Privacy Policy

1. Our two roles — and why the difference matters

NerthOne is used by two groups of people, and our responsibilities are different for each. Reading the rest of this policy is much easier once you know which one you are.

Businesses that subscribe to NerthOne. When a business signs up, we decide how and why we handle the information about that business and the people who log in for it — their names, email addresses, plan and billing records. For this information we are the controller, and this policy describes what we do with it.

The customers of those businesses. When a plumber adds you as a customer, raises an invoice or books a visit, the plumber decides what to record about you and why. We store and process it on their instructions. For this information we are a processor and the business is the controller. Our handling is governed by our agreement with that business — and if you want your details changed or erased, the business is the right place to start. Section 10 explains what to do if that does not work.

We do not sell personal information, and we do not use the data a business stores in NerthOne to advertise to its customers or to build profiles for anyone else.

2. What we collect

2.1 Information a business gives us

• Business profile: trading name, category, legal entity type, company registration (RC) number where provided, email, phone, address, country, currency, time zone, logo and brand colour.
• Account holders: name, email address, phone number, a hashed password, role, and two-factor settings where enabled.
• Payout and transfer details: bank name, account name and number, routing number and bank address, where a business chooses to print these on its invoices.
• Billing records: the plan held, subscription invoices, payment status, and whether a free trial or free plan has been used.

2.2 Information a business stores about its own customers

Processed on that business's behalf. Typically: customer name, email address, phone number, billing and service addresses, a customer reference, outstanding balance, invoices and receipts, payment records, bookings and appointment notes, and messages exchanged through the portal.

2.3 Information we collect automatically

• Security and audit records: sign-in events, IP address, and an activity log of significant actions, so an account holder can see what was changed and by whom.
• Delivery records: whether an email we sent on a business's behalf was queued, sent or failed.
• Technical data: the information any web server receives — browser type, approximate location derived from IP, and the pages requested.

We do not run advertising trackers or third-party analytics profiling on the NerthOne application.

2.4 What we deliberately do not store

Card numbers never reach our servers. Card payments are handled by our payment processor; we receive only a reference, the last four digits, the card brand and the outcome. We never see or store a full card number, expiry date or security code.

3. How we use it

• To provide the service: create accounts, raise and deliver invoices and receipts, schedule bookings, carry messages, and run the customer portal.
• To take payment: charge subscriptions, process card payments on invoices, and apply the platform processing fee where a business has it switched on.
• To communicate: verification codes, password resets, payment reminders, notifications a business or its customer has asked for, and necessary service notices such as planned downtime or a change to these terms.
• To keep accounts secure: detect and investigate suspicious sign-ins, enforce two-factor verification, and maintain the audit log.
• To support you: answer questions and diagnose faults. Our staff access a business's data only where it is necessary to do so, and such access is recorded.
• To meet legal obligations: keep tax and accounting records, and respond to lawful requests.
• To improve the product: understand which features are used and where people get stuck, using aggregated information rather than the content of anyone's invoices or messages.

4. Legal bases

Where data protection law requires us to identify a legal basis — for example the UK GDPR or the EU GDPR — we rely on the following:

• Performance of a contract: providing NerthOne to a business that has subscribed, and giving its customers access to the portal.
• Legitimate interests: securing the service, preventing abuse, keeping audit records, and improving the product — balanced against your interests and rights.
• Legal obligation: tax, accounting and other record-keeping duties.
• Consent: optional messages a business or customer has opted into. Consent can be withdrawn at any time in notification preferences, without affecting the service messages we must still send.

5. Who we share information with

We share personal information only with the providers needed to run the service, and only with what each needs. Every one is bound by contract to protect it and to use it solely to provide their service to us.

We may also disclose information where we are legally required to, where it is necessary to establish or defend legal claims, or as part of a merger or acquisition — in which case we will tell affected businesses before their data becomes subject to a different policy.

We will publish any change to this list here before it takes effect, so a business can object or end its subscription if it is not comfortable with a new provider.

