1. Who we are
Tickover is operated by Tickover App Ltd, a company registered in England and Wales (company no. 17256001) with its registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.
For the purposes of UK GDPR and the Data Protection Act 2018, we are the data controller for the personal data described in this policy. If you have questions about your data you can email us at hello@tickover.app (mark the subject "Data request" for the fastest route to the right person).
We are registering with the Information Commissioner’s Office (ICO) and will add our registration number here when it issues.
2. What this policy covers
This policy applies to the Tickover marketing site at tickover.app, the four user-facing apps — home.tickover.app, tenant.tickover.app, landlord.tickover.app and trade.tickover.app — and to email and other communications we send to you.
It does not cover websites or services we link to but don’t run (for example a tradesperson’s own website, or Google Maps); those have their own privacy policies.
3. Personal data we collect
We collect the data we need to run Tickover and no more. The categories below summarise what we hold and where it comes from.
| Category | What this includes |
|---|---|
| Account & identity | Your name, email address, password (stored as a one-way bcrypt hash, never in readable form), phone number if you give us one, and which app(s) you use (homeowner, tenant, landlord or trade). |
| Property & home data | For homeowners, tenants and landlords: the address of your property, photos you upload, the appliances and items you record (boiler model, white goods, etc.), certificates, warranties, identity documents, and notes you add to your home file. |
| Tradesperson onboarding | For tradespeople: business name and trading name, VAT number if applicable, public liability insurance details, professional qualifications and Gas Safe / NICEIC / equivalent registrations, and coverage area (postcodes). |
| Self-diagnose & Find someone | Answers and photos you add in the guided diagnosis tool, and the trade categories or area you search when you use Find someone. Searching does not send your job or contact details to a tradesperson. |
| Historic jobs, quotes and messages | If your account was opened when Tickover ran a quote marketplace, we may still hold those older job, quote, message and photo records. New work is not quoted or booked through Tickover. |
| Payment data | When we add payments to the platform, card details are handled directly by our payment processor (e.g. Stripe) and never reach Tickover servers. We hold a transaction record (amount, date, last 4 of the card, processor reference) for accounting. |
| Technical data | Your IP address, browser and device type, the pages you visit on the marketing site and apps, and sign-in events (timestamp, success/failure, IP). Used for security, debugging and fraud detection. |
| Communications with us | If you email us, write to us, or talk to us, we keep a record of that exchange so we can pick up where we left off and so we can train new team members. |
Most of this data comes from you, directly — when you sign up, add a property, store a document, run self-diagnose, or search Find someone. A small amount (your IP address, browser details, sign-in timestamps) is collected automatically when you use the apps.
4. Lawful bases
UK GDPR requires us to identify a "lawful basis" for every use of your personal data. Ours are:
| What we use the data for | Lawful basis | Detail |
|---|---|---|
| Providing you with the service you signed up for (creating an account, storing your home file, sending reminders, self-diagnose, showing local trades, transactional email). | Contract | UK GDPR Art. 6(1)(b) — necessary to perform a contract with you, or to take steps before entering one. |
| Vetting tradespeople, fighting fraud, debugging issues, keeping the platform secure, defending legal claims. | Legitimate interests | UK GDPR Art. 6(1)(f) — necessary for our legitimate interests in operating Tickover safely. You can object; see "Your rights". |
| Meeting our obligations under UK tax, accounting, anti-money-laundering and consumer-protection law. | Legal obligation | UK GDPR Art. 6(1)(c). |
| Marketing emails or non-essential cookies (we don't currently send these; if we ever do, we'll ask first). | Consent | UK GDPR Art. 6(1)(a). You can withdraw consent at any time without affecting anything you did before that point. |
| Reading a mailbox you choose to connect (Connect Gmail or Connect Outlook) so we can suggest bills, certificates and policies for your home file. | Consent | UK GDPR Art. 6(1)(a). Optional. You connect from Documents in Tickover Home — the website or the app — and can disconnect at any time. |
5. How we use your data
The day-to-day uses, expanded out:
- Running your account. Letting you sign in, store documents and items, see reminders, and manage household access.
- Find someone. Showing local trades for the category and area you search. We do not send the job to them.
- Vetting tradespeople. Verifying ID, insurance and qualifications when a trade applies to join, and on an ongoing basis.
- Communicating with you. Sign-in links, password resets, verification emails, reminder notifications, and replies to anything you send us.
- Keeping the platform safe. Detecting fraud, account takeover, abuse and policy violations; defending legal claims; meeting safeguarding obligations.
