Privacy Policy
How we collect, use and protect your information.
Last updated: 13th October 2026 · Version: 1.0
Your privacy matters to us, particularly because Rose & Hammer involves your name, your location, and for tradeswomen, identity and business documents. This policy explains what personal information we collect, why, who can see it, how long we keep it, and what rights you have. We have tried to keep it clear and free of jargon.
1. Who we are
Rose & Hammer (the Service) is run by The Women's Auto Academy Ltd ("we", "us", "our"), company number 17417728, registered office 71-75 Shelton St, London WC2H 9JQ.
We are the "controller" of your personal information, which means we decide how and why it is used. We are registered with the Information Commissioner's Office (ICO), registration number C2058993.
Contact us about anything in this policy at hello@roseandhammer.co.uk.
2. The short version
- We collect only what we need to run a safe, trustworthy directory.
- Tradeswomen's phone numbers and emails are never shown publicly. Customers' contact details are never shared by us. A tradeswoman sees only a customer's first name, the job details and the general area until she chooses to accept an enquiry.
- Documents you upload for verification (photo ID, qualifications, insurance) are stored privately, seen only by our authorised team, and never shown publicly.
- We do not sell your personal information, and we do not use it for advertising.
- You have rights over your information, including to see it, correct it, download it and delete it.
3. What information we collect
If you are a customer
| What | Examples | How we get it |
|---|---|---|
| Account details | Name, email address, password (stored securely, never in readable form), postcode | You provide it when you register |
| Enquiry details | Job type, job description, the postcode of the job (the tradeswoman sees only the first part, e.g. "LS1"), urgency, preferred contact time, photos, details of a car you are viewing | You provide them when you send an enquiry |
| Messages | Questions and answers about an enquiry before it is accepted | You provide them |
| Reviews and feedback | Ratings, written reviews, photos, private feedback to us | You provide them |
| Favourites and preferences | Saved listings, email preferences | Created as you use the Service |
| Reports and safety information | Reports you make, evidence you upload | You provide them |
If you are a tradeswoman
| What | Examples | How we get it |
|---|---|---|
| Account details | Name, email address, password (stored securely) | You provide it when you register |
| Application and listing details | Display name, business name and type, bio, trades, services, years of experience, base postcode and service radius, website and social links, profile photo and work photos | You provide them |
| Eligibility declarations | Your confirmations that you meet our eligibility requirements, and when you made them. We do not ask for evidence of your gender identity | You provide them |
| Verification documents | Photo ID, proof of qualification, public liability insurance (with expiry date), trade registrations or membership (for example Gas Safe or MOT tester) | You upload them |
| Verification records | Which checks we have completed, our internal notes and the date of our decision | Created by us |
| Enquiries and contact details you choose to share | The enquiry's job details, your replies, and the phone number, email or notes you choose to send to a customer | You provide them |
| Performance information | Your response times and reply rate | Created as you use the Service |
If you are anyone using the Service
| What | Examples | How we get it |
|---|---|---|
| Technical information | IP address, browser and device type, pages visited, approximate location from your IP address, error logs | Collected automatically |
| Search information | The trade, the postcode area (the first part only), distance and filters used in a search | Collected automatically |
| Communications | Messages you send to us, feedback, waitlist or membership interest sign-ups | You provide them |
| Cookie and consent choices | Your cookie preferences and the version of the terms you accepted | Collected automatically |
We do not knowingly collect information about anyone under 18, and the Service is not for children.
We do not ask for or use more sensitive information (such as health information, or details about your race, religion or sexual orientation) and ask that you do not include it in your profile, enquiries or reviews. We use photo ID documents only to confirm your identity and name, and we do not use facial recognition or other biometric processing on them.
4. How and why we use your information
We must have a lawful basis for using personal information. These are ours:
| Purpose | Our lawful basis |
|---|---|
| Creating and managing your account, running the directory, search, enquiries, messages and reviews | Contract: it is necessary to provide the Service you have signed up for |
| Verifying tradeswomen (reviewing identity, qualifications and insurance) and keeping verification current | Legitimate interests: keeping the Service safe and trustworthy for everyone. Where the law requires registration (for example Gas Safe), it also supports legal obligation compliance by tradeswomen |
| Sending service emails (enquiry notifications, account, security and policy notices, review invitations, insurance expiry reminders) | Contract and legitimate interests |
| Keeping the Service safe: handling reports, blocking, investigating complaints and misuse, preventing fraud and spam, applying sanctions and appeals | Legitimate interests and, where we must act, legal obligation |
| Moderating reviews and content | Legitimate interests |
| Understanding how the Service is used and improving it (including anonymous analytics and search statistics that show where we need more tradeswomen) | Legitimate interests |
| Contacting you about the launch or about membership, if you joined a waitlist or registered interest | Consent. You can withdraw it at any time |
| Optional non-essential cookies and similar technologies | Consent, through our cookie banner |
| Meeting our legal obligations, responding to lawful requests from the police or other authorities, and establishing or defending legal claims | Legal obligation and legitimate interests |
| Showing public content (such as work photos and reviews) on our own social media or marketing | Consent or legitimate interests, depending on the content. You can ask us to stop |
We do not make decisions about you using solely automated processing that has legal or similarly significant effects. People review applications, reports and reviews. Where we use automated tools (for example, to flag a phone number in a review, or to limit repeated enquiries), a person makes the decision about any action.
