the cure for trade admin
Plain English. What we hold, why we hold it, how long we keep it, and how to make us stop.
Two different things happen here, and it matters which one you are.
If you are a business using DRSaaS, we hold your account details. We decide what to do with those.
If you are a customer of a business that uses DRSaaS, your details are in their account. They decide what happens to them. We only store and process them so their software works. Ask them first - and if you cannot reach them, ask us.
DRSaaS is software for trades and home businesses, run by Peter Roberts as a sole trader in Dorset, England.
Peter Roberts is the person responsible for data protection. Email info@drsaas.co.uk.
DRSaaS keeps a pool of business contacts so that an electrician who joins can start work in their area on day one. It holds limited companies only. It holds the company name, the registered office address, the company number, the trade the register lists the company under, and the email address and phone number the company publishes on its own website. Nothing about any individual is looked up or stored on purpose.
Where it comes from: the public register of companies at Companies House, and the company's own public website. We never guess an email address and we never buy a list.
Why we hold it, and the lawful basis: to introduce local electricians to businesses that need electrical safety certificates, which is a legitimate interest of ours and of the electricians who use DRSaaS. DRSaaS is the data controller for the pool. When an electrician contacts you, they are the sender and every email says who they are.
How we keep it right: every row is checked against the register again at least every six months. A company that is dissolved, or whose email no longer works, is removed. Tell us to stop and we remove you from the pool and from every electrician's list within a day, and we keep only your email address on a stop list so you are never added again.
You gave us most of it - when you signed up, and every time you used the product.
Outreach prospects come from public sources: the register of companies at Companies House, and firms' own public websites, through the contact pool described above.
Four parts of DRSaaS can connect to your Google account. All are optional. All are off until you tap Connect. This section says exactly what each one reads, writes, stores and shares, and how to switch it off.
DRSaaS's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain words: your Google data is used only for the feature you connected it for, is never sold, never used for advertising, never used to train a model, and no person at DRSaaS reads it unless you ask us to look at a problem.
What you grant. When you tap Connect Google Calendar (Settings, Calendar connection), Google asks you for one permission: to see and edit events on your calendars. Google's name for it is calendar.events. We ask for nothing wider: no access to your email, your contacts, your files, or your calendar's sharing settings.
What we read. The events on the calendar you connect, from one day back to fourteen days ahead, once every thirty minutes. From each event we take its title, its place, its start and end, whether it is all day, and its colour. A blue event counts as personal: it shows as busy time and its title is never offered as a job.
What we write. Only the jobs you book in DRSaaS. Each one carries a hidden DRSaaS tag. We never change or delete an event without that tag. An appointment you typed yourself is read, never edited.
What we store. The key Google gives us to read your calendar, sealed with encryption so it cannot be read from the database; the name of the calendar; and those diary entries for the fortnight window, so the day picker can show what is free when you book a job.
What we use it for. To show your free days when you book a job, to put the jobs you book on your phone, and to match a receipt or a diary entry to the job you were on. Nothing else.
Who we share it with. Nobody. It is not sold, not passed to another business using DRSaaS, not sent to an advertiser, and not sent to Anthropic. Cloudflare hosts the database it sits in, encrypted.
How to switch it off. Settings, Calendar connection, Disconnect. The sealed key is deleted the moment you tap it and we stop reading. The diary entries already read stay in your diary, because they are your jobs; ask us and we delete those too, and they go with everything else when your account is deleted. You can also remove DRSaaS from your Google account at any time at myaccount.google.com/permissions.
DRSaaS uses YouTube API Services to put your job films on your own channel. By connecting your channel you also agree to the YouTube Terms of Service, and Google's handling of your account is covered by the Google Privacy Policy.
What you grant. When you tap Connect your YouTube channel (Settings, YouTube channel), Google asks you for one permission: to upload videos to your channel. Google's name for it is youtube.upload. It cannot read, edit or delete the videos already on your channel, and we have not asked for anything wider.
What we read. Nothing from your channel's videos, comments or viewers. When you connect, we ask YouTube once for your channel's name. With the upload permission YouTube says no, so you confirm the channel yourself instead. After that, the only things YouTube tells us are its answer to each upload: the id of the video it made, its privacy setting, its publish time, and the id and name of the channel it landed on. The HQ uses these to show the film and name the channel it went to.
What we write. One video per film you approve. A film is made from the photographs of your own job and shown to you first. Nothing is uploaded until you tap approve on it, and nothing is uploaded by itself.
What we store. The key Google gives us to upload, sealed with encryption so it cannot be read from the database; the id and name of the channel you connected; and for each video uploaded, its id, its privacy setting and its publish time, so the HQ can link to it. YouTube's rules let us keep what YouTube tells us for no longer than 30 days, so every night we delete the video's id, privacy setting, publish time and link, and the channel's id and name, once they are 30 days old. The next film you post names the channel again. The film itself, its words, and the date it went up are ours and are kept with your job's photographs.
