The Lads logo

Privacy Policy

Last updated: November 2026 · CruxAi Tech Limited

1. Data Controller

This Privacy Policy explains how CruxAi Tech Limited (“The Lads”, “we”, “us”, or “our”), registered in Drogheda, Co. Louth, Ireland, collects, uses, stores, and protects personal data when you access or use the-lads.com, including our homeowner marketplace, trade directory, and professional mobile quoting and invoicing tools.

For the purposes of the General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”) and the Irish Data Protection Acts 1988–2018, CruxAi Tech Limited is the Data Controller.

2. Personal Data We Collect

We adhere to strict data-minimization principles and only collect data necessary to provide our services:

  • Account & Identity Data: Mobile phone numbers and one-time password (OTP) verification records used for passwordless login.
  • Job Request Data: Service category requested, general location/town, job description details, media/photos (if uploaded), and proposed scheduling arrival windows.
  • Trade Quote & Invoice Data: Customer name, Eircode/address, line item descriptions, materials vs. labour splits (for Irish Two-Thirds VAT compliance), SEAI grant deductions, trade professional bank IBAN or payment handles, and signed acceptance records.
  • Professional Profile Data: Business trading name, business registration/tax numbers, registered phone numbers, trade qualifications (e.g. Safe Electric / RGI where applicable), and public showcase portfolios.
  • Technical & Log Data: Masked IP addresses, browser user-agent, rate-limiting counters, and transactional delivery statuses (e.g., SMS delivery receipts).

3. Legal Bases for Processing (Article 6 GDPR)

We process your personal data under the following lawful grounds:

  • Performance of a Contract (Art. 6(1)(b)): To deliver requested local trade matches, transmit job quotes, generate trade contracts/invoices, and send transactional SMS notifications.
  • Legitimate Interests (Art. 6(1)(f)): To secure our infrastructure, prevent spam, fraud, or directory spoofing, and ensure platform reliability.
  • Legal Obligation (Art. 6(1)(c)): To maintain required statutory tax and financial transaction records under Irish Revenue guidelines.
  • Consent (Art. 6(1)(a)): For non-essential analytics cookies, which you can grant or revoke at any time via our Cookie Settings.

4. Sub-Processors and Data Recipients

We partner with trusted, vetted infrastructure and service providers bound by Data Processing Agreements (DPAs):

  • Twilio Ireland Limited: Enterprise SMS routing and one-time passcode (OTP) verification.
  • Google Ireland Limited: Cloud Run hosting (europe-west1 region, Belgium/Frankfurt), Cloud SQL data storage, and Google Maps/Places API rendering.
  • Resend Inc: Transactional email delivery for quote notifications and customer support responses.
  • PostHog EU (Frankfurt, Germany): Privacy-focused product analytics (activated only with your consent; contact details, descriptions, and full Eircodes are never sent to analytics).

We never sell, rent, or trade your personal data to third-party advertisers or brokers.

5. Cookies & Tracking Technologies

Our website uses strictly necessary cookies (such as authenticated session tokens) to ensure basic security and function. Optional analytics cookies are only stored if you choose “Accept All” on our cookie banner.

For a detailed list of all cookies and to adjust your preferences at any time, please visit our dedicated Cookie Policy.

6. Data Retention Periods

  • SMS OTP verification tokens: Destroyed immediately upon verification (valid for max 10 minutes).
  • Technical security logs & IP counters: Retained for up to 30 days for incident analysis.
  • Quotes, Invoices & Job Contracts: Retained for up to 6 years in accordance with Irish statutory tax and Revenue audit retention obligations.
  • Closed Account Data: Deleted or anonymized within 30 days of a verified erasure request.

7. International Data Transfers

Our primary databases and cloud workloads operate within the European Economic Area (EEA). If a sub-processor processes data outside the EEA, we ensure adequate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

8. Your GDPR Rights

Under Articles 15–22 of the GDPR, you have the following enforceable rights regarding your personal data:

  • Right of Access: Request a copy of the personal data we hold about you.
  • Right to Rectification: Request correction of inaccurate or incomplete records.
  • Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data when no longer legally required.
  • Right to Restriction: Request that we suspend processing of your data in certain scenarios.
  • Right to Data Portability: Request transmission of your data in a structured, machine-readable format.
  • Right to Object: Object to processing grounded in legitimate interests.

9. How to Exercise Your Rights

You can exercise any of your data protection rights by:

  • Submitting an automated request via our Data Rights Portal.
  • Emailing our Data Protection team directly at dev@cruxai.ie with the subject line “Data Rights Request”.

We do not charge a fee for standard rights requests and will respond within 30 calendar days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Irish Data Protection Commission (DPC) at dataprotection.ie.