Privacy Policy

1. Who We Are

GK Tools Ltd is a UK-registered company providing software tools and services for small businesses and tradespeople.

• Company Name: GK Tools Ltd
• Registered Office: 483 Green Lanes, London, N13 4BS
• Company Number: 16434833
• ICO Registration: ZB899192
• Contact: support@gk.tools

For the purposes of UK GDPR, we are the "data controller" - meaning we decide how and why your personal data is processed.

2. What Data We Collect

The data we collect depends on how you interact with us:

When you contact us (email, contact form):

• Your name and email address
• Your mobile number, if you choose to give it (optional)
• Whether you would prefer a reply by email or WhatsApp
• Your country and preferred language, if you tell us (optional)
• The content of your messages
• For a message sent through a form on this website: the IP address it came from, kept with the message so we can stop spam and abuse

Messages sent through the forms on this website go straight into our own Service Desk, the system we use to answer every support request, so they sit with any earlier conversations you have had with us. If the Service Desk cannot be reached at that moment, the message is emailed to support@gk.tools instead.

When you use Invoicer (our invoicing application):

• Account details: name, email, password (encrypted), business name, address
• Client/customer information you add (names, addresses, contact details)
• Invoice and quote data you create
• Payment information (processed securely by Stripe - we don't store card details)
• Session data to keep you logged in

When you use our hosting services:

• Account and billing information
• Technical data needed to provide the service

3. Why We Collect Your Data

We only collect data when we have a good reason:

• To provide our services: We need your account info to let you use Invoicer, and your client data to generate invoices for you.
• To communicate with you: Responding to support requests, sending important service updates.
• To process payments: If you have a paid subscription, we need billing details.
• Legal obligations: We're required to keep certain financial records for HMRC.

4. Legal Basis for Processing

Under UK GDPR, we process your data based on:

• Contract: Processing necessary to provide services you've signed up for.
• Consent: Where you've explicitly agreed (e.g., opting in to marketing emails).
• Legal obligation: Where we're required by law (e.g., tax records).
• Legitimate interests: Where we have a genuine business need that doesn't override your rights (e.g., responding to your enquiries, improving our services, preventing fraud).

5. Who We Share Data With

We don't sell your data. Ever. We only share data with:

• Stripe: Our payment processor. They handle card payments securely. Stripe's Privacy Policy
• Microsoft 365: We use Microsoft for email. Messages you send us are stored in their systems. Microsoft's Privacy Statement
• Our hosting provider: Your data is stored on servers they manage in the UK.
• HMRC: We're legally required to share certain financial information for tax purposes.
• Google (reCAPTCHA & Maps): We use Google reCAPTCHA to protect our contact form from spam, and an embedded Google Map on our contact page. Google may process limited technical data (such as your IP address) in doing so, including on servers outside the UK under the UK Extension to the EU-US Data Privacy Framework and standard contractual safeguards. Google's Privacy Policy
• Google Translate: Only if you use the language switcher. Nothing is sent to Google unless you choose a language — the page is not translated by default. If you do, Google receives the page content to translate it and sets its own googtrans preference cookie. Google's Privacy Policy
• Google Analytics: Only if you accept our cookie banner. We use it to understand site traffic, with IP anonymisation switched on. See Section 10 for what it sets and how to opt out. Google's Privacy Policy
• Anthropic (Claude) and Google (Gemini), for suggested support replies: Only when one of our staff asks for help drafting a reply to your support request. We then send that conversation to Anthropic or Google through their paid business services: its subject and reference, the messages in it, your first name and the names of any attachments (never the attachments themselves). They send back a suggested reply, which a member of our staff reads and edits before anything reaches you; nothing is sent to you automatically. Under their commercial terms neither may use your messages to train their models. They may process the data in the US, under their data processing terms and the UK Extension to the EU-US Data Privacy Framework or standard contractual safeguards. Anthropic's Privacy Policy · Google's Privacy Policy

All our service providers are UK-based or operate under UK data-protection safeguards (including the UK Extension to the EU-US Data Privacy Framework where applicable).

6. Where Your Data Is Stored

Your data is stored on secure servers in the United Kingdom. We use encryption (SSL/TLS) to protect data in transit, and access to our systems is restricted to authorised personnel only.

Email is processed through Microsoft 365, which may store data in Microsoft's UK or EU data centres.