What we use it for. To upload the films you approve to your channel and to show you where they went. Nothing else. Nothing from YouTube is used for advertising, sold, or used to train any model.
Who we share it with. Nobody. The upload is done by our own film-making computer. For each film you approve it is handed a pass from Google that works for one hour, and never the sealed key itself. It is not passed to another business using DRSaaS and not sent to an advertiser.
How to switch it off. Settings, YouTube channel, Disconnect. The moment you tap it, no film can be uploaded. We ask Google straight away to withdraw our permission, and when Google confirms, the sealed key is deleted. If Google does not answer, the page says so and you can tap again. If your Google Calendar is connected with the same Google account, Google ends that connection at the same time, and the page tells you. You can also remove DRSaaS's access from Google's side at any time on the Google security settings page. The films already on your channel are yours and stay there until you delete them on YouTube. Questions or complaints about any of this go to info@drsaas.co.uk, the address at the top of this page.
Google is reviewing our application to use the Business Profile API. Until Google approves it there is no Connect button and nothing is read. When there is, this is what the connection does.
What you grant. One permission: to manage your business listing on Google. Google's name for it is business.manage.
What we read. Your listing's details (name, categories, phone, website, hours, service areas), your reviews with their stars and words and the reviewer's display name, and the posts on your listing.
What we write. Only what you tap to send: a reply to a review, a post about a job, or a listing correction you approved. Nothing posts by itself, ever. A review under four stars is never answered by the machine.
What we store. The sealed key, a copy of each review so the HQ can show it and count it, the draft reply and the draft post until you send or discard them, and what the weekly listing check found.
What we use it for. To draft a reply to each review for you to approve, to draft one post from a finished job's photographs for you to approve, to show your rating and review count in the HQ, and to tell you when your listing no longer matches your business.
Who we share it with. To draft a reply we send the review's words, its stars and the reviewer's first name to Anthropic, which sends the draft back and does not keep it or train on it. Nobody else sees it, and nothing is sold.
How to switch it off. Settings, Google listing, Disconnect: the sealed key is deleted and nothing is read or written again. The reviews already copied stay on your Reviews page until you ask us to remove them. The Google-side switch is the same permissions page.
What you grant. When you tap Connect your Google Search Console (Your website, SEO), Google asks you for one permission: to view Search Console data for the sites you have verified. Google's name for it is webmasters.readonly. It can only read. We cannot change anything in your Search Console, and we have not asked for anything wider.
What we read. The list of properties your Google account holds in Search Console, read once when you connect, so we can find the one that is your website. After that we read one property only, the one you are connected to: the clicks, how many times you were shown, and the words people typed into Google before they saw your website. Nothing from any other property. Nothing from any other part of your Google account.
What we write. Nothing. The permission cannot write, and we never ask Google to change anything.
What we store. The key Google gives us to read, sealed with encryption so it cannot be read from the database; the address of the property you connected; and the list of properties Google showed us, so you can pick a different one if we picked wrong. When your search figures are read in they are stored with your website's SEO pages, so the HQ can show them without asking Google again.
What we use it for. To show you what people search for before they tap your website, and to put your SEO pages in the order of what actually brings work in. Nothing else.
Who we share it with. Nobody. It is not sold, not passed to another business using DRSaaS, not sent to an advertiser, and not sent to Anthropic. Cloudflare hosts the database it sits in, encrypted.
How to switch it off. Your website, SEO, Disconnect. The sealed key is deleted the moment you tap it and we stop reading. The figures already read stay on your own SEO page until you ask us to remove them, and they go with everything else when your account is deleted. The Google-side switch is the same permissions page.
Simple EICR is our own channel. You type a postcode, we tell you whether an electrician using our software covers it, and you decide what happens next. This is what we hold and who sees it.
Simple Heat Pumps is our own channel, and it works exactly like Simple EICR above. You type a postcode, we tell you whether a heat pump installer using our software covers it, and you decide what happens next. Everything in the section above applies here word for word. These are the two differences.
Nothing on that page claims a grant, a scheme or a price, and we do not check whether you qualify for anything. That is between you and the installer.
This one is for the electricians and installers using our software, not for homeowners. A business can tick Feed the DrSaaS channel in its own settings. Ticking it is a permission, and we keep the sentence that was ticked, the moment it was ticked and who ticked it.
We do not sell anything to anybody. We use a small number of suppliers to make the product work:
Some of these suppliers are outside the United Kingdom. Where they are, the transfer relies on the standard contractual protections the United Kingdom recognises.
You can ask us to:
Email info@drsaas.co.uk. We answer within one month, and it is free.
Tell us first, so we can put it right. If you are still unhappy you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.
We set one cookie, and only when you sign in. It keeps you signed in. There is no advertising cookie and no third-party tracking on this site.
The date at the top changes with it. If a change matters to you, we email you about it rather than hoping you check this page.
Terms · Data deletion · drsaas.co.uk · DRSaaS is run by Peter Roberts, sole trader, England.