Privacy Policy

1. Who we are

Pepperseed is UK-based booking software for independent service businesses. This policy is written with the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 in mind. For business-account information and information submitted directly to Pepperseed, the organisation responsible for deciding how that information is used is:

Our business customers use Pepperseed to offer their own services. For personal information a customer provides when booking with one of those businesses, that business will normally be the data controller and Pepperseed will normally process the information on its behalf. The business remains responsible for its own privacy information and lawful use of customer data. Pepperseed may separately use limited information where necessary to secure the platform, prevent abuse, comply with law and administer payments.

2. Information we collect

Business owners and account users

• name, email address, authentication and account information;
• business name, description, contact details, booking-page address, services, prices and availability;
• logos, cover images and other branding or public content you upload;
• subscription, billing and Stripe Connect account identifiers and status information;
• support enquiries, website-enquiry details and communications with Pepperseed;
• optional feedback about Pepperseed and, only where you actively grant permission, testimonial publication preferences and withdrawal records;
• notification subscription details, device label and browser information if push notifications are enabled; and
• technical, security and usage information such as timestamps, request information and pseudonymised abuse-prevention identifiers; and
• where you allow optional analytics, website page views, approximate acquisition information, device/browser information and interactions with selected Pepperseed pages and calls to action.
• where you allow optional analytics, bounded first- and latest-touch source, medium, campaign and landing-page categories linked through a 30-day first-party attribution token; and
• limited pseudonymous operational lifecycle milestones, such as account/business setup, activation, publication, first qualifying booking and subscription lifecycle.

Customers making a booking

• name, email address and telephone number;
• the selected business, service, date, time, price and booking status;
• payment arrangement, amounts paid or outstanding, refund status and payment-provider references; and
• optional verified appointment reviews and private ratings or comments about the Pepperseed booking experience; and
• technical identifiers needed to secure and complete a booking or prevent duplicate and abusive requests.

If you choose Allow analytics, we use Google Analytics 4 to understand traffic, acquisition, page use and selected conversion events, and Microsoft Clarity to understand appropriately masked behavioural patterns such as clicks, scrolling, heatmaps and session replays on Pepperseed's public website. We do not intentionally send names, email addresses, telephone numbers, customer notes, booking notes, passwords, payment details, authentication tokens or full customer records to either service. Google page-view measurement excludes URL query strings, Clarity's input and select-field masking remains enabled, and non-public application screens are explicitly masked for Clarity.

Imported reservations

Where a business imports existing reservations, Pepperseed stores the supplied contact and reservation details, source references and external payment status. An externally paid reservation is not a Pepperseed-collected payment. The importing business is responsible for the accuracy and lawful transfer of its records.

Commercial features, where enabled

Commercial is a separately enabled product area, not a feature of every Core booking. Journey requests can include pickup and destination addresses, times, passenger and luggage counts, booker and passenger contacts, flight information and optional practical journey instructions. Do not enter medical histories, diagnoses or other unnecessary sensitive information.

Commercial business workspaces can also hold personnel and vehicle information, including driver contacts, licence references, location information, photographs and internal operational notes. These private records are tenant-scoped; approved customer-facing profiles and images are separate. Businesses must provide their own privacy information and assess any sensitive-data processing before using these features.

Payment card details are entered into Stripe's payment interface. Pepperseed does not receive or store complete card numbers or card security codes.

3. How and why we use personal information

Where we rely on legitimate interests, those interests include operating and improving a secure booking service, communicating about requested services, preventing misuse and protecting Pepperseed, its business customers and booking customers. The relevant legitimate-interest assessments must be documented and kept under review; this policy is not evidence of a completed assessment.

We do not currently use personal information for advertising profiles or solely automated decisions that produce legal or similarly significant effects.

4. Who receives information

We disclose information only where it is needed to provide, secure or administer Pepperseed, or where law requires it. Recipients may include:

• the service business selected by a booking customer, which receives the booking and contact details needed to provide and manage its service;
• Supabase, for database, authentication and application infrastructure;
• Stripe, for Pepperseed subscription billing, connected-account onboarding and customer-to-business card payments. Stripe may act as a separate controller for some payment and compliance processing under its own privacy terms;
• Resend, for transactional email delivery;
• Vercel, for application hosting and delivery;
• Google Analytics 4, for consented website traffic, acquisition and conversion measurement;
• Microsoft Clarity, for consented heatmaps, interaction analytics and appropriately masked session recordings on public Pepperseed pages;
• browser or device push-notification services, but only where the business owner enables notifications; and
• professional advisers, regulators, courts or public authorities where reasonably necessary and lawful.

