Privacy Policy

This Privacy Policy explains how Registered business name not published yet (“we”, “us”) collects, uses, and protects personal data in connection with Retavu (the “Service”). We comply with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations.

1. Who we are

We are the data controller for personal data about the business owners and staff who use the Service, the developers in our developer programme and the clients they sell websites to through it, anyone taking part in our referral programme, and visitors to our own website — and for keeping reviews to the rules and acting on spam reports (sections 7b and 7c). You can contact us at Contact address not published yet or Postal address not published yet. Our ICO registration number will be shown here once our registration is confirmed.

We have not appointed a Data Protection Officer. We are not a public authority, we do not monitor people on a large scale, and we do not process special category data on a large scale, so the law does not require one. Data protection questions go to the address above.

2. Controller vs processor

For personal data about the businesses and their staff who sign up, we are the controller. For personal data about a business’s own customers (for example, people who book an appointment), the business is the controller and we are its processor — we process that data only to provide the Service on the business’s behalf and under its instructions. The exceptions are keeping reviews to the rules and acting on spam reports, which we decide ourselves (sections 7b and 7c).

Where a business gives a member of staff a login, the split runs through the middle: we are the controller for the account itself (the sign-in details and login records, which exist on our terms), and the processor for everything the business decides about that person — their bookings, their days off, their earnings.

Stripe is different. It is not simply our supplier: for payments it acts as a data controller in its own right, under its own regulatory duties, and uses payment data for its own purposes such as fraud prevention. Its handling of your data is governed by Stripe’s privacy policy as well as this one.

3. What we collect

• Account & business data: your name, email, password (hashed), business name, address and contact details, and settings — and, if you turn on two-step sign-in, the key your authenticator app’s codes are checked against, held by Supabase, which runs our sign-in.
• Billing data: subscription plan and status, and payment records. Card payments are handled by Stripe — we do not store your full card number.
• Content: the website content, images, services, and messages you create.
• Your customers’ booking data (as processor): names, contact details and booking information your customers give when booking with you — and your marketing list, which is worked out in our own database from your bookings and any contacts you add yourself, leaving out anyone who said no or has unsubscribed.
• Your customers’ saved cards (as processor): where a service needs a card to book, the card is entered on Stripe’s own page and saved by Stripe — with the customer’s name and email — on the connected account the booking’s money would go to: the business’s, or a paid-directly team member’s. We keep only its brand, its last four digits and Stripe’s references to it — never the card number — with the fee terms the customer agreed to, so the fee can be charged if it applies.
• Your customers’ order data (as processor): where you sell products, the name, email, delivery address and order details of people who buy from you, so the order can be fulfilled and receipted.
• Reviews and tips: where a business asks its customers for reviews, the email that asks, the reviews written and what became of them, reports and disputes about them, and the tips customers leave — see section 7c.
• Referral programme data: if you take part, your contact email, your referral code, who you introduced, and what commission is owed and paid.
• Developer programme data: if you join as a developer, your name, email and payout details; and for each website you sell through it, your client’s name, business name and email, the agreement they were shown and accepted, and the IP address and browser they accepted it from — kept as evidence of the contract, the IP address and browser for two years.
• Notification settings: if you switch on notifications, the address your browser gives us for your device and the keys used to encrypt messages to it — or, in the phone app, the token Expo issues for your phone — and which business and role each is for.
• Account activity: a record of significant actions — who closed an account, restricted a customer, or removed a worker — kept so that such actions can be checked later.
• Fault diagnostics: when something breaks, the error and the technical detail around it. We do not choose what a crash captures, so we treat it as though it may contain personal data.
• Technical data: essential cookies only, plus one you’re asked about: if you arrive through someone’s referral link and choose to, we remember that link’s code for 12 months so they’re credited if you sign up. We use your IP address — and, when you ask for a sign-in link, your email address — to limit how often certain actions can be repeated, which is how we keep out abuse; each count is deleted within two days. When you sign in, the IP address and device of that session are recorded so you can see where you are signed in and sign out of any of them; they go when the session ends. We run no analytics, no tracking pixels, and no third-party monitoring of any kind. See our Cookie Policy.