6. International transfers

Our providers may process information in countries other than your own. Where personal information protected by UK or EU law is transferred outside those areas, we rely on the safeguards available to us — most commonly the UK International Data Transfer Agreement or the European Commission's Standard Contractual Clauses, or the provider's own certification under an approved framework. You may ask us for details of the safeguards applying to a particular transfer.

7. How we protect it

• In transit: every connection to NerthOne is encrypted with TLS.
• Passwords: stored only as a one-way hash. Nobody at Nerth Labs can read your password, and we will never ask you for it.
• Sensitive short-lived values: verification and invitation codes are encrypted at rest while they are valid, and the readable copy is discarded once used or expired.
• Separation between businesses: every record belongs to exactly one business, and that boundary is enforced in the application on every query — not left to the correctness of individual screens.
• Access control: permissions determine what each member of a business's team can see, and administrators can require two-factor verification.
• Accountability: significant actions are written to an audit log, including administrative access to a business's account.

No system is perfectly secure. If a breach affects your personal information and is likely to present a risk to you, we will notify the affected business and, where the law requires, the relevant supervisory authority, without undue delay.

8. How long we keep it

• While the account is open: for as long as a business keeps its NerthOne account, so its records remain usable.
• After closure: service data is deleted or anonymised within a reasonable period of a business closing its account and that account being settled, unless we must keep it for the reasons below.
• Financial records: invoices, payments and tax records are kept for the period required by law, which is commonly six to seven years.
• Security and audit logs: kept for a limited period for investigation and dispute resolution.
• Verification codes: short-lived by design and discarded once used or expired.

Where we are a processor, a business can delete its customers' records at any time, and we delete them from live systems accordingly. Backups are overwritten on their own cycle.

9. Your rights

Depending on where you live, you may have the right to:

• ask what personal information we hold about you and get a copy;
• have inaccurate information corrected;
• have information erased, where we have no overriding reason to keep it;
• restrict or object to how we use it, including objecting to our legitimate interests;
• receive your information in a portable format;
• withdraw consent where we relied on it; and
• complain to your data protection authority.

A business can export its customers, invoices and payments from the application at any time without asking us. For anything else, write to hello@nerthlabs.com. We will respond within one month, and will tell you if we need longer because a request is complex. We may ask you to confirm your identity first — not to obstruct the request, but because handing someone else's data to the wrong person is the failure we are most concerned to avoid.

10. If you are a customer of a business using NerthOne

The business you deal with decides what to record about you. Ask them first: they can correct or delete your details directly, and they will usually be quicker than we can be.

If you cannot reach them, or they do not respond, write to us at hello@nerthlabs.com and we will pass your request to them and help them act on it. Where the law places an obligation directly on us, we will meet it ourselves.

You can manage which notifications you receive, and turn off optional categories, from the notification preferences in your portal account at any time.

That includes text messages and WhatsApp. If the business has your mobile number, service messages — invoices, payment reminders, appointment changes, portal invitations — are sent to it by default, because that is what the number was given for. Promotional messages are not: those are only sent on these channels if you positively agree to them.

To stop them, switch the channel off in your portal or reply STOP to any message. An opt-out takes effect immediately and applies to every business using NerthOne that messages that number, not only the one you replied to.

11. Cookies and local storage

We use the smallest set we can, and none of it is for advertising.

Clearing your browser's site data removes all of these. The strictly necessary cookie cannot be switched off without signing you out.

12. Children

NerthOne is a tool for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child's information has been provided to us, contact us and we will delete it.

13. Changes to this policy

We will update this page when our practices change, and change the "last updated" date at the top. If a change materially affects how we handle personal information, we will tell subscribing businesses by email or in the application before it takes effect.

14. Contact us

Questions, requests and complaints: hello@nerthlabs.com.

Still to be completed before publication: the registered legal name and address of the Nerth Labs entity operating NerthOne, the name of our hosting provider and the country its servers are in, and — if we are required to appoint one — the contact details of our data protection representative. These are marked rather than guessed, because stating them wrongly in a privacy policy is worse than leaving them out.