- Improving the service. Diagnosing bugs from error logs, measuring how features perform in aggregate, and planning what to build next. We use the minimum identifiable data needed for each task.
- Meeting legal obligations. Keeping accounting records, responding to lawful requests from HMRC, the ICO, courts and the police.
7. International transfers
Some of the service providers we use (notably Resend, Google and Railway) are based in the United States or operate global infrastructure. When personal data leaves the UK we make sure it stays protected, using:
- the UK International Data Transfer Addendum to the EU Standard Contractual Clauses; or
- another lawful transfer mechanism approved under UK GDPR (for example an adequacy decision).
You can ask us for a copy of the safeguards in place for a specific transfer by emailing hello@tickover.app.
8. How long we keep your data
We keep personal data only as long as we need it. The headline rule of thumb is "life of your account, plus 6 years", which covers the UK statutory limitation period for contract claims. The detail by category:
| Data | How long | Why |
|---|---|---|
| Account data | Life of the account, plus 6 years after closure | Allows tax, accounting and consumer-rights claims to be resolved (Limitation Act 1980). |
| Historic job history (quotes, messages, photos) | 6 years after the job is completed | Standard limitation period for contract claims (Limitation Act 1980). |
| Payment & invoice records | 6 years | HMRC record-keeping requirements. |
| Sign-in and server logs | Up to 90 days | Security incident investigation. After that, only aggregated/anonymous metrics survive. |
| Connected mailbox tokens | Until you disconnect that mailbox, or the account is closed | Refresh tokens let Tickover scan for matching mail. Encrypted at rest. Deleted on disconnect. |
| Mailbox suggestions (unfiled) | Until you file, skip, or disconnect that mailbox | We store sender, subject, date and a relevance note so you can choose what to file. Bodies and attachments are only downloaded when you file a message. |
| Support email threads | 3 years after the last message | So we can pick up where we left off if you come back to us. |
| Marketing preferences | Until you change them | We honour an unsubscribe forever; we keep a small record showing you opted out, so we don't accidentally email you again. |
When the retention period ends we either delete the data or irreversibly anonymise it so it can no longer be linked to you.
9. Your rights
Under UK GDPR you have the right to:
- Be informed about how we use your data — this policy is part of how we do that.
- Access the personal data we hold on you.
- Rectify inaccurate data, or have incomplete data completed.
- Erase your data ("right to be forgotten") where we no longer need it or where you withdraw consent we were relying on.
- Restrict processing in certain circumstances (for example while we resolve a complaint about accuracy).
- Portability — receive the data you gave us in a structured, commonly-used, machine-readable format.
- Object to processing we rely on legitimate interests for, or to direct marketing (we don’t do marketing today, but the right always applies).
- Rights related to automated decisions — we don’t currently make automated decisions about you that have a legal or similarly significant effect.
To exercise any of these rights, email hello@tickover.app with the subject "Data request". We’ll reply within one calendar month, and let you know if we need longer for a complex request. We may ask you to verify your identity before we hand data over.
If you think we’ve got something wrong, please tell us first so we can fix it — but you also always have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
10. Security
We take security seriously and use commercially reasonable measures to protect your data, including:
- TLS for all traffic between your device and Tickover.
- Bcrypt password hashing — we never store your password in readable form.
- JWT session cookies with the
httpOnlyandSecureflags, so the session token is not readable by JavaScript and is only sent over HTTPS. - Least-privilege access internally — only the people who need access to data to do their job have it.
- Regular dependency updates and code review.
No system is 100% secure. If we ever have a personal data breach that’s likely to risk your rights and freedoms, we’ll notify the ICO within 72 hours and tell you directly without undue delay.
12. Children
Tickover is intended for adults. You must be 18 or over to create an account. If you believe a child has given us personal data, email hello@tickover.app and we’ll delete it.
13. Changes to this policy
We’ll update this page when our practices change. The version number and "Last updated" date at the top of the page always reflect the current text. For material changes, we’ll also email you (using the address on your account) and/or display a notice in the app the next time you sign in.
14. Contact us
For any privacy or data-protection question, including subject access requests, please email hello@tickover.app (or trade@tickover.app if you’re a tradesperson contacting us about your trade account specifically). You can also write to us at the registered office below.
If we can’t resolve your concern, you have the right to complain to the ICO at ico.org.uk.
Questions about this document?
Email hello@tickover.app or write to Tickover App Ltd, 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. We aim to reply within two working days.