Privacy Policy

OnPoint Business is a UK trade-business management platform. This summary is here to be useful, not legally binding — the rest of the policy is what governs.

“OnPoint Business”, “we”, “us” or “our” refers to the operator of the OnPoint Business platform at onpointbusiness.co.uk, our mobile apps, customer portal and APIs (together, the “Service”).

The data controller is OnPoint Business Software Ltd, registered in England and Wales under company number 17445976, whose registered office is at Unit 15 Leyton Business Centre, Etloe Road, London, E10 7BT.

For data protection matters you can reach our privacy team at privacy@onpointbusiness.co.uk. If you're a customer and want the Article 28 processing terms, they're published in full in our Data Processing Addendum.

Data protection law distinguishes between two roles. We act in different roles depending on whose data is involved:

We use personal data for the following purposes:

• Provide the Service

  Authenticate users, run the dashboard, mobile apps and customer portal, store the records you create.

• Process payments

  Collect subscription fees through Stripe; help you collect payments from your customers via Stripe Connect.

• Reconcile bank payments

  Match incoming credits from TrueLayer-linked accounts to your invoices.

• Sync your accounting

  Push and pull contacts, invoices and payments to/from Xero or QuickBooks if you choose to connect them.

• Communicate with you and your customers

  Send transactional email and SMS, push notifications, automatic reminders and overdue chasers.

• Provide AI helpers

  Generate suggestions for invoice descriptions, parts, costs and similar drafting tasks (see §08).

• Live engineer tracking

  Show GPS location to internal users and (if you enable it) to the customer portal.

• Keep things secure

  Detect abuse, rate-limit, log security events, prevent fraud, investigate incidents.

• Support you and improve the product

  Usage analytics — including a per-account record of which screens you used and on what device — so our support and onboarding team can help when you're stuck, follow up during a trial, and so we can fix bugs and prioritise features. Only OnPoint staff who need it can see this; your employer can't.

• Comply with the law

  Maintain accounting and tax records, respond to lawful requests from regulators or courts.

• Marketing (with consent or as a customer)

  Send product news, run ads on Google and Meta, measure their performance.

Under the UK GDPR we need a lawful basis for each use. Ours are:

• Contract (Art. 6(1)(b)) — providing the Service to you, processing your subscription, supporting your team.
• Legitimate interests (Art. 6(1)(f))— keeping the Service secure and reliable, preventing fraud and abuse, improving the product, and contacting existing customers about features they're likely to care about. We've weighed these against your interests; you can object at any time.
• Consent (Art. 6(1)(a)) — non-essential marketing cookies, push notifications, location access, sending marketing emails to non-customers. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — tax and accounting record-keeping, responding to lawful requests.

Most integrations are off by default. They only run after you explicitly authorise them in Preferences, and you can disconnect them at any time.

Some features use large language models — for example, drafting invoice descriptions, suggesting parts and costs, transcribing a spoken job report, or summarising notes. Today these are powered by OpenAI.

• The text you submit to an AI feature is sent to the relevant provider over an encrypted connection to generate the response.
• We have contractual terms with these providers that prohibit using your prompts or outputs to train their public models.
• AI outputs are best-effort drafts. They can be wrong. You are responsible for reviewing anything an AI feature suggests before sending it to a customer or relying on it.
• Don't paste sensitive personal data (e.g. full payment details, government IDs, special-category data) into AI prompts. We'll add filtering over time but the safer path is not to put it in.

We use the following sub-processors to run the Service. We've picked providers we'd use ourselves, with appropriate security and (where relevant) UK-GDPR-compliant transfer safeguards.

We may add or change sub-processors as the product evolves. For material changes that affect your data, we'll update this list and (where required) notify you.

The OnPoint dashboard, customer portal and mobile apps don't use third-party advertising cookies. They use a small number of essential cookies and local-storage entries to keep you signed in, remember your preferences (e.g. selected organisation) and run features like offline live-chat persistence.

