Privacy Policy

This Privacy Policy explains how Toverra Ltd (“Toverra”, “we”, “us”) handles personal information in connection with the Toverra service. We are based in the United Kingdom and provide the service to businesses in the United States.

1. Two groups of people this policy covers

This policy concerns two distinct groups, with different roles:

• Contractors — our business customers, who create an account and connect their Jobber account.
• Homeowners — the contractor’s own customers, whose data appears in the contractor’s Jobber history and to whom outreach emails may be sent. Homeowners do not have an account with us.

Our role differs by activity. For ingesting and scoring Homeowner data, we act as a service provider / processor on behalf of the Contractor, who is the business/controller. For sending outreach emails, we act as the sender of record under CAN-SPAM and, for that limited purpose, as a controller — but only on the Contractor’s documented instruction. The Contractor is responsible for the lawful basis to contact each Homeowner.

2. Information we collect

From Contractors

• account details (name, business name, email);
• sender configuration (from-name, reply-to, physical postal address);
• billing details — collected and processed by Lemon Squeezy as Merchant of Record, not stored by us in full;
• usage and log data.

About Homeowners (from the Contractor’s connected Jobber account)

• identifiers and contact details (name, service address, email, phone);
• commercial / service information (equipment installed, job notes, quotes, invoices, dates); and
• information we derive (estimated equipment age, replacement-readiness score, suppression/unsubscribe status, email delivery events).

We collect Homeowner information from the Contractor’s connected Jobber account, not from the Homeowner directly, and only with read-only scopes limited to what the Service uses.

3. How we use information

• to provide the Service: estimate equipment age and replacement-readiness, and rank opportunities;
• to send outreach emails on the Contractor’s behalf, where enabled;
• to operate, secure, support, and improve the Service;
• to comply with legal obligations.

4. AI processing (Anthropic)

To extract structured equipment facts from job records, we send the relevant record text to Anthropic’s Claude API, a third-party AI provider. This processing is operated under no-training commercial terms; zero-data-retention enrolment is in progress and not yet confirmed. We use Claude only to produce the structured output described above and not to train any model.

5. Sharing and sub-processors

We do not sell personal information. We share information only with the sub-processors needed to run the Service (hosting, storage, AI processing, email delivery, and payments), each under contract and only for the purposes above. See our sub-processor list. We may also disclose information where required by law.

6. Cookies

We use only strictly necessary cookies (for example, to keep you signed in and to secure forms). We do not use advertising or cross-site tracking cookies. See our Cookie Notice.

7. Retention and deletion

We keep Contractor account data for as long as the account is active. Homeowner data is retained while the Contractor’s account is connected and is deleted when the Contractor disconnects their Jobber account or closes the account; we can certify deletion on request. We honour unsubscribe requests promptly and keep the minimum record needed to ensure a person who has opted out is not contacted again.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, to opt out of its sale or sharing (we do not sell or share for cross-context behavioural advertising), and not to be discriminated against for exercising these rights.

• Homeowners: because your data originates from a Contractor who controls it, we will, on request, action your request and/or route it to the relevant Contractor. You can unsubscribe from emails at any time using the link in any message. Contact privacy@toverra.com.
• Contractors and UK/EU individuals: contact us at privacy@toverra.com. As we are UK-based, UK data-protection law applies to our processing; you may also complain to the UK Information Commissioner’s Office (ICO).

9. International transfers

We are based in the United Kingdom and use sub-processors located in the United States. Personal information may therefore be processed in the UK and the US. Where required, we put appropriate safeguards in place for such transfers.

10. Security

We use technical and organisational measures including encryption of sensitive data at rest, encryption in transit, strict per-customer data isolation, and access controls. No method of transmission or storage is completely secure.

11. Changes

We may update this policy; we will post the new version with an updated date and, for material changes, provide reasonable notice.

12. Contact

Toverra Ltd — privacy contact: privacy@toverra.com.