4. How and why we use data (legal bases)

• To provide the Service and your account — performance of our contract with you.
• To take payment and manage subscriptions — performance of our contract and our legitimate interest in running the business.
• To secure and improve the Service and prevent abuse — our legitimate interests.
• To send service messages (e.g. billing, security, important changes) — performance of our contract.
• To comply with the law (e.g. tax and accounting records) — legal obligation.
• To run the referral programme and pay commission — performance of our contract with you.
• Where we rely on legitimate interests, those interests are: keeping the Service secure and free of abuse; being able to check afterwards who took a significant action on an account; diagnosing faults; keeping reviews honest; keeping the Service’s emails deliverable; and keeping evidence of the website sales made through our developer programme. We have weighed each against your rights, and you can object at any time (see “Your rights”).

No automated decisions with legal or similarly significant effects. We do not profile you, and no decision that significantly affects you is made by a machine alone. Restricting a customer’s online booking, marking a missed appointment and charging a fee are decisions made by a person at the business. A few things do happen automatically, by fixed rules rather than anyone’s judgement: the timed steps of the “this review is untrue” process (section 7c); stopping emails to someone who has marked them as spam (section 7b); limiting how many online bookings one email address can make in an hour; and ending a referral commission nobody claimed within its claim window (our Terms). You can ask for a person to look at any of these again, using the details below.

What you have to give us. The account details we ask for at signup are needed to provide the Service under our contract with you; without them we cannot open an account. Everything else is optional, and leaving it out only limits the features that depend on it.

5. Who we share data with (sub-processors)

We use a small number of providers to run the Service. Each processes data only on our instructions, under a contract that requires it to protect the data — with two exceptions: Stripe, for the reason given in section 2, and the push services run by browser makers, which your browser chooses, not us.

• Stripe — payments: our subscriptions, and your customers’ payments, which go straight to your own Stripe account (or a paid-directly team member’s). For much of this it acts as a controller in its own right (section 2).
• Supabase — database, sign-in and file storage.
• Vercel — hosting the website and app, and registering the domains you buy (in our name, not yours).
• Resend — sending email: account emails, booking emails and your campaigns.
• Anthropic — the AI features that draft a website design or an email. Only what you give that feature is sent — your business name, your description or goal, your design choices and your logo’s colours — never your customers’ details, and it is not used to train Anthropic’s models.
• Your browser’s push service — Google, Mozilla, Apple or Microsoft, depending on your browser, and only if you turn on notifications. It delivers the message to your device. The contents are encrypted with your device’s own keys, so the push service cannot read them; it sees only when a message is sent and how large it is.
• Expo, then Apple or Google — notifications to the phone app, only if you allow them on your phone. Unlike browser notifications these are not encrypted end to end: the text — which includes a customer’s name, what they booked and when, and, if an email to a customer couldn’t be delivered, that customer’s email address — passes through Expo (a US company) and then Apple’s or Google’s notification service to your phone. The app also checks Expo for updates, sending an identifier for your copy of the app.

We may also share data where required by law, to enforce our terms, or in connection with a business sale or reorganisation.

6. Where your data is held

Two things matter here and they are not the same: where the data physically sits, and which company we contract with. A provider can store data in one country and be a company in another, and both count.

• The database, logins and uploaded files are stored in Ireland, which UK law treats as protecting data to the UK’s standard. The company we contract with for them is in Singapore, and its support and operations company is in the United States, so staff there can reach the data when support or operations need it; pictures can also be delivered from servers around the world. Those transfers are covered by the standard contractual clauses, with the UK Addendum, in our agreement with them.
• The application runs in the United Kingdom (London). Our hosting provider is a US company, and its network delivers pages from servers around the world, so it is covered by the safeguards below.

