SOOF legal
Privacy Policy
Last updated: 20 September 2026
Who operates SOOF
SOOF is a software service operated by Dextericy Ltd (company number 17461625), a company registered in England and Wales whose registered office is in NW4, London. For account administration, security, service improvement and direct enquiries, Dextericy Ltd is the data controller. Contact us at hello@soof.co. Where a customer enters personal data about its workers, clients or other contacts into SOOF, that customer is normally the controller and Dextericy Ltd processes that data on its instructions.
Information we process
Depending on how SOOF is used, we process account and contact details; company, worker and client records; authentication and security records; site, job, scheduling, document, inspection and compliance information; invoices, payment status and accounting identifiers; support communications; and technical information such as timestamps, broad device and browser class, IP-derived country or region, and service logs. Customers decide what operational information they enter and must have a lawful basis for personal data they provide about other people.
Connected services
Connections to Xero, Stripe and Google Calendar are optional and initiated by an authorised user. SOOF receives and stores the account or organisation identifiers and encrypted OAuth access and refresh tokens needed to operate the connection. According to the features enabled, SOOF may import customer or contact details, send invoices and credit notes, exchange invoice and payment status, create Stripe checkout sessions, receive payment and refund events, or create and update assigned-job calendar events. We use connected-service data only to provide, secure and support the selected integration, not for advertising or sale. Users can revoke access with the provider or ask us to remove a connection; legal, security and audit records may remain where retention is required. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Why we use personal data and our lawful bases
We process account, service and integration data to perform our contract or take requested pre-contract steps; operational records on a customer's documented instructions; billing and legally required records to comply with legal obligations; and limited security, fraud prevention, support, service reliability and product-improvement data for our legitimate interests in operating a safe and useful service. We use optional website analytics only with consent. Where consent applies, it may be withdrawn at any time without affecting earlier lawful processing.
Website enquiries and analytics
If you contact us or request access, we use your name, work contact details and company information to respond and administer the request. With your consent, first-party website analytics may record page views, referring and campaign information, selected clicks, form conversion, pseudonymous visitor and session identifiers, timestamps, broad device or browser class, screen class, and country or region supplied by our hosting provider. We do not deliberately place passwords, failed credentials, precise location, payment-card details, form contents or sensitive operational records into marketing analytics. You may decline analytics or change your choice using Privacy settings in the website footer.
Who receives information
We disclose information only as needed to the customer that controls the relevant workspace; authorised users; hosting, database, authentication, email, support and security suppliers acting for us; the connected provider selected by the customer, including Xero, Stripe or Google; professional advisers; or regulators, courts and public authorities where legally required. Our current suppliers and their purposes are listed on the Sub-processors page. Each connected provider processes information under its own terms and privacy policy. We do not sell personal data.
International transfers
Some suppliers and connected providers may process information outside the United Kingdom. Where a restricted transfer occurs, we use an applicable UK adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with relevant risk assessments. Contact hello@soof.co for information about the safeguard applicable to a particular transfer.
Retention
We retain active-account and operational data for the customer relationship and then for a limited period selected according to contractual, legal, tax, dispute, security and backup requirements. OAuth tokens are deleted or made unusable when the applicable connection is removed, subject to short-lived backups and legal obligations. Website enquiries are retained while relevant to the request and relationship. Security and audit records are kept only for the period reasonably required to protect the service and investigate incidents. Customers may request deletion or export, but some records may be retained where law or legitimate legal claims require it.
Security
We use proportionate technical and organisational safeguards, including access controls, tenant separation, encrypted transport, encryption of stored integration tokens, restricted administrative access, logging and backups. No internet service can guarantee absolute security. Customers are responsible for their users, access permissions, lawful content and the security of devices and credentials used to access SOOF.
Your rights
UK data-protection law may give you rights of access, correction, erasure, restriction, objection and data portability. You may withdraw consent where processing relies on consent. The right to object applies particularly where we rely on legitimate interests or use data for direct marketing. To exercise a right, email hello@soof.co; we may need to verify your identity. If your information was entered by a SOOF customer, contact that customer first because it normally controls that record. We do not use personal data for solely automated decisions producing legal or similarly significant effects.
Complaints and changes
Please contact hello@soof.co first so we can investigate. You may also complain to the Information Commissioner's Office at ico.org.uk or by telephone on 0303 123 1113. We may update this policy as SOOF develops or legal and integration requirements change; the date above identifies the current version. Material changes will be communicated through an appropriate service notice where reasonably practicable.