Toolsmith App — Privacy Policy
1. About this Privacy Policy
This Privacy Policy explains how Toolsmith Ltd ("Toolsmith", "we", "us", "our") collects and uses personal data when you use the Toolsmith mobile app for iOS and Android (the "App"). It supplements the Toolsmith website Privacy Policy — for browsing or purchasing via our website, that policy continues to apply.
We are the data controller of personal data described in this policy. We are committed to handling your data lawfully and transparently under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Who we are and how to contact us
| Legal entity | Toolsmith Ltd |
|---|---|
| Companies House number | 16520777 |
| VAT number | GB497504454 |
| ICO data protection registration | ZC147961 |
| Registered address | 39 Heather Road, Small Heath, Birmingham, B10 9TE, United Kingdom |
| Privacy contact email | info@toolsmithltd.co.uk |
| Privacy contact post | Privacy, Toolsmith Ltd, 39 Heather Road, Small Heath, Birmingham, B10 9TE |
We are not required to appoint a Data Protection Officer (DPO) under UK GDPR Article 37. The Director, Khurram Yaseen, is responsible for data protection compliance.
3. What personal data we collect
3.1 Data you provide directly
| Category | Examples | When |
|---|---|---|
| Account details | Name, email address, password (hashed), phone number (optional) | When you create or sign in to an account |
| Authentication tokens | Sign in with Apple / Sign in with Google identifiers | If you use a third-party login |
| Shipping & billing addresses | Postcode, street, town, country | At checkout |
| Payment data | Card last 4 digits, payment method type | Processed by Apple Pay, Google Pay, Shop Pay or our payment processor; we do not store full card details |
| Order history | Items purchased, order value, dates, fulfilment status | When you place an order |
| Wishlist & favourites | Product handles you save | When you tap the heart icon |
| Support correspondence | Messages, attachments, photos you send us | When you contact us via the app, email, or social channels |
| Reviews & UGC | Reviews, photos, ratings you submit | If you submit a product review |
3.2 Data collected automatically
| Category | Examples |
|---|---|
| Device identifiers | Apple IDFV / Google AAID (only if you grant permission), device model, OS version, app version, language, time zone |
| Push notification token | Apple APNs token or Firebase FCM token (only after you grant push permission) |
| Usage analytics | Screens viewed, taps, search queries within the app, session duration, crashes |
| Search activity | Search terms entered inside the app (used to improve search relevance) |
| Approximate location | Derived from IP address only — used for fraud prevention and currency display. We do not access device GPS. |
| Diagnostic data | Crash logs, error reports, performance metrics |
3.3 Data we receive from third parties
| Source | Data |
|---|---|
| Apple | Sign in with Apple identifier (a relay email if you choose to hide your real one), purchase receipts for in-app purchases (none currently used) |
| Sign in with Google profile (name, email, profile picture if granted), purchase receipts | |
| Shopify | Order history if your account email matches an existing Toolsmith web account |
| Payment processors | Payment confirmation status, fraud signals |
3.4 Special category data
We do not intentionally collect special category data (health, religion, ethnicity, sexual orientation, biometric, genetic, political). If you voluntarily disclose such information in a support message or product review, we treat it with appropriate care but ask that you avoid sharing it where not necessary.
3.5 Children's data
The Toolsmith App is not directed at children under 13 and is rated accordingly on the App Store and Google Play. We do not knowingly collect data from children under 13. If you believe a child has provided personal data, please contact us and we will delete it.
4. Lawful bases for processing (UK GDPR Article 6)
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account | Contract — necessary to provide the App service you requested |
| Processing your orders, payments, refunds | Contract — necessary to fulfil our purchase agreement |
| Sending order-related transactional notifications | Contract + Legitimate interest |
| Sending marketing push notifications and emails | Consent — you opt in; you can withdraw at any time |
| Fraud prevention, security, abuse detection | Legitimate interest + Legal obligation |
| Analytics to improve the App | Legitimate interest — we limit data, use aggregated reporting where possible |
| Responding to your support requests | Legitimate interest + Contract |
| Complying with tax, accounting, consumer-protection law | Legal obligation |
You may withdraw consent at any time by changing settings in the App (Profile → Notifications), the OS-level permissions (iOS Settings or Android Settings), or by emailing us. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
5. Who we share your data with
We share only what is necessary, only with the parties listed below, only for the purposes stated.
5.1 Service providers (processors acting on our instructions)
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Shopify Inc. | E-commerce backend (catalog, cart, checkout, orders) | Account, order, shipping, payment status | Canada / Ireland |
| Cloudflare, Inc. | App backend hosting (Workers), CDN, security | API requests, device IP, request headers | Global edge network |
| Klaviyo, Inc. | Marketing email, push notifications, customer segmentation | Account email, name, push token, order events | United States |
| Google LLC (Firebase, FCM, Crashlytics, Vertex AI Search) | Android push delivery, crash reporting, in-app search | FCM token, crash logs, search queries | EU (Vertex Search europe-west1), US (Firebase) |
| Apple Inc. | iOS push delivery (APNs), Sign in with Apple, App Store payments | APNs token, Sign in with Apple identifier | United States |
| Meta Platforms Ireland Ltd. | App attribution, advertising measurement | Device IDFV/AAID (only if you grant ATT permission), event names | Ireland / United States |
| Sentry, Inc. (if enabled) | Crash reporting and error monitoring | Stack traces, device model, app version | United States / EU |
| Shopify Payments / Apple Pay / Google Pay / Shop Pay | Payment processing | Card token (full PAN never stored), billing address, transaction amount | Varies; PCI-DSS compliant |
Each processor is engaged under a data processing agreement (Article 28 UK GDPR) and is contractually required to handle your data only for the purposes we direct.
