Privacy Policy

1. Information we collect

A. Information you give us

• Account and profile data: your name, email address, phone number, postcode or town, profile photo and account preferences.
• Business profile data: trading name, company or VAT registration details, service description, categories used for benchmarking, coverage area and photos you publish.
• Job data: job titles, descriptions, budgets, locations and any photos or files you upload from your device camera or gallery.
• Messages and reviews: quote messages, job comments, cancellation reasons and reviews you leave about a job.
• Support conversations: the questions you ask the Ask Tonto help assistant and any ticket escalated to our admin team.
• Payment and payout data: billing details processed by Stripe, plus the bank account name, sort code and account number you give us so we can pay a wallet withdrawal.

B. Referral and introducer data

If you were invited by an introducer, we record the link between your account and theirs so rewards can be paid correctly. Your name, email address and sign-up date are visible to the introducer who invited you. If you invite others, the same information about them becomes visible to you.

C. Device and location data

• Location data: with your permission we use your device location, or the postcode you enter, to rank nearby businesses by distance. You can decline and search by area instead.
• Technical log data: IP address, browser type, device information, operating system and access timestamps, collected to keep the service secure and working.

2. How we use your information

• To run the platform: matching customers with relevant businesses, delivering quote requests, and tracking each job through its stages.
• To send service notifications: email and in-app alerts when a quote arrives, a job changes stage, a payment is due or a payout is processed.
• To operate the rewards ledger: calculating commission, customer cashback and introducer rewards, and reconciling wallet balances and withdrawals.
• To provide help: routing your question through the Ask Tonto assistant and, where needed, to a human admin.
• To keep the platform safe: preventing fraud and abuse, verifying business credentials, and meeting our legal and accounting obligations.

Our lawful bases are performance of a contract (running your account and jobs), legitimate interests (security, service improvement, fraud prevention), consent (device location, optional marketing) and legal obligation (tax, VAT and accounting records).

3. Who we share it with

• Other users, to the extent needed to do the job: a business you contact sees your job details and contact information; a customer sees your published business profile and reviews.
• Stripe, for card payments, commission charges and cancellation fees, including their identity and anti-fraud checks.
• Our hosting, database, storage and email providers, who process data on our instructions under contract.
• Professional advisers, regulators or law enforcement where we are legally required to disclose.

We do not sell, rent or lease your personal information to third-party marketing brokers, and we never will.

4. Reviews and published content

Reviews and comments left about a business may be published on that business’s public profile alongside the reviewer’s first name. Do not include personal information in a review that you are not happy to make public.

5. How long we keep it

We keep account, job and message data for as long as your account is active. Financial records — commission charges, cashback, introducer rewards and payouts — are kept for at least six years to meet UK tax and accounting requirements. Other data is deleted or anonymised when it is no longer needed.

6. Security

Access to personal data is restricted by database-level security rules so users can only see the records they are entitled to. Payment card details are handled by Stripe and never stored on our systems. Bank details supplied for withdrawals are visible only to the admin team processing the payment.

7. Your rights

Under UK GDPR you have the right to access, correct, delete or port your data, to object to or restrict processing, and to withdraw consent at any time (for example by turning off location access or using the unsubscribe link in our emails). To exercise any of these rights, email chief@trusttonto.com. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

8. Cookies and similar technologies

We use only the cookies and local storage needed to keep you signed in, remember your preferences and keep the service secure. We do not use third-party advertising cookies.

9. Children

Trust Tonto is not intended for anyone under 18 and we do not knowingly collect their data.

10. Changes to this policy

We may update this policy from time to time. Material changes will be notified in the app or by email, and the “last updated” date above will change.

11. Contact us