on legitimate interests you can object; where you have given consent you can withdraw it, without affecting anything done beforehand. Requests are free and answered within one month.

10. Changes

If we materially change this policy we will note the new effective date here and notify account holders by email where the change affects them.

11. Contact

Data questions or requests: hello@treetask.app