We do not sell personal information.

Verified business reviews may be visible publicly on the reviewed business's Pepperseed booking page. We shorten the reviewer's name and do not publish their email address, telephone number or booking reference. Private booking-experience feedback is visible only to authorised Pepperseed operators. Owner feedback remains private unless both the owner has granted publication permission and Pepperseed has approved it for use.

5. International transfers

Some suppliers may process information in, or make it accessible from, countries outside the UK. Where a restricted transfer occurs, we require an appropriate transfer mechanism, such as UK adequacy regulations or approved contractual safeguards, together with any additional measures considered necessary. Contact us if you would like more information about the safeguards relevant to your information.

6. How long we keep information

We keep information only for as long as reasonably necessary for the purpose for which it was collected. The period depends on the nature of the information, whether an account or booking relationship remains active, the business customer's instructions, security and dispute needs, and legal, tax or accounting requirements.

Token expiry does not delete the underlying booking, review or financial record. Our table-specific retention schedule and provider-copy procedures require approval; no universal automatic deletion period is claimed.

Account, subscription and transaction records may be retained after an account closes where needed to meet legal obligations or resolve claims. Booking and customer records are retained while needed by the relevant business and may be deleted or restricted in response to valid instructions or rights requests, subject to lawful retention needs. Push subscriptions are removed when disabled or identified as stale. Security and rate-limit records are kept for operational periods appropriate to their purpose.

Optional Google Analytics and Microsoft Clarity information is retained according to Pepperseed's configured account settings and the providers' applicable retention controls. Provider settings and deletion processes require periodic verification; this policy does not promise automatic deletion.

When Growth Funnel V1 is enabled after the required review, Pepperseed's first-party attribution cookie lasts up to 30 days. Unlinked attribution is deleted after no more than 31 days; linked attribution and limited operational growth milestones are deleted after 13 months. These periods do not govern separate account, booking, payment, security or provider records.

Unused review invitations expire after 30 days and booking-experience feedback links expire after 48 hours. Submitted reviews and business responses may remain while the relevant business uses Pepperseed and for a reasonable period afterwards for integrity, complaints and legal claims. Private product feedback requires a reviewed retention decision; there is not currently a universal automatic erasure process. Publication-permission and withdrawal records may be retained as evidence that a testimonial was used lawfully.

7. Security

We use access controls, tenant separation, encrypted connections, server-side validation, restricted administrative credentials, payment-provider controls and abuse protections designed to protect information. No online service can guarantee absolute security. Business owners must keep their login details secure, use a strong unique password and promptly tell us about suspected unauthorised access.

8. Your data-protection rights

Depending on the circumstances, UK data-protection law may give you rights to request access, correction, deletion, restriction, objection and portability, and to withdraw consent where processing is based on consent. These rights are not absolute and exemptions may apply.

You have the right to object to processing based on legitimate interests. Tell us about your circumstances and we will consider the request as required by law.

If your request concerns a booking, contacting the service business first is usually the quickest route because it normally controls that booking information. You may also contact Pepperseed and we will assist the business or respond where Pepperseed is responsible. We may need to verify your identity before acting.

You can withdraw analytics consent at any time using Cookie settings in the site footer. This stops future optional analytics collection, clears accessible Google Analytics and Clarity cookies where appropriate, and erases the matching optional first-party attribution record where it can be identified. It does not affect separate operational lifecycle records, essential authentication, payment or security storage.

A reviewer may ask Pepperseed to correct or remove personal information in a review, subject to review integrity and legal requirements. A business owner can withdraw testimonial publication permission from the Reviews area of the dashboard; withdrawal removes that feedback from the approved public marketing feed without deleting the private feedback record.

9. Questions and complaints

Contact info@pepperseed.co.uk with privacy questions or rights requests. Please give us the information needed to identify the relevant account or booking, but do not email card details or passwords.

If you are unhappy with our response, you can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. We would appreciate the chance to address your concern first.

10. Changes to this policy

We may update this policy when Pepperseed, our suppliers or applicable law changes. We will publish the revised version here, update the date above and provide additional notice where a change is material.