Privacy Notice

This notice explains how Timothy Bosse, trading as Bomb Diggity Woodcrafters (Deckworks), handles personal data in the Deckworks app. For the data you and your clients provide through Deckworks, we act as the data controller — we decide why and how it is processed. Where you upload your own clients’ details, you are responsible for having a lawful basis to share them with us.

Data we collect and why

• Account data (name, email, login credentials, sign-in provider) — to create and secure your account. Legal basis: performance of our contract with you.
• Business and document data (company details, client names, addresses, emails, estimates, invoices, line items, takeoff figures, job photos and captions) — to provide the service and generate the documents you share with your clients. Legal basis: contract.
• Support messages — to answer your questions. Legal basis: legitimate interests.
• Usage and device data (pages viewed, feature usage, IP address, browser and device identifiers, error logs) — for security, fraud prevention and product improvement. Legal basis: legitimate interests.
• Email delivery data (recipient address, send and open status of invoice reminders) — to send the reminders you enable. Legal basis: contract and legitimate interests.
• Marketing communications, if you opt in. Legal basis: consent, withdrawable at any time.

Payment card details are collected and processed by Paddle, not by us. We never see or store full card numbers.

Who we share data with

• Service providers and subprocessors: hosting, database and storage, email delivery, and error monitoring.
• Paddle.com, our Merchant of Record, for the sale of subscriptions, subscription management, payment processing, tax compliance and invoicing.
• Professional advisers such as legal and accounting, where needed.
• Authorities or regulators where required by law.

We do not sell personal data.

International transfers

Our providers may process data in the United States and other countries. Where data leaves the UK or EEA we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

Retention

We keep your account and document data for as long as your account is active, and for up to 12 months after closure so you can reactivate or export. Billing records are kept as long as tax and accounting law requires. Usage logs are kept for up to 12 months. After that, data is deleted or anonymised.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your data, to receive a portable copy, to withdraw consent, and to complain to your data protection authority. UK and EEA residents have these rights under the GDPR and we will respond within one month. Contact support@notify.bombdiggitywoodcrafting.com to exercise them.

Security

We use appropriate technical and organisational measures, including encryption in transit, encrypted storage, row-level access controls so each account can only reach its own records, and signed, time-limited links for shared invoices and job photos.

Cookies

We use essential cookies and local storage to keep you signed in and to remember app preferences such as your export format. We do not use advertising cookies. You can clear or block cookies in your browser settings, though the app may not work correctly without the essential ones.