On our marketing pages (the public website, comparison and pricing pages) we use:

• Plausible — privacy-friendly, cookieless analytics for traffic counts.
• Vercel Analytics & Speed Insights — performance and page-load data.
• Google Ads — to measure which ads bring people to OnPoint and to retarget visitors who've shown interest. Off unless you accept. The tag isn't loaded and no advertising cookie or click identifier is stored on your device until you choose “Accept” on our cookie banner.
• Meta Pixel (Meta Platforms Ireland) — to measure which Facebook and Instagram ads lead to free trials, demo requests and subscriptions. It sets the _fbp and _fbc cookies. Off unless you accept, exactly like Google Ads. We've switched off Meta's automatic event collection, so it doesn't read what you type into forms.

Plausible and Vercel don't need your permission because they store nothing on your device. Google Ads and Meta Pixel do, so we ask first — and “Reject” is exactly as easy to click as “Accept”. You can change or withdraw your choice at any time via Cookie settingsin the site footer; withdrawing also deletes the advertising identifiers we'd stored. We'll ask again after six months.

Your data is primarily stored in the UK and EU. Some of our sub-processors operate in the United States or globally. Where personal data is transferred outside the UK, we rely on:

• UK adequacy regulations (where the destination is recognised as providing adequate protection),
• the UK's International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses with the UK Addendum, and
• additional safeguards where appropriate (encryption in transit and at rest, access controls, contractual restrictions on use).

• Active accounts — for as long as your account is open. You can delete records at any time.
• Closed accounts — we keep your data for up to 90 days after closure to allow recovery and export, then delete or anonymise it, except where we're required to keep it longer.
• Invoices and tax records — kept for at least 6 years to meet HMRC requirements.
• Backups — overwritten on a rolling cycle (typically within 35 days).
• Engineer location trails — deleted after 90 days. Only the route for a specific journey is kept, and only while that journey is active; we don't keep a continuing movement history.
• Live-chat conversations — deleted after 12 months.
• In-app usage history (screens used, app opens, errors) — deleted after 90 days.
• Security logs & error reports — generally retained for 30–90 days.
• Marketing lists — until you unsubscribe, plus a short suppression record so we don't accidentally re-add you.

• Data is encrypted in transit (TLS 1.2+) and at rest (AES-256) on managed infrastructure.
• Passwords are hashed with bcrypt; we don't see them.
• Database access uses row-level security so each organisation only sees its own records.
• Card data is handled by Stripe (PCI DSS Level 1). Bank access goes through TrueLayer (FCA-authorised). We don't store card numbers or bank credentials.
• We follow least-privilege internal access, log administrative actions, and review access regularly.
• Support access to your account.To diagnose a problem we may need to view the product as you see it. Only the platform developer can do this, every start and stop is written to an immutable audit log with time, IP and device, and access is refused outright if it can't be logged. The session is revoked the moment we exit. We don't use it to browse accounts casually, and you can ask us for a record of any such access to yours.
• If we ever discover a breach affecting your data, we'll notify the ICO within 72 hours where required and contact you without undue delay.

Under the UK GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Rectify data that's wrong or out of date.
• Erase data where it's no longer needed and there's no legal reason to keep it.
• Restrict or object to certain processing — including direct marketing, which you can opt out of at any time.
• Port your data — receive it in a structured, machine-readable format.
• Withdraw consent where processing relies on it (this won't affect anything done before you withdrew).
• Complain to the Information Commissioner's Office — though we'd appreciate the chance to put things right first.

To exercise any of these, email privacy@onpointbusiness.co.uk. We'll respond within one month and may ask for proof of identity.

OnPoint Business is built for businesses and is not directed at people under 18. We don't knowingly collect personal data from children. If you believe a child has provided us with personal data, please email privacy@onpointbusiness.co.ukand we'll delete it.

We'll update this policy as the product evolves. When changes are material — for example, a new sub-processor that handles personal data, or a new use of data — we'll notify you by email or through the app before they take effect. The “last updated” date at the top always reflects the current version.

For anything related to your data, email privacy@onpointbusiness.co.uk or our general team at support@onpointbusiness.co.uk.

By post: OnPoint Business Software Ltd, Unit 15 Leyton Business Centre, Etloe Road, London, E10 7BT.

You also have the right to complain to the UK's Information Commissioner's Office (ICO) — Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, helpline 0303 123 1113, or ico.org.uk/make-a-complaint .