5.2 Other recipients
- Couriers (Royal Mail, DPD, Evri, others) — your name, delivery address, phone number, where needed to fulfil delivery
- Tax authorities (HMRC) — transaction data as required by VAT and corporation tax law
- Law enforcement, regulators, courts — where legally compelled or to protect our rights
- Professional advisers (accountants, solicitors) — under confidentiality, where needed
We do not sell your personal data. We do not share your data with advertising networks except as you authorise through App Tracking Transparency (iOS) or equivalent Android consent.
6. International data transfers
Some of our processors (notably Apple, Google, Klaviyo, Meta, Sentry, Cloudflare) process data outside the UK, primarily in the United States or globally distributed edge networks.
Where data leaves the UK, we rely on one of the following safeguards:
- The UK adequacy decision for the EEA
- The UK Extension to the EU–US Data Privacy Framework for certified US recipients
- UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses (SCCs) plus UK Addendum
- Supplementary technical measures (encryption in transit and at rest, pseudonymisation where feasible)
You can request a copy of the relevant transfer safeguard by emailing info@toolsmithltd.co.uk.
7. How long we keep your data
| Data | Retention period |
|---|---|
| Active account data | While your account is active + 12 months after last login |
| Order and transaction records | 7 years (UK tax and consumer-protection law) |
| Marketing consent records | Until you withdraw + 6 months for evidence of withdrawal |
| Push notification tokens | Until you uninstall the App or disable push |
| Support correspondence | 3 years from last contact |
| Crash logs and analytics | 13 months, then deleted or fully anonymised |
| Payment records | 7 years (financial regulation) |
| Marketing analytics (aggregated) | Indefinitely once anonymised — no longer personal data |
8. Your rights under UK GDPR
You have the following rights in relation to your personal data. To exercise any of them, contact info@toolsmithltd.co.uk.
| Right | What it means |
|---|---|
| Right of access (Article 15) | Get a copy of the personal data we hold about you |
| Right to rectification (Article 16) | Correct inaccurate or incomplete data |
| Right to erasure (Article 17) | Have your data deleted (subject to legal retention obligations such as VAT records) |
| Right to restrict processing (Article 18) | Limit how we use your data while a query is resolved |
| Right to data portability (Article 20) | Receive your data in a machine-readable format and transmit it elsewhere |
| Right to object (Article 21) | Object to processing based on legitimate interest, or to direct marketing |
| Right to withdraw consent (Article 7) | Withdraw any consent you've given, at any time |
| Right not to be subject to automated decisions (Article 22) | We do not make solely automated decisions with legal or similarly significant effects |
We will respond within one calendar month of receiving a verified request, free of charge.
Complaining to the ICO
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):
- Website: https://ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would appreciate the chance to address your concern first by contacting us at info@toolsmithltd.co.uk.
9. App permissions explained
The App requests the following permissions only when needed. You can revoke any of them at any time in your device settings.
| Permission | iOS / Android | Why we ask |
|---|---|---|
| Push notifications | iOS Notifications / Android POST_NOTIFICATIONS | Order updates, shipping alerts, restock notifications (only those you opt in to) |
| Camera | iOS NSCameraUsageDescription / Android CAMERA | AR product viewer (Phase 2). Image is processed on-device only and never uploaded. |
| Photo Library (if enabled) | iOS NSPhotoLibraryUsageDescription | Attaching photos to a support message or product review |
| App Tracking Transparency | iOS only | Asks whether you allow advertising measurement (Meta Pixel App Events). Refusing has no effect on the App's functionality. |
We do not request: GPS location, contacts, microphone, calendar, motion sensors, Bluetooth, or background app refresh.
10. Security
We protect your data with industry-standard measures including:
- TLS 1.3 encryption for all data in transit
- AES-256 encryption for data at rest where supported
- Hashed and salted passwords (passwords are never stored in plain text)
- Tokenised payment data (full card numbers never touch our servers)
- Principle of least privilege — staff access is limited to what their role requires
- Multi-factor authentication on all administrative accounts
- Regular security review of dependencies, APIs, and infrastructure
- Logging and monitoring for unusual access patterns
No system is 100% secure. If a personal data breach occurs that is likely to affect your rights, we will notify you and the ICO within the 72 hours required by UK GDPR Article 33.
11. Cookies and similar technologies in the App
The App does not use browser-style cookies. It does use:
- Secure on-device storage for authentication tokens and your preferences
- SDK identifiers for the third-party services listed in Section 5
- Crash reporting and analytics IDs that you can reset in your device settings
The website (toolsmithltd.co.uk) uses cookies as described in the Cookie Policy.
12. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent change.
If we make a material change affecting how we use your data, we will:
- Notify you in the App (banner on next launch)
- Email you (if you have an account)
- Where required by law, ask for your renewed consent
You should review this page periodically. Continued use of the App after a non-material update means you accept the revised policy.
13. Glossary
| Term | Meaning |
|---|---|
| Personal data | Any information that identifies you or could be combined with other data to identify you |
| Processing | Anything we do with your data — collecting, storing, using, sharing, deleting |
| Data controller | The organisation that decides why and how data is processed (Toolsmith Ltd) |
| Data processor | A third party that processes data on the controller's instructions (e.g. Shopify, Klaviyo) |
| UK GDPR | The UK version of the General Data Protection Regulation, in force from 1 January 2021 |
| DPA 2018 | The Data Protection Act 2018, which implements UK GDPR in domestic law |
| ICO | The Information Commissioner's Office — the UK's independent data protection regulator |
