Privacy Policy

Green Candle Digital Studio is the data controller for:

• Client account data (business owner and staff personal data)
• Platform usage data collected for security and service improvement

For End User personal data (name, email, phone, booking details collected during a booking), the Client (the business)is the data controller and Green Candle Digital Studio acts as a data processor on the Client's behalf. Clients are responsible for their own privacy notices to End Users.

Contact our data protection point of contact: [email protected]

We process personal data for the following purposes and legal bases:

We do not sell personal data. We share data only with the following sub-processors, each bound by data processing agreements:

We may disclose personal data to law enforcement, regulators, or courts where we are legally obliged to do so, or to protect the rights, property, or safety of Green Candle Digital Studio, our Clients, or others.

In the event of a business sale, merger, or acquisition, Client Data may be transferred to the successor entity. We will give reasonable notice and ensure equivalent protections are maintained.

Stripe, Resend, and Vercel are based in the USA. We transfer personal data to them under UK International Data Transfer Agreements (IDTA) or Standard Contractual Clauses (SCCs) approved under the UK GDPR adequacy framework. Supabase data is stored within the EU and does not involve a third-country transfer.

We retain personal data only for as long as necessary:

We use strictly necessary cookies only:

We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies. Under PECR and UK GDPR, a cookie consent banner is not required for strictly necessary cookies.

You have the following rights in relation to your personal data. To exercise any of them, email [email protected]. We will respond within one calendar month (extendable by two further months for complex requests, with notice).

• Right of access (Art. 15) — obtain a copy of the personal data we hold about you and information about how we process it.
• Right to rectification (Art. 16) — have inaccurate or incomplete data corrected.
• Right to erasure (Art. 17) — request deletion of your data where there is no compelling reason for continued processing. Note: we may retain data where legally required (e.g. financial records).
• Right to restriction (Art. 18) — request that we limit how we use your data in certain circumstances.
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format (applies to data processed by automated means on the basis of consent or contract).
• Right to object (Art. 21) — object to processing based on legitimate interests. We will cease unless we can demonstrate compelling legitimate grounds.
• Withdraw consent — where processing is based on consent, you may withdraw at any time without affecting the lawfulness of prior processing.

We will not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive.

We implement appropriate technical and organisational measures to protect personal data, including:

• TLS encryption in transit for all data
• AES-256 encryption at rest (Supabase managed)
• Row-level security (RLS) in the database ensuring multi-tenant isolation
• Access to production systems restricted to authorised personnel on a need-to-know basis
• Regular dependency and security reviews

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay, as required by UK GDPR Articles 33–34.

The Platform is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data about a child, please contact us immediately at [email protected] and we will delete it promptly.

We will post any updates to this page and update the "Last updated" date. For material changes, we will notify registered Clients by email at least 14 days before the change takes effect. Continued use of the Platform after that date constitutes acceptance of the updated policy.

If you have concerns about how we handle your personal data, please contact us first at [email protected]. If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office · Wycliffe House · Water Lane · Wilmslow · SK9 5AF
ico.org.uk/make-a-complaint · 0303 123 1113