5. Who can see your information
| Who | What they can see |
|---|---|
| The public (anyone visiting the Service) | For approved tradeswomen: display name, business name, trades, services, bio, general area and service radius (not your full postcode), photos, verified checks, published reviews and replies, and response information. Reviews appear with the reviewer's first name only. Customers' details are not shown, apart from this |
| A tradeswoman who receives an enquiry | Before she accepts: the customer's first name, the job details and photos, the first part of the job postcode, and urgency. After she accepts: whatever the customer chooses to tell her. We never share a customer's email, phone number or surname |
| A customer whose enquiry is accepted | The contact details and note the tradeswoman chooses to send |
| Our authorised team | What they need to run the Service: verification documents, applications, enquiries, messages and reports (for example, when handling a report or complaint). Access is limited to named people, and administrator access is protected with two-factor authentication. Administrator actions are logged |
| Our service providers | See section 6 |
| Authorities and professional advisers | See section 7 |
6. Our service providers
We use trusted providers who process information on our behalf, under contracts that require them to protect it and use it only on our instructions:
- Hosting, database, authentication and file storage: Lovable Cloud and its cloud infrastructure providers
- Email delivery: Lovable Emails
- Bot and abuse protection: Cloudflare Turnstile
- Anonymous analytics: our own privacy-friendly visitor counts, which do not use cookies
- Postcode lookup: postcodes.io (your postcode is sent to convert it to a location)
- Maps: OpenStreetMap map tiles (loading a map sends your IP address and the area you are viewing to the map provider)
- Website hosting and development: Lovable
We may add or change providers over time and will keep this list up to date.
7. Sharing your information with others
We do not sell your personal information. We share it only:
- with the people described in section 5, as part of how the Service works;
- with our service providers (section 6);
- with the police, regulators, courts or other authorities, where we reasonably believe we are legally required to, or it is necessary to protect someone's safety or to prevent or detect crime;
- with professional advisers (lawyers, insurers and accountants) where necessary;
- if we sell or restructure the business, with the new owner, who must continue to protect your information; and
- with anyone else, if you ask us to or give us your permission.
8. International transfers
Some of our providers may process information outside the UK. Where they do, we make sure it is protected by an appropriate safeguard, such as a UK adequacy decision, the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for more information at hello@roseandhammer.co.uk.
9. How long we keep your information
We keep personal information only as long as we need it for the purposes above. Our current retention periods are:
| Information | How long we keep it |
|---|---|
| Account details | While your account is open, and for 14 days after you ask us to delete it (so you can change your mind), then deleted |
| Verification documents (approved tradeswomen) | While your listing is live, plus 12 months after it closes, in case we need to respond to a complaint or investigation. Then deleted |
| Verification documents (rejected applications) | Deleted within 30 days of the decision |
| Application and listing details | While your account is open |
| Enquiries and messages | 24 months after the enquiry closes, then deleted or anonymised |
| Reviews | While published. When a customer deletes their account, they choose whether the review is deleted or kept anonymously as "Former customer" |
| Reports, safety records, sanctions, appeals and administrator logs | 6 years, with personal information limited to what is necessary, because we may need it to protect people or deal with legal claims |
| Search statistics | Kept without any name or full postcode, so it is not personal information |
| Waitlist and membership interest sign-ups | Until you ask us to remove you, or 12 months after the launch if you have not joined |
| Contact form messages and feedback | 12 months after the matter closes |
| Cookie and consent records | 12 months from the choice, or longer if we need proof of consent |
| Backups | Deleted information may remain in secure backups for up to 30 days before being overwritten |
If you delete your account, we remove or anonymise your personal information, except where we must keep some for the reasons above.
10. Your rights
Under UK data protection law you have the right to:
- be informed about how we use your information (this policy);
- access the personal information we hold about you;
- correct information that is wrong or incomplete;
- delete your information in certain circumstances;
- restrict how we use your information in certain circumstances;
- object to uses based on our legitimate interests, and to direct marketing at any time;
- data portability, to receive information you gave us in a portable format; and
- withdraw consent at any time, where we rely on it.
Many of these you can do yourself in Account settings, including downloading your data, changing your details and deleting your account. For anything else, email hello@roseandhammer.co.uk. We will respond within one month. We may ask you to confirm your identity, and we cannot always grant a request in full (for example, where we must keep information to meet a legal obligation, or where it would reveal someone else's information), in which case we will explain why.
11. Cookies and similar technologies
We use only the cookies and browser storage that are strictly necessary for the Service (for example, keeping you logged in, security, and remembering your cookie choice) unless you agree to others using the cookie banner. Our analytics tool does not use cookies. Our Cookie Policy lists exactly what we use. You can change your choices at any time using Cookie settings in the footer.
12. Keeping your information secure
We protect your information with measures including encryption in transit, private storage and time-limited access links for documents, controls that limit who can see what, two-factor authentication for administrators, removal of location data from uploaded photos, rate limits, and activity logs. No system is completely secure. If a breach is likely to put you at risk, we will tell you and the ICO as the law requires.
Please help by choosing a strong, unique password and not sharing it, and by not sharing your own phone number or address in public parts of the Service.
13. Links to other websites
Our Service may link to websites we don't control, such as a tradeswoman's own website or social media. This policy does not cover them, so please read their privacy policies.
14. Changes to this policy
We may update this policy. We will tell you about important changes, usually by email or when you next log in, and update the date at the top.
15. Questions and complaints
If you have a question or complaint about how we use your information, please contact us first at hello@roseandhammer.co.uk. We will acknowledge it within 30 days and aim to resolve it without delay.
You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.