Outside the UK. Stripe’s US company, our hosting and email providers, and Expo are in the United States. Each says it is certified under the UK Extension to the EU–US Data Privacy Framework, which UK law recognises as protecting data sent to the companies certified under it. Stripe, our hosting provider and our email provider also have standard contractual clauses with us, with the UK Addendum, so protection does not lapse if that recognition ends. Our AI provider is Anthropic’s Irish company, which processes the data on Anthropic’s systems in the United States under standard contractual clauses with the UK Addendum. You can ask us for a copy of any of these safeguards using the details below.

7. How long we keep data

We keep personal data for as long as your account is active and as needed to provide the Service, then for a reasonable period afterwards to meet legal, tax and dispute-resolution requirements, after which we delete or anonymise it. When you close your account, we wait 30 days in case you change your mind, then delete your logins and your team’s, your files, your website and your customers’ personal details, and clear your contact details — keeping your business name and the de-identified sales records, which are part of the accounts. If your subscription lapses instead, your site goes offline but nothing is deleted, so you can come back, until you close the account; a sign-up that was never finished is kept until it is finished or you ask us to remove it. Where we act as a processor, we handle data in line with the controlling business’s instructions.

Sales records — bookings and orders — keep the customer’s details for at most six years, because that is how long the law requires a business to keep its accounts. Sooner — when a business closes its account, or a customer removes their details or asks the business to — we blank the name, email, phone, notes and delivery address and keep only the financial record — the date, the amount and the payment reference, with nobody’s name on it — and after six years we do that by ourselves, whether or not anyone has asked. That financial record then stays, as part of the business’s accounts.

Saved cards are taken off the Stripe account they were saved on once 7 days have passed since the appointment, or sooner when no fee can apply, so they can never be charged again — and the customer record made at Stripe for the card, with the name and email saved on it, is deleted too, once no fee is waiting on it (Stripe keeps its own record of a card it has handled, and of any payment). Where no fee was charged, nothing about the card is kept once it is off; where one was, its brand and last four digits stay with that charge, and go with the customer’s other details. A customer who asks for their details to be removed while a fee they agreed to can still apply keeps their card on file until that window closes — we ask Stripe to clear the name and email saved with it straight away — and we keep only their email address, for telling them about that fee, until the window closes or a fee then waiting for their bank’s approval is settled.

Operational records are cleared automatically on a schedule: rate-limit counters within two days; fault diagnostics 90 days after the fault was last seen; email delivery records, spam reports and the “unseen bookings” marker after one year; our security and audit trail after two years; our own subscription invoices after seven years, because they are part of our accounts; and one-time codes, sign-in checks and other expiring tokens as soon as they expire.

Emails we have already sent are kept by our email provider, with whatever was in them — such as a name and appointment details — for 30 days after sending, and then deleted. Individual messages can’t be deleted sooner, and removing someone’s details from our own records doesn’t reach those copies, which is why we say so here rather than promising a deletion we cannot deliver.

7a. Booking data, blocking and self-service removal

When you book with a business through its booking site, that business controls your booking record (name, email, phone, notes, appointment details). Your confirmation email contains a private “Manage your booking” link which also lets you remove your personal details from that business’s past bookings and orders at any time after your visit (once nothing is still to come); anonymised records of the appointments (dates and amounts, with no personal details) are retained for the business’s accounts. If you have only bought from a business’s shop, there is no such link: ask the business, or us, and your details will be removed for you. Businesses can also restrict online booking for a specific email address (for example after repeated missed appointments). Where they do, that email address alone is retained for as long as the restriction lasts — this is necessary to enforce the restriction (legitimate interests), so a data-removal request does not lift it. It does not last forever either: an open-ended restriction is put back in front of the business for review after a year, and if you have asked us to remove your details it is capped at a year from that point and then deleted, so your removal request finishes in full. The record in our audit trail that a restriction was set or lifted, which names the email address, is kept for two years, like the rest of that trail.

Whether you attended is part of the booking record the business keeps. Nothing about a restriction is shared between businesses — being restricted by one has no effect on booking anywhere else, and no reason is ever disclosed to anyone. You can always contact the business directly to book, or to ask about a restriction you think is wrong.

