Privacy policy
Last updated 2 November 2026
This explains what personal information DrivePal keeps, why, who else sees it and what you can do about it. We keep it short and plain on purpose. If anything is unclear, email us at support@palhq.co.uk.
Who we are
DrivePal is run by Pal HQ Ltd (company number 17523135), The Coach House, Powell Road, Buckhurst Hill, IG9 5RD. We are registered with the Information Commissioner's Office (ICO) under number ZC283048.
- For your own account (you, the business using DrivePal, and your team's logins), and for keeping DrivePal secure and improving it, we are the "controller": we decide how your details are used.
- For other people's details you put in (your customers, subcontractors, suppliers, people who sign in on your sites, and your accountant, and your team's work records, such as timesheets), you are the controller and we are your "processor": we only store and use them to run DrivePal for you, as set out in our terms.
What we keep
- Your account: your first name and surname, business name, email address, password (stored scrambled, so nobody can read it, including us), trades, prices, quote and invoice settings, bank details you add for invoices, and which accounting software you use, if you tell us.
- Your work: clients, quotes, jobs, appointments, programmes, invoices, payments you record, costs, expenses and budgets, your VAT number and the records you keep for Making Tax Digital and CIS.
- Photos: job photos and receipt photos you take or upload. They are stored privately and only shown to you, your team and, for photos you choose to put on an invoice, your customer (and, for receipt photos you send them, your accountant).
- Your team: the names and emails of people you invite.
- Your customers: the names, addresses, phone numbers and emails you enter, whether they like to be contacted by email or text, whether they've asked not to get review requests, and notes you keep about them. When they accept a quote online, the name and signature they give and any message they send. When they first open a quote link, the time it was opened. When they book from your online booking page, the name, phone number, email, address and note they give, and the services and time they choose.
- Client notes: some Pals suggest noting things like allergies, patch tests, injuries or health conditions, or a pupil's name and school year. You only add these if you choose to, and you should only add what you need (see our terms).
- Subcontractors and suppliers: names, trades, contact details, day rates, prices they send you, payments, and for CIS their tax reference (UTR) and verification number.
- Timesheets and the site signing-in book: who was on site, the day, the times they signed in and out, and the hours worked.
- Your accountant (if you add one): their name, firm, email and phone number, and when you last sent them your figures.
- Subscription: whether you're on a free trial or subscribed (monthly or yearly), and the date of your next payment. Card details are held by Stripe, never by us.
- Card payments from your customers (if you switch them on): the link between your DrivePalaccount and your own Stripe account, and how each job was paid. Your customers' card details go straight to Stripe, never to you or us.
- Automatic texts: when each text was sent, what kind it was and how many parts it took, so we can keep to the monthly allowance. We don't keep the text itself or who it went to after it has been sent, but Twilio, which sends it, keeps its own record (see "Who else sees it").
- Technical: your internet address (and your customers', on quote, payment and booking pages), kept for a short time to stop people guessing passwords or misusing booking pages, and error reports when something breaks (these don't include your customers' details).
- Feedback: any message you send us from the app, with your name and email so we can reply.
- Usage: the days you used DrivePal and the time you last used it each day (not which pages or where), and counts of how many quotes you've made, sent and had accepted. We use these to see whether DrivePal is helping and what to improve. We don't use advertising or analytics tracking tools inside the app. We share only the counts described below with Loops, to send your trial emails.
- Referrals: your referral code, who referred you (if anyone), and the referral credits you've earned. The person who referred you sees only how many people signed up with their code and how many pay, never your name or details.
Why we keep it
- To provide DrivePal to you, under our contract with you (your terms with us). Where you use DrivePal for a company, or as a member of someone else's team, we rely instead on our legitimate interest in providing it.
- To take subscription payments and keep tax records, which the law requires.
- Only if you ticked the box when you signed up (or in Settings): to contact you by email or phone about Pal HQ news and offers. This is your consent, and we keep the date you gave it. Untick it in Settings at any time. Your details are only ever used for Pal HQ's own news and offers, and never passed to anyone else for their marketing (the providers below only handle them for us).
- To keep DrivePal secure and working (stopping password guessing, stopping misuse of quote, payment and booking pages, fixing errors), and to improve it (reading feedback, counting how much it's used). This is our "legitimate interest".
- To email you about your account, such as password resets, and when a customer opens or accepts a quote, pays you by card, or books online.
