OrderBraidOrderBraid privacy
Effective 19 October 2026. Controller for account and billing data: Yolleg Ltd, [email protected]. Provider address in terms.
Information and account access
Supplier business names and addresses, purchasing requests, entered invoice details, approvals and delivery observations. Do not store banking or card details. We also process your email, invitations/roles, server-received account attribution and the records/photos you choose to save. Requested sign-in links are random, one-use and expire after 15 minutes; matching email confirmation is required. Essential secure HttpOnly, SameSite session cookies last up to seven days. No password is stored. No advertising trackers, marketing messages or third-party page fonts. Sign-in links use a fragment removed by the app before confirmation, not a token in server request URLs. Do not share a link.
Sharing and processing
The workspace owner and their authorised staff can see its saved records/photos and recorded account attribution; editors can export. Staff invitations reveal the owner’s email to the invited account. Each account has its own separate workspace; selecting an accepted membership opens that owner’s workspace. Owner revocation blocks subsequent requests, not copies already exported. We can decrypt content to deliver the service; encryption is not end-to-end. Account data is processed for contract, legal obligations and security-related legitimate interests. The business determines its lawful basis for workspace personal data; we process it under its instructions to provide the service. Hosting.com provides hosting, Stripe processes payments, and Twilio SendGrid sends requested sign-in, purchase and declaration messages. No staff-invitation email or automatic operational reminders. These providers may process personal data in the United States and other countries. Stripe’s published transfer addendum and Twilio’s published data-protection addendum describe the Data Privacy Framework, including its UK extension, and contractual clauses with the UK addendum where applicable. Hosting.com publishes a UK-extension Data Privacy Framework notice for data it receives in the US. Provider documents are linked below; ask [email protected] for copies and account-specific information. Our hosting account’s complete support/backup locations and applicable processing agreement have not been confirmed; we do not promise UK-only processing. We do not receive full card numbers, sell data or make automated legal, employment or safety determinations.
Retention and choices
Records/photos remain until whole-workspace erasure; cancellation does not erase them. Erasure deletes the live payload, photos and creates a revision tombstone against stale saves. Draft uploads remain counted even after their reference is removed. We do not operate a separate application recovery archive. Provider-managed backups may remain after live workspace erasure; their retention and deletion schedule has not been confirmed. Keep independent originals and ask support about a specific erasure request. Account email and membership remain until account-deletion requests are processed by support. Verified account terms acceptances retain the full original terms, hash and acceptance/verification times; unverified challenges are pruned after 30 days. Billing, verified account consent and complaint records may be retained for six years where legally needed. Sign-in challenges and authentication mail are pruned after use/expiry; invitations expire after seven days. Technical logs may include IP, route, time and errors; security counters are bounded and pruned.
Provider transfer information
Stripe: https://stripe.com/legal/dta Twilio SendGrid: https://www.twilio.com/en-us/legal/data-protection-addendum Hosting.com: https://terms.hosting.com/data-privacy-framework Twilio’s Binding Corporate Rules do not cover SendGrid. The linked published mechanisms do not establish every detail of this particular hosting account.
Your rights
Export record JSON for portability; it contains references, not image bytes. View photos and include relevant ones in prepared reports where supported. Ask [email protected] for access, correction, deletion, restriction or objection. Identify your account without sending sign-in links or card details. Mandatory rights remain unaffected; you may complain to the UK ICO or your local authority. Protect your email/device and use Sign out all devices if needed.