7b. If you mark an email from us as spam

Every business on the Service sends its emails through the same email provider, so when you mark one of those emails as spam and your email provider tells us (most do; Gmail does not), we act on it straight away. If it was a business’s marketing, that business stops sending you marketing for good; everything else still reaches you, including booking confirmations. If you do it twice within 90 days, no business on the Service sends you marketing for the next 90 days. If it was an email about a booking or an order, we take that as you not wanting email from us at all and stop sending you any — confirmations and reminders included. The business whose email it was is told, so it can reach you another way, and any business you book with sees that it cannot email you, but never which business’s email it was.

We keep a scrambled code of your address, not the address itself, to do this, and the record of each report for a year. Our legal basis is our legitimate interest in respecting what you asked for and in keeping the Service’s emails deliverable for everybody. If you would like emails again, contact us using the details below.

7c. Reviews and tips

A business on the Service can ask its customers for a review after a visit, and a customer can leave a tip for the person they saw. Our Reviews Policy sets out the rules; this is what happens to the personal data.

• The email asking for a review. About two hours after an appointment ends — never overnight — the customer is emailed once, with a private link. It goes only to customers who booked on the business’s booking site (and, if the business chooses, only those who paid online), never to anyone who said no to that business’s emails or has stopped them, and every one carries a way to stop them. So that it reaches the person who booked, and only if they said yes, we keep our own copy of the email address, name and answer to the marketing question they gave when booking — apart from the booking, which the business can edit — and delete it once the email has gone or isn’t needed, at the latest a fortnight after the visit. We keep the record of the email, its link (scrambled) and the appointments it asked about for eight months.
• A review is shown publicly on the business’s booking site under the name its writer chose — their first name and initial, or “Verified customer” or “Customer” — never their email. The business can see who wrote it, because it already has the booking. Earlier versions are kept with it, for the record. It stays until its writer deletes it, it is taken down, or the business leaves the Service. One taken down is kept for two years, for the record — its writer can still see why, and delete it at any time. One taken down for good (by a court’s order, as fake, or by the “this review is untrue” process) can’t simply be posted again about the same person: we keep a scrambled code of the writer’s email address, made with a secret key and never the address itself, until the business leaves the Service — even if the writer deletes the review or removes their details.
• Checks for fake reviews. When a review is posted we compare the writer’s email and phone number with the business’s own, and check whether one card is behind several customers’ reviews, using a scrambled code of the card — never the card. A match is shown to our team, who decide what, if anything, to do. Nothing is decided automatically.
• Reporting a review. The business a review is about can report it from its dashboard: we keep the report, who made it and what it says, and delete it a year after it is decided. Anyone else can email us about a review, and we use what they send only to look into it. Reports made earlier from a booking site’s own “Report” link also kept any email address left with them and a scrambled code made from the reporter’s IP address with a secret key; those go with the report, on the same timetable.
• “This review is untrue”. If a business says a statement in a review is untrue, we email the review’s writer, who can take it down, or keep it up by giving their full name and postal address. Those go to the business only because the writer agrees, and the business may use them only to settle the matter or take it to court. We delete our copy 90 days after they are given, and keep only a record that the process happened. Parts of this run to a clock rather than a person, as the law that shapes it sets out: a case our team hasn’t looked at within two working days goes to the writer by itself; a review whose writer was emailed and didn’t answer by the deadline in that email (the end of the fifth day) comes down by itself, unless the words complained of have gone; and details nobody has checked within two working days go to the business. A writer whose review came down this way can ask us to look at it again, using the details below, and a person will.
• Tips are paid on Stripe’s own page, straight into the Stripe account of the person tipped — Stripe is a controller for the payment (section 2). We keep the amount and the date, and the customer’s name and email so the person tipped can see who it was from and a refund can be matched. The name and email go after two years, or straight away if the customer asks us to remove their details; the amount stays, as the person tipped’s record of their income. A tip that was started but never paid is deleted after a month.
• Removing your details from a booking (section 7a) deletes your reviews of that business, the record of the emails that asked for them, our copy of what you typed when booking and the email address on any report you made there, takes your name and email off any tip you gave, and sets your bookings there aside so you aren’t asked about them again. A bar on posting a review that was taken down for good stays, as the scrambled code above. A business removing your details at your request does not remove your reviews: you can delete each one from the link in the email that confirmed it, or ask us.