- If you agree on our public pages, to see which adverts bring people to us (see Cookies). This is your consent.
We never sell your data, never use what you put into DrivePal for advertising, and never send you marketing without asking first, apart from our trial emails, which you can stop at any time.
Who else sees it
We use a few trusted companies to run DrivePal. Each only gets what it needs:
- Supabase: stores the database and logins, in London.
- Vercel: runs the website. Pages pass through its servers, which may be outside the UK.
- Stripe: takes subscription payments and holds card details. If you take card payments from customers, your own Stripe account handles them, under Stripe's terms with you.
- Resend: sends emails for you and for us (quotes, invoices, reminders, review requests, requests to subcontractors, figures to your accountant, password resets).
- Ideal Postcodes (with postcodes.io as a back-up): finds addresses. They only get the postcode you type.
- Sentry: receives error reports so we can fix problems.
- Twilio: sends the automatic reminder texts, if you switch them on. It gets your customer's mobile number, your business name and the text. It may handle them outside the UK.
- Loops: sends our emails to you during your free trial (tips on getting started and when the trial ends, which may suggest referring a friend). It gets your name, email, business name, which Pal and trade you use, your trial end date, how many quotes and jobs you have, and your own referral code and link, never what's in them. Every email has a link to stop them.
- Google and Meta (Facebook and Instagram): only if you say yes on our public pages, they learn about your visit and any sign-up, so we can see which adverts work. They also use this for their own purposes and may handle it outside the UK.
Where any of them handles data outside the UK, we make sure it is protected as UK law requires: either the UK has approved the country or scheme, or the provider has signed the UK's approved contract terms (the International Data Transfer Agreement or Addendum).
Your customers only see what you send them: a quote link shows that quote and your business name, never your notes, costs, other jobs or bank details. In the same way, a subcontractor only sees the work you ask them to price or book, and your accountant only sees the figures and receipts you send them (receipt links stop working after 60 days).
Texts you send your customers yourself go from your own phone (by text message or WhatsApp), not from us. If you switch on automatic texts, we send those reminders for you through Twilio, with your business name as the sender.
How long we keep it
- While your account is open, we keep your data so you can use it.
- If you delete your account (Settings, then "Delete my account"), your account and everything in it are deleted straight away. Copies in backups are overwritten within 30 days.
- Subscription and payment records are kept by Stripe, and by us, for as long as tax law requires (usually 6 years).
- Internet addresses used to stop password guessing or misuse of quote, payment and booking pages are deleted within a day.
Your rights
You can:
- Get a copy of your data: Settings, then "Download all my data", or ask us for anything else we hold about you.
- Correct it: change anything in the app, or ask us.
- Delete it: Settings, then "Delete my account".
- Object to or limit how we use it, by emailing us.
If your customers ask you about their data, you can find, change, download or delete it in DrivePal. If they ask us, we'll pass the request to you and help you answer it.
If you're unhappy with how we've handled your data, please tell us first. You can also complain to the ICO at ico.org.uk or on 0303 123 1113.
Cookies
DrivePal uses a few small cookies:
- One keeps you logged in, which the app needs to work.
- One remembers which Pal you last opened on your phone (just its name, such as ChippyPal), so palhq.co.uk can show a button straight back to it.
- If you pick Light or Dark in Settings, one remembers that choice.
- On ProBuildPal, one remembers whether you were last on Jobs or Programmes.
- While you set up card payments, one briefly keeps any error message from Stripe so we can show it.
Your phone also remembers a couple of display choices, such as whether you send texts by text message or WhatsApp. Customer quote links don't set any cookies, but the quote page tells us when it is first opened so that we can let the business know (see "What we keep"). Payment and booking links don't set any cookies either. A referral link (palhq.co.uk/r/…) doesn't set one: its code is carried in the web address to the sign-up page, so the person who sent it gets the credit if you sign up.
Our public pages (the Pal HQ and Pal homepages, and Sign up) ask before using advertising cookies from Google Analytics and Meta. If you say yes, they count your visit and whether you signed up, so we can see which adverts bring people to us. Google and Meta may also use this for their own purposes. If you say no, or don't answer, nothing is sent to them. These cookies are never used inside the app once you've logged in. We keep your answer in one more small cookie for about 6 months. You can change your choice at any time in this section.
Changes
If we change this policy in a way that matters, we'll tell you by email or in the app before it takes effect.