Privacy Policy
Bukkit is run by Leslie John Tasker, a sole trader trading as Bukkit, of 2 Beresford Avenue, Wirral, CH63 7LS. Questions or requests: hello@bukkit.co.uk.
In short:we collect what’s needed to run bookings, nothing more. We don’t sell data and we don’t use advertising trackers. We count visits to the site without cookies and without identifying anyone. A shop’s customers belong to that shop.
Who's responsible for what
- If you run a shop on Bukkit, we’re the controllerof your account details: we decide how they’re used, and this policy covers them.
- If you book with a shop, the shop is the controller of your booking details, and we’re its processor: we hold and use them for the shop, on its instructions (see Schedule 1 of our Terms). For anything about your details, the shop is the first place to ask, but you can always write to us and we’ll help or pass it on.
What we collect, and why
Shop owners
| What | Why | Lawful basis |
|---|---|---|
| Your name, email, and your Google account’s name and email if you sign in with Google | Your login, and to contact you about your account | Contract |
| Your shop’s name, address, postcode, phone, hours, services, prices, team, photos and site | To run your shop’s bookings, site and directory listing | Contract |
| Your plan and billing (handled by Stripe; we see your plan, not your card) | To charge for Bukkit, and keep records the law requires | Contract; legal obligation |
| Technical logs (IP address, browser, times, errors) | To keep Bukkit secure, stop abuse and fix faults | Legitimate interests |
Customers booking with a shop (we process these for the shop)
| What | Why |
|---|---|
| Your name, email and phone | To make your booking and send your confirmation, reminders and any changes |
| Your bookings, visits, notes you or the shop write, and whether you turned up | So the shop can run its day, remember how you like it, and run its loyalty card |
| Reviews you leave, and waitlist requests | To show real reviews, and offer you a slot when one opens |
| A saved card, if the shop asks for one to hold your booking | So the shop can charge its no-show fee if you don’t turn up. Stripe keeps the card; we only keep its type and last four digits. |
Anyone visiting
If you search the directory, the postcode or town you type is looked up with postcodes.io to find shops near it. We don’t keep your searches. If you use “Use my location”, your browser asks you first, and your location is used only for that search.
Who we share it with
We use a small number of companies to run Bukkit. Each handles data only to provide its service to us, under a contract that protects it.
| Who | What they do | Where |
|---|---|---|
| Supabase | Our database, logins and photo storage | EU (Paris, France) |
| Vercel | Hosts the website and app, and counts visits to it (anonymously: no cookies, no personal data) | EU (Paris), with a worldwide network |
| Resend | Sends booking emails | USA |
| Stripe | Takes payments: our plans, and shops’ deposits and no-show fees. For payments, Stripe is also responsible for the data itself, under its own privacy policy. | UK, EU and USA |
| Only if you choose to sign in with Google or add a booking to Google Calendar | USA | |
| postcodes.io | Turns a postcode into a place on the map (postcodes only, nothing about you) | UK |
Where data is handled outside the UK, it’s protected by the safeguards UK law requires: the UK International Data Transfer Addendum to the EU standard contractual clauses, or the UK–US data bridge. We never sell personal data or share it for advertising. We’ll share it with the police or a regulator only when the law requires.
How long we keep it
- Shop accounts: while your account is open. When you close it, your shop and everything in it are deleted straight away; backups holding it expire within 30 days.
- Customers’ details:for as long as the shop keeps them. A shop can delete a customer at any time; their past bookings then stay in the shop’s books without their name or anything they wrote.
- Billing records: as long as tax law requires (currently six years), mostly held by Stripe.
- Technical logs: a short time, usually days, and never longer than 30 days.
Your rights
You have the right to:
- ask for a copy of your personal data;
- have it corrected if it’s wrong;
- have it deleted;
- limit or object to how it’s used;
- have it moved to another service, in a common format.
Email hello@bukkit.co.uk. We reply within a month, free of charge. If you booked with a shop, you can also ask the shop, who can download or delete your details from their desk.
If you’re unhappy with how we’ve handled your data, please tell us first. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, or 0303 123 1113.
Children
Bukkit isn’t meant for children to use on their own. Bookings for children, like a kids’ cut, should be made by a parent or guardian.
Keeping it safe
Everything travels over encrypted connections. Each shop’s data is walled off from every other shop’s, access is limited to what’s needed, and card details never touch our systems: Stripe holds them. If something ever goes wrong, we’ll tell the people affected, the shops concerned and the ICO where the law requires.
Changes to this policy
If we change how we use personal data, we’ll update this page and, if the change matters, email shop owners before it applies. The date at the top shows the last change.