Who decides. The business decides whether to ask its customers for reviews and which of them, and is the controller for its customers’ bookings and the reviews about it; we send the email asking for its customers’ reviews on its behalf. We are the controller for keeping reviews to the rules — the reports, the “this review is untrue” process, the bars on posting again and the checks above — which we do under our legitimate interest in a review system people can trust.

8. Security

Among the measures we use:

• Every table in our database enforces access rules at the database itself, not merely in the application, and every query is scoped to a single business.
• The credentials capable of bypassing those rules exist only on the server and are never sent to a browser.
• Every action re-checks the caller’s permissions on the server, independently of what the screen offers them.
• Administrator accounts require a second factor to sign in, and business owners can turn on two-step sign-in: after the password, a code from an authenticator app on their phone.
• Sign-in codes, booking links and similar tokens are stored scrambled, never in a readable form.
• Card details never reach our systems at all; payment happens on Stripe’s own pages.
• Data is encrypted in transit, and encrypted at rest by our database provider.

No system is completely secure, but we work to protect your data, and we will tell you, and the regulator, about a breach whenever the law requires us to.

9. Your rights

Under UK data protection law you have the right to:

• access a copy of your personal data;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to certain processing;
• data portability;
• withdraw consent where we rely on it (for example, the referral cookie in our Cookie Policy).

To exercise these rights, contact Contact address not published yet. It is free, and we will respond within one month of receiving your request, or of receiving anything we reasonably need from you to answer it, such as confirming who you are or which data you mean. If a request is complex, or you make several, we may extend that by up to two further months, and will tell you within the first month. If your request concerns data where a business is the controller — its own customers’ data — we will pass you to that business and help it answer you.

If you booked an appointment with a business, you do not have to write to anyone: the confirmation email contains a private link that lets you remove your own details directly, once nothing is still to come. See section 7a. If you only bought from a business’s shop, or would rather not use the link, ask the business: it can remove your details from its dashboard.

You also have the right to complain to the regulator, the Information Commission (still known as the ICO): at ico.org.uk, by phone on 0303 123 1113, or by post to ICO Head Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester M1 7BL. We would rather you came to us first (section 9a), but you are not obliged to.

9a. Complaining to us

You can complain directly to us about anything we do with your personal data. Write to Contact address not published yet — there is no form to fill in and no particular wording needed. A complaint made any other way still counts, including by reply to one of our emails or on social media.

We will acknowledge it within 30 days, look into it properly, keep you posted if it takes a while, and tell you the outcome and our reasoning without undue delay. If you are unhappy with how we handle it, you can still go to the ICO.

10. Marketing

We send service messages — billing, security, important changes — which you cannot opt out of while you have an account, because they are part of providing the Service. We do not send marketing about our own product; if that ever changes, we will ask you first and give you a simple way out of every message. Marketing you send to your own customers through the Service is your responsibility as controller, including having their agreement (or another lawful basis) and honouring unsubscribe requests; every campaign carries a one-click unsubscribe, and we never send to anyone who has used it.

11. Children

The Service is for businesses and is not intended for children: you must be 18 or over to open an account. We do not ask anyone’s age, and we do not knowingly collect data from children for our own purposes. A business’s customers may include younger people, whose details a parent may give when booking; their data is that business’s to look after, as section 2 explains.

12. Changes

We may update this policy from time to time. We will post the updated version here and, for material changes, take reasonable steps to notify you.

13. Contact

Questions or requests? Contact us at Contact address not published yet or Postal address not published yet.