Privacy Policy

OnPoint Business is a UK trade-business management platform. This summary is here to be useful, not legally binding — the rest of the policy is what governs.

“OnPoint Business”, “we”, “us” or “our” refers to the operator of the OnPoint Business platform at onpointbusiness.co.uk, our mobile apps, customer portal and APIs (together, the “Service”).

We're based in London, United Kingdom. For data protection matters you can reach our privacy team at privacy@onpointbusiness.co.uk.

Data protection law distinguishes between two roles. We act in different roles depending on whose data is involved:

We use personal data for the following purposes:

• Provide the Service

  Authenticate users, run the dashboard, mobile apps and customer portal, store the records you create.

• Process payments

  Collect subscription fees through Stripe; help you collect payments from your customers via Stripe Connect.

• Reconcile bank payments

  Match incoming credits from TrueLayer-linked accounts to your invoices.

• Sync your accounting

  Push and pull contacts, invoices and payments to/from Xero or QuickBooks if you choose to connect them.

• Communicate with you and your customers

  Send transactional email and SMS, push notifications, automatic reminders and overdue chasers.

• Provide AI helpers

  Generate suggestions for invoice descriptions, parts, costs and similar drafting tasks (see §08).

• Live engineer tracking

  Show GPS location to internal users and (if you enable it) to the customer portal.

• Keep things secure

  Detect abuse, rate-limit, log security events, prevent fraud, investigate incidents.

• Improve the product

  Aggregate usage analytics, error reports and crash data to fix bugs and prioritise features.

• Comply with the law

  Maintain accounting and tax records, respond to lawful requests from regulators or courts.

• Marketing (with consent or as a customer)

  Send product news, run ads on Google and Meta, measure their performance.

Under the UK GDPR we need a lawful basis for each use. Ours are:

• Contract (Art. 6(1)(b)) — providing the Service to you, processing your subscription, supporting your team.
• Legitimate interests (Art. 6(1)(f))— keeping the Service secure and reliable, preventing fraud and abuse, improving the product, and contacting existing customers about features they're likely to care about. We've weighed these against your interests; you can object at any time.
• Consent (Art. 6(1)(a)) — non-essential marketing cookies, push notifications, location access, sending marketing emails to non-customers. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — tax and accounting record-keeping, responding to lawful requests.

Most integrations are off by default. They only run after you explicitly authorise them in Preferences, and you can disconnect them at any time.

Some features use large language models — for example, drafting invoice descriptions, suggesting parts and costs, or summarising notes. Today these are powered by Google Generative AI (Gemini) and OpenAI.

• The text you submit to an AI feature is sent to the relevant provider over an encrypted connection to generate the response.
• We have contractual terms with these providers that prohibit using your prompts or outputs to train their public models.
• AI outputs are best-effort drafts. They can be wrong. You are responsible for reviewing anything an AI feature suggests before sending it to a customer or relying on it.
• Don't paste sensitive personal data (e.g. full payment details, government IDs, special-category data) into AI prompts. We'll add filtering over time but the safer path is not to put it in.

We use the following sub-processors to run the Service. We've picked providers we'd use ourselves, with appropriate security and (where relevant) UK-GDPR-compliant transfer safeguards.

We may add or change sub-processors as the product evolves. For material changes that affect your data, we'll update this list and (where required) notify you.

The OnPoint dashboard, customer portal and mobile apps don't use third-party advertising cookies. They use a small number of essential cookies and local-storage entries to keep you signed in, remember your preferences (e.g. selected organisation) and run features like offline live-chat persistence.

On our marketing pages (the public website, comparison and pricing pages) we use:

• Plausible — privacy-friendly, cookieless analytics for traffic counts.
• Vercel Analytics & Speed Insights — performance and page-load data.
• Google Ads — to measure which ads bring people to OnPoint and to retarget visitors who've shown interest. You can opt out via your browser settings or via Google's preference page.

Your data is primarily stored in the UK and EU. Some of our sub-processors operate in the United States or globally. Where personal data is transferred outside the UK, we rely on:

• UK adequacy regulations (where the destination is recognised as providing adequate protection),
• the UK's International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses with the UK Addendum, and
• additional safeguards where appropriate (encryption in transit and at rest, access controls, contractual restrictions on use).

• Active accounts — for as long as your account is open. You can delete records at any time.
• Closed accounts — we keep your data for up to 90 days after closure to allow recovery and export, then delete or anonymise it, except where we're required to keep it longer.
• Invoices and tax records — kept for at least 6 years to meet HMRC requirements.
• Backups — overwritten on a rolling cycle (typically within 35 days).
• Security logs & error reports — generally retained for 30–90 days.
• Marketing lists — until you unsubscribe, plus a short suppression record so we don't accidentally re-add you.

• Data is encrypted in transit (TLS 1.2+) and at rest (AES-256) on managed infrastructure.
• Passwords are hashed with bcrypt; we don't see them.
• Database access uses row-level security so each organisation only sees its own records.
• Card data is handled by Stripe (PCI DSS Level 1). Bank access goes through TrueLayer (FCA-authorised). We don't store card numbers or bank credentials.
• We follow least-privilege internal access, log administrative actions, and review access regularly.
• If we ever discover a breach affecting your data, we'll notify the ICO within 72 hours where required and contact you without undue delay.

Under the UK GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Rectify data that's wrong or out of date.
• Erase data where it's no longer needed and there's no legal reason to keep it.
• Restrict or object to certain processing — including direct marketing, which you can opt out of at any time.
• Port your data — receive it in a structured, machine-readable format.
• Withdraw consent where processing relies on it (this won't affect anything done before you withdrew).
• Complain to the Information Commissioner's Office — though we'd appreciate the chance to put things right first.

To exercise any of these, email privacy@onpointbusiness.co.uk. We'll respond within one month and may ask for proof of identity.

OnPoint Business is built for businesses and is not directed at people under 18. We don't knowingly collect personal data from children. If you believe a child has provided us with personal data, please email privacy@onpointbusiness.co.ukand we'll delete it.

We'll update this policy as the product evolves. When changes are material — for example, a new sub-processor that handles personal data, or a new use of data — we'll notify you by email or through the app before they take effect. The “last updated” date at the top always reflects the current version.

For anything related to your data, email privacy@onpointbusiness.co.uk or our general team at support@onpointbusiness.co.uk.

You also have the right to complain to the UK's Information Commissioner's Office (ICO) — Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, helpline 0303 123 1113, or ico.org.uk/make-a-complaint .