Privacy Policy

Trendly ("we", "us") provides a website builder and business app for service businesses at usetrendly.co.uk, including the Trendly mobile app. This policy explains what data we collect, why, who we share it with, and how you can control it. If you have questions, contact us at info@usetrendly.co.uk.

• Account information: your email address and password (stored as a salted hash, never in plain text) when you sign up, or your Google or Apple sign-in identifier if you use those.
• Business information: whatever you type when generating a site, and the resulting business name, tagline, description, services, phone number, location, photos and hours we generate and store on your behalf.
• Your customers' details and messages: enquiries sent through your Trendly website, the replies sent from your account, and the quotes, invoices and jobs you create for your customers.
• Connected accounts: if you connect Meta Ads, Google Ads, Google Search Console, Gmail, Outlook or another email account, we store the connection details described below. We never store your password for Google, Microsoft or Meta; you sign in directly with them.
• Payment information: handled entirely by Stripe. We receive confirmation that a payment succeeded, never your card details.
• Newsletter: if you subscribe to our newsletter we keep your email address and the date you agreed.
• Usage data: standard server logs (IP address, browser, pages visited) for security and debugging, and an anonymous daily count of how many times the Trendly app is opened.

• To generate and host your website and to run the features you use (inbox, receptionist, jobs, quotes, invoices).
• To send the emails and messages you ask Trendly to send, and to notify you of new enquiries.
• To display your ad spend and, where you've authorised it, to manage ad campaigns on Meta and Google on your behalf.
• To process your subscription payment.
• To send essential account and service emails.
• To detect abuse and keep the service secure.

Your business description and the enquiries sent to your website are processed by Anthropic's Claude API to generate website content and to draft replies for you. We do not sell your data to anyone, ever.

Sending email from your own Gmail address. If you choose "Connect Gmail", we ask Google for a single mail permission: send email on your behalf (the gmail.send scope), together with your email address so we can show which account is connected. We do not ask to read, list, search, change or delete any email in your Gmail, and we cannot see your inbox, contacts or any message other than the ones Trendly itself sends for you.

How we use it. Only to send emails that you have asked Trendly to send from your own address: replies to your customers (written by you, or by the Trendly receptionist where you have left it switched on), quotes, invoices, payment and appointment reminders, review requests and visit confirmations. Sent messages appear in your own Gmail Sent folder. We use this access for no other purpose.

What we store. Your connected email address and the OAuth tokens Google gives us (a short-lived access token and a refresh token that lets us keep sending until you disconnect).

Who we share, transfer or disclose Google user data with. No one. We do not sell, rent or share Google user data, and we do not use it for advertising, profiling, credit or lending decisions. It is held only by the service providers that host Trendly on our behalf and under contract: Supabase (our database) and Vercel (our hosting). We do not send your Google account data, such as your email address or tokens, to any AI provider, and we do not use it to train any artificial intelligence or machine learning model. No person at Trendly reads Google user data, except where you ask us for support and agree to it, where it is needed to investigate abuse or a security problem, or where the law requires it.

How we protect it. All connections to Trendly use HTTPS. The stored connection details sit in a database that encrypts data at rest, and row-level security means each business can only reach its own record. On top of that, Trendly encrypts the Gmail and Outlook tokens (AES-256) before saving them. The tokens are used only by our servers: they are never sent to your browser or to the Trendly app after you connect, and the database does not allow browsers to read them. Access to the production database is limited to the people who run Trendly. We send mail only through Google's official Gmail API.

Keeping and deleting it. You can disconnect Gmail at any time in Settings or from your Inbox. Disconnecting deletes the stored tokens and your connected address immediately, and Trendly stops sending from that account. Deleting your Trendly account removes them too. You can also remove Trendly's access directly at myaccount.google.com/permissions. To ask us to delete anything else, email info@usetrendly.co.uk.

Google API Services User Data Policy. Trendly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Google Search Console and Google Business Profile. If you connect these, we read only the search performance and review information for your own business, to show it in your dashboard. The same sharing, protection and deletion rules above apply.

If you connect Outlook / Microsoft 365, we ask Microsoft for permission to send mail on your behalf and to read your basic profile (name and address); we do not read your mailbox. If you connect another email provider with an app password, we store the mail server details and your app password, which is encrypted before it is saved. In every case the connection is used only to send the emails you ask Trendly to send, you can disconnect at any time, and disconnecting deletes the stored details.

When you connect a Meta or Google Ads account, we request permission to read your ad account's spend and performance data and, where you enable it, to create and manage campaigns. This access is used solely to provide the dashboard and campaign management features of Trendly. You can disconnect an ad account at any time from your dashboard, which revokes our access.

We use a small number of service providers to run Trendly, each only for the job described:

• Supabase stores account and business data (hosted in the EU).
• Vercel hosts the website and app.
• Stripe processes payments.
• Anthropic (Claude) generates website content and draft replies from your business description and the enquiries you receive.
• Resend delivers email sent from Trendly's own address, and Twilio delivers text and WhatsApp alerts.
• Apple and Google deliver push notifications to the Trendly app.

We do not sell personal data, and we only share it as set out here or where the law requires.

Our homepage shows a small card when a business joins Trendly, with the business name, its town or area, and how recently it joined (for example "Joined today"). It never shows an email address, personal name, phone number, street address or exact time. If you would rather your business wasn't shown, email info@usetrendly.co.uk and we'll remove it.

Under UK GDPR, you can request access to, correction of, or deletion of your personal data at any time by emailing info@usetrendly.co.uk. You can delete your account yourself in the app or on the website (Settings, then General, then Delete my account), which removes your site, business data and any connected account tokens. You can unsubscribe from our newsletter at any time by emailing us, and we will remove you.

We'll update this page if our practices change and, for material changes, notify you by email.