Privacy policy

Last updated: 13 August 2026  ·  Applies to the Dab Hand mobile app and dabhandapp.com.

1. Who we are

Dab Hand is provided by Alexander Musgrave T/A Dab Hand Apps, Office 20361, 182-184 High Street North, East Ham, London E6 2JA. For anything to do with your data, contact info@dabhandapp.com.

For UK GDPR purposes we are the data controller for the personal data described in section 2. For the information you store about your own customers we act as your processor — see section 3.

2. What we collect

Information you give us

• Account details. Your email address, and a password we never see in readable form. If you sign in with Google or Apple we receive your email address and, where you allow it, your name. Apple's Hide My Email is supported — if you use it, we only ever see the relay address.
• Business details. Your trading name, business address, contact details, logo and the bank details you choose to show on invoices.
• Your work. Work orders and jobs, including titles, descriptions, prices, statuses, due dates, calendar notes, quotes, invoices, job reports, and the time sessions you record.
• Customer records. The details you enter about your customers — covered separately in section 3.
• Photos and files. Images and PDFs you attach to jobs, and a logo if you upload one.
• Settings. Your chosen theme, layout, currency, business type, notification and display preferences.

Information collected automatically

• Subscription status. Whether you hold an active Dab Hand Professional subscription, how many team seats you hold, and the renewal state.
• Technical data needed to run the service, such as the IP address your requests come from, held briefly in server logs for security and abuse prevention.

Information from enquiries (Quote Express)

• If you switch Quote Express on, we receive the enquiries sent to your private address — typically a name, contact details and a description of the work — and turn them into drafts inside your account. It is off unless you turn it on, and you can turn it off or regenerate the address at any time.

What we do not collect

• We do not collect your location, and the app does not track where you or your crew are.
• We do not collect your contacts, calendar, or any files other than the photos and PDFs you choose to attach.
• We do not use advertising identifiers, and we do not track you across other companies' apps or websites.
• We do not use analytics or advertising SDKs in the app.
• We never receive your card details. Payment is handled entirely by Google or Apple.
• Biometric unlock uses your device's own Face ID, Touch ID or fingerprint system. Your biometric data never leaves your device and is never sent to us.

3. Your customers' data

When you store a customer's name, address, phone number, email address, job history or notes, that information is about a third party rather than about you. For UK GDPR purposes you are the controller of it and we are your processor: we hold it only to run the app for you, act only on your instructions, and never use it for our own purposes.

What that means in practice:

• We do not contact your customers. The only messages that go to them are the quotes, invoices, reports and review requests you send yourself.
• You can view, correct, export or delete any customer record from inside the app.
• You are responsible for telling your customers how you use their information and for having a lawful basis to hold it.
• If one of your customers contacts us directly, we will refer them to you.
• The sub-processors in section 6, the security in section 12 and the deletion timescales in section 9 apply to this data too.

4. Teams

If you add crew members to your business, each of them has their own account with their own email address and password. Within the business:

• The account owner can see the jobs team members are assigned, the work they complete and the time they record. Roles control what each member can see in return, including whether prices are visible to them.
• Business records — jobs, customers, quotes, invoices — belong to the business, not to the individual, and remain with the business if someone leaves.
• A team member deleting their own account removes their login and personal profile; it does not remove the business's records of work done.

5. Why we use it, and our lawful basis

6. Who we share it with

We use a small number of service providers to run Dab Hand. They process data on our instructions, under contract, and only for the purposes below. We do not sell personal data, and we do not share it for advertising.

When you email a quote, invoice or report from the app, it is sent using your own device's email app or share sheet, so it goes through whichever email or messaging provider you use.

We may also disclose data where we are legally required to, or to establish or defend legal claims.

7. Connected accounting software

If you choose to connect accounting software such as QuickBooks, this section applies. If you do not, none of it does — the feature is off until you set it up, and nothing described here happens.

This is different from the providers in the table above. Those process data on our instructions, for us. Your accounting provider does not: it is your software, holding your accounts, and once information reaches it that provider is the data controller for it, under their own privacy notice and your agreement with them. We are sending it there because you asked us to.

What we store when you connect. An access token and a refresh token, which are what let us send on your behalf; an identifier for the company you connected; that company's name, so we can show you which set of books is linked; and the identifiers your provider gives back for the invoices and customers we have sent. The tokens are held on our servers, never on your device, in a table the app itself has no permission to read — only our server-side functions can use them. We never receive or store your password for your accounting provider.

What we send, and when. Only when you tap send on a specific invoice, and only that invoice: its number and date, your customer's name, address and email, each line's description and amount, the VAT treatment and the totals. Nothing is sent automatically.

What we read, and when. When you open your invoice list, we ask your accounting software whether the invoices we previously sent there have been paid, and record the answer against those invoices in Dab Hand. We ask only about invoices Dab Hand itself created, and we receive only the outstanding balance on each — not your accounts, not your bank feeds, and nothing about invoices or customers that did not come from here.

How long we keep it. The tokens and identifiers are kept for as long as the connection exists. When you disconnect, we ask your provider to revoke our access and we delete the record. Deleting your Dab Hand account does the same. Information already sent to your accounting software stays there — it is in your books, and only you can remove it.

Our lawful basis for this is performance of our contract with you: you have asked for a feature that works by sending your invoices where you tell us to, and telling you when they have been paid.

8. Where your data is held

Your data is stored on servers in the United Kingdom (Supabase London, eu-west-2). Some of our providers are based outside the UK. Where data is transferred internationally it is protected by UK adequacy regulations or by standard contractual clauses.

9. How long we keep it

• While your account is open, we keep your jobs, customers, invoices, photos and time sessions so they're there when you need them. Completed jobs move to your archive rather than being deleted.
• Photos on completed jobs can be cleared automatically after a number of months that you choose in Settings, or never. Nothing is removed unless you ask for it, and the job records themselves are always kept.
• When you delete your account, your profile, jobs, customer records, quotes, invoices, photos, time sessions and notes are deleted. Backups are overwritten on a rolling basis and fully cycled out within 30 days.
• Server logs containing IP addresses are cleared within 30 days.
• Support emails are kept for up to 24 months.

10. Deleting your account

You can delete your account and everything in it from inside the app: Settings → Delete account. You don't need to email us and we don't hold anything back. Full detail, including what is and isn't removed, is on the delete account page. Deleting your account does not cancel a subscription — that's held by Google or Apple and must be cancelled there.

11. Your rights

Under UK and EU data protection law you have the right to access your data, correct it, delete it, restrict or object to how we use it, and receive a copy in a portable format. Most of these you can exercise directly in the app; for anything else email info@dabhandapp.com and we'll respond within one month.

If you're unhappy with how we've handled your data you can complain to the Information Commissioner's Office at ico.org.uk.

12. Security

Data is encrypted in transit and at rest. Access to your records is enforced at the database level, so one account cannot read another's data, and plan limits and permissions are applied on the server rather than only in the app. Passwords are stored hashed and are never visible to us. You can add a biometric or device passcode lock to the app in Settings.

13. Children

Dab Hand is a tool for working tradespeople and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we'll delete it.

14. Changes to this policy

If we change this policy we'll update the date at the top, and for anything significant we'll tell you in the app before it takes effect.

15. Contact

Alexander Musgrave T/A Dab Hand Apps
Office 20361
182-184 High Street North
East Ham
London
E6 2JA
info@dabhandapp.com