7. How Long We Keep Data

• Account data: For as long as your account is active, plus 90 days after closure to allow for reactivation or to handle any disputes.
• Invoice/financial records: 7 years (as required by HMRC).
• Support correspondence: 3 years from last contact.
• Email open and click records: the IP address and app or browser details for 90 days; that an email was opened or clicked stays with the email.
• Marketing enquiries: Until you ask us to delete it.

We don't keep data longer than necessary. When data is no longer needed, we securely delete it.

8. Your Rights

Under UK GDPR, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate data.
• Erasure: Ask us to delete your data (where we don't have a legal reason to keep it).
• Restriction: Ask us to limit how we use your data.
• Portability: Request your data in a machine-readable format.
• Object: Object to certain types of processing.
• Withdraw consent: Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, email support@gk.tools. We'll respond within one calendar month (usually much sooner).

9. Security

We take security seriously:

• SSL/TLS encryption on all our sites and applications
• Passwords are hashed (we can't see them)
• Regular security updates and patching
• Access controls and logging
• Regular backups stored securely

No system is 100% secure, but we do our best to protect your data.

10. Cookies

Matomo (always on, no cookies, no consent needed)
We use Matomo, a self-hosted, open-source analytics platform, to understand how visitors use our website. Matomo runs entirely on our own infrastructure in the United Kingdom — your analytics data is never shared with third parties or sent abroad. We do not set any Matomo cookies on gk.tools. The last two octets of your IP address are discarded before storage.

Google Analytics (only if you accept the cookie banner)
When you first visit gk.tools you'll see a cookie banner. If you click Accept, we also load Google Analytics (GA4) alongside Matomo, so we can see aggregate traffic trends. Google Analytics is not loaded, and sets no cookies, until you accept — if you click Reject, or close the banner without choosing, only cookieless Matomo runs. IP anonymisation is switched on in our Google Analytics configuration. You can change your mind at any time by clearing the gk_cookie_consent cookie in your browser, which brings the banner back on your next visit.

Other GK Tools products
Each product in the GK Tools family runs as a separate site with its own privacy policy describing the cookies and tracking specific to that product:
• Invoicer — invoicer.gk.tools/privacy-policy
• Gravity Host — gravityhost.co.uk
All GK Tools products that use analytics use the same self-hosted Matomo described above — no third-party analytics tools, no cross-product profiling.

Emails we send you
Some emails we send you (replies to your support requests, licence keys, receipts and team invitations) contain a tiny image and links that pass through core.gk.tools on the way to their destination. When you open one of these emails or click a link in it, we record that it happened, when, the app or browser used and your IP address (stored encrypted), so we know our reply reached you. The IP address and app or browser details are deleted after 90 days; the fact that the email was opened or a link clicked, and when, stays with the email record. We do not use this for advertising or to build a profile of you, and it is never shared. If your mail app blocks images, opens are not recorded; links work the same either way. Lawful basis: our legitimate interest in knowing that our emails arrive.

Payment Processing
When you make a payment, Stripe (our payment processor) may set cookies to process the transaction securely. These are set by Stripe, not by us. See Stripe's Cookie Policy.

Opting out
You can opt out of Matomo analytics on gk.tools by ticking the box below. We’ll store that preference locally in your browser and stop tracking you on future visits. (Untick to re-enable.)

11. Children's Privacy

Our services are designed for businesses and are not intended for anyone under 18. We don't knowingly collect data from children.

12. Changes to This Policy

We may update this policy from time to time. The "Last Updated" date at the top will reflect any changes. For significant changes, we'll notify you via email or a notice on our website.

13. Complaints

If you're unhappy with how we've handled your data, please contact us first at support@gk.tools - we'll do our best to sort it out.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113

14. Job Applicants

If you apply to work with us or send us your CV, through the form on our careers page or by email, whether for a role that is open or for one in the future:

• What we keep: What you tell us in the form (your name, email, phone number if you give it, the hours you would like and what you write about yourself), your CV if you send one, and the messages between us.
• Why: Only to consider you for roles at GK Tools. We don't use it for marketing.
• How long: We delete it 12 months after our last message with you, or sooner if you ask.
• Where it is held: In our own Service Desk. A CV you add through the private upload link goes there too. Anything you email us is also held in our Microsoft 365 mailbox (see Section 5).
• Sharing: We never share it with anyone outside GK Tools. If we ask for a suggested reply to you, the AI services in Section 5 see the messages as described there, never your CV.
• Your rights: You can ask to see it, or ask us to delete it, at any time by emailing support@gk.tools.