Template. Fill in everything marked [like this] and have it checked before you take real customers. The ICO website has free guidance for small businesses.
Privacy notice
Last updated: 25 October 2026
Who we are
Apptronics is run by Mark McCormack, trading as Apptronics. Contact us about privacy at [privacy email]. ICO registration number: [number].
Two kinds of data, two roles
- Your account data. Your name, email, login and billing details as a business using Apptronics. For this, we are the controller.
- Data you put into Apptronics about your own customers and staff, such as bookings, phone numbers, loyalty cards, quotes and rotas. For this, your business is the controller and we are your processor. We only use it to run the service for you, as set out in our terms.
What we collect and why
| Data | Why | Lawful basis |
|---|---|---|
| Email address and password (stored only as a secure hash) | To create your account and let you sign in | Contract |
| Business name and settings | To run the app for your business | Contract |
| Billing details (handled by Stripe; we never see full card numbers) | To take subscription payments | Contract; legal obligation for tax records |
| Activity log (who changed logins, plans and deletions) | Security, and to help you investigate problems | Legitimate interests |
| Count of AI requests | To apply your plan’s monthly allowance | Contract |
Who we share it with
We use these service providers to run Apptronics. Each is bound by a data processing agreement.
- Supabase: database, logins and file storage, hosted in London (eu-west-2).
- Stripe: subscription payments.
- Anthropic: the AI features (Claude). Records are only sent when someone uses an AI feature. For example, the assistant reads a summary of bookings, orders, stock, loyalty customers and quotes to answer a question. Anthropic’s API doesn’t keep prompts or answers by default, and doesn’t use them to train its models without permission. It may keep flagged content for safety checks.
- Netlify: hosting the website.
- Supabase Auth: sign-up and password emails.
Some of these providers are based in the USA. Where data leaves the UK, it is protected by the UK–US Data Bridge where the provider is certified under it, or otherwise by the UK International Data Transfer Addendum in that provider’s data processing agreement.
How long we keep it
- Account and business data: while your account is open. Deleting your business or account removes it from the live system straight away, and from backups within 30 days.
- Billing records: 6 years, because UK tax law requires it.
- Activity log: until the business is deleted.
Your rights
You can ask for a copy of your data, or ask us to correct it, delete it, restrict it or object to how we use it. Owners can download all their business data and delete their business or account from Team & settings in the app. For anything else, email [privacy email]. We reply within one month.
If your request is about a business that uses Apptronics (for example, a salon that holds your booking), please contact that business first. We will help them answer you.
You can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Security
We protect data with:
- Encrypted connections.
- Rules inside the database that keep each business’s data separate.
- Secret keys held only on our servers.
- An activity log of security-relevant changes.
- Regular backups.
If a breach could put people at risk, we will tell affected businesses without delay. Where the law requires it, we will also tell the ICO within 72 hours.
Cookies
Apptronics uses your browser’s storage only to keep you signed in and to remember which screen you were on. These are strictly necessary, so we don’t ask for consent. We don’t use advertising or tracking cookies.