Last updated: 1st September 2026
This Privacy Policy explains how ArbHub LTD collects, uses, shares, and protects personal information when you use our website, app, and related services (together, ArbHub).
It is written to meet the UK GDPR and the Data Protection Act 2018. It should be read with our Data Processing Agreement at https://www.arbhub.app/data-processing-agreement, which covers data that customer organisations enter into ArbHub.
If you do not agree with this policy, please do not use ArbHub.
Who we are
ArbHub LTD is a company registered in England and Wales.
Registered office: 9 Elmcroft Crescent, Bristol, England, BS7 9NF
Company number: 14726285
ICO registration: ZB673550
Contact: info@arbhub.app
ArbHub is software for arboriculture and tree-work businesses. It helps customers manage quotes, invoices, jobs, clients, sites, risk assessments, method statements, incidents, toolbox talks, equipment, and related files.
Two roles: controller and processor
We act in two different roles.
When we are the controller. We decide how to use personal data about people who visit our website, create an account, buy licences, contact us, or receive our emails. That processing is described in this policy.
When we are the processor. If your organisation uses ArbHub to store staff, client, site, or job data, your organisation is the controller of that data and we process it on their instructions. That relationship is set out in our Data Processing Agreement. If you are a client or employee of an ArbHub customer and want to access, correct, or delete data they hold about you, please contact that organisation first. We will help them where we can.
Information we collect
Account and contact information
When you create an account, are invited to one, book a demo, or contact us, we collect information such as your name, email address, phone number, organisation name, and password (stored by our authentication provider, not in readable form).
Billing information
If you subscribe to a paid plan, we collect the information needed to manage the subscription, such as your name, email, organisation, plan, and payment status. Card numbers and card security details are collected and processed by Stripe. We do not store your full card number.
Customer-entered business information
As you use ArbHub, your organisation may enter information about staff, clients, properties, jobs, quotes, invoices, risk assessments, method statements, incidents, toolbox talks, equipment, photos, and other files. We host that data to provide the service. Your organisation is the controller of it.
Emergency medical and next-of-kin information
Organisations can optionally record next of kin and emergency medical details (for example allergies or conditions that would matter if someone is injured). This can be special category (health) data.
These fields are for emergency use. They are visible to everyone on that ArbHub account, including on the SOS screen, crew lists, and risk assessments. They are not a private medical record. People should only enter information they are willing for colleagues to see if they are hurt.
We only store this if someone in the organisation chooses to enter it. We do not require it to create an account. The organisation must have a lawful basis for recording it, including an Article 9 condition for health data.
Usage and device information
We collect information about how ArbHub is used, such as features used, pages viewed, approximate location derived from IP address, browser or app type, device information, and diagnostic data. This helps us operate, secure, and improve the product.
Location information
With permission, we may collect precise location (for example from a phone) to support site-specific features such as risk assessments, weather, or maps. You can refuse or turn this off in your device settings. Organisations may also store addresses and what3words references for sites and trees.
Marketing and advertising identifiers
Where you use our website or marketing pages, we may store cookie or click identifiers (for example Google Analytics and Meta) so we can understand how people find ArbHub and measure advertising. See Cookies below.
How we use information
We use personal information to:
provide, maintain, and support ArbHub
create and manage accounts, invitations, and permissions
process subscriptions and send billing-related messages
respond to enquiries and send service notices
improve and secure the product
measure website and advertising performance
comply with the law (for example tax and accounting)
We do not sell personal information.
Lawful bases
Where we are the controller, we rely on these bases under the UK GDPR:
Contract. To provide ArbHub to you, manage your account, and process payment.
Legitimate interests. To secure the service, prevent abuse, understand how the product is used, improve it, and respond to business enquiries, where this does not override your rights.
Legal obligation. To keep records required by law, such as billing records.
Consent. For optional cookies and marketing that require consent, and for optional precise location where consent is the right basis. You can withdraw consent at any time.
Where we are the processor, the customer organisation is responsible for its own lawful basis, including any Article 9 condition if it records health data.
Who we share information with
We share personal information with service providers who help us run ArbHub, and only as needed for that purpose.
Always used to operate the service
Google Ireland Limited / Google Cloud / Firebase — hosting, database, file storage, authentication, application processing, and backups
Stripe — subscription payments
Twilio SendGrid — transactional email, such as invites and notices
Used for product operation or improvement
Google Analytics — product and website analytics
Meta — conversion and advertising measurement (hashed identifiers where used)
Google Maps — addresses and map features
what3words — location references, when that feature is used
OpenWeatherMap — weather, when that feature is used
Kindwise / plant.id / mushroom.id — species identification from photos, when that feature is used
Only if your organisation connects them
Intuit (QuickBooks) — accounting sync
Jobber — job and client sync
We may also share information if the law requires it, or if ArbHub LTD is involved in a merger, acquisition, or sale of assets, in which case we will take reasonable steps to keep the information protected.
A fuller list, including typical locations, is in our Data Processing Agreement: https://www.arbhub.app/data-processing-agreement
Where information is stored
The main database is hosted in Google’s Europe multi-region (Belgium and the Netherlands). Application processing runs in London.
Some providers may process information in the UK, the EEA, or other countries. Where we transfer personal data outside the UK, we use a lawful mechanism, such as a UK adequacy regulation (including the UK’s arrangements for the EEA) or standard contractual clauses / the UK international data transfer tools.
How long we keep information
We keep account and billing information for as long as you have an account, and then for as long as we need it for support, tax, or legal reasons.
Customer-entered data is kept for the life of the organisation’s account. When an account ends, we delete that data from live systems, or return a copy if the customer asks within 30 days. Residual copies in backups drop out of the backup cycle and are not kept longer than 90 days after deletion from live systems, unless the law requires a longer period.
An account that is only archived or marked inactive is not deleted until the customer asks for deletion or the account is fully closed.
Security
We take the security of personal information seriously. Customer data is hosted on Google Cloud / Firebase, which encrypts data in transit and at rest. Access to organisation data is limited to people in that organisation, plus a small number of ArbHub staff when needed for support, security, or legal reasons. The database is backed up daily.
No method of transmission or storage is completely secure. We cannot guarantee absolute security.
You are responsible for choosing a strong password, keeping login details safe, and deciding who you invite to your account.
Your rights
Under the UK GDPR you have the right to:
access the personal information we hold about you
correct inaccurate information
ask us to delete information, in certain cases
object to or restrict our processing, in certain cases
receive a copy of information you provided to us, in certain cases (data portability)
withdraw consent, where we rely on consent
To exercise these rights where we are the controller, email info@arbhub.app. We will respond without undue delay, and within one month where the law requires it.
If we hold the information only as a processor for an ArbHub customer, we will direct you to that organisation or help them deal with your request.
You also have the right to complain to the Information Commissioner’s Office (ICO): https://ico.org.uk. We would welcome the chance to put things right first.
Cookies
Our website uses cookies and similar technologies for essential operation and, where allowed, for analytics and advertising. You can control non-essential cookies through the cookie banner and your browser settings. See our Cookie Policy for more detail.
Children
ArbHub is a business product. It is not directed at children, and we do not knowingly collect personal information from anyone under 16.
Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version on this page and change the date above. For material changes we may also notify you by email or in the app.
Contact us
Questions about this policy or our privacy practices: info@arbhub.app
ArbHub LTD, 9 Elmcroft Crescent, Bristol, England, BS7 9NF
ICO registration: ZB673550