Privacy Policy

What we collect

When you make a booking through Velkome, we collect your phone number and your name. There is no separate customer account. These details are attached to your booking only.

We may also hold your email address. It is optional. You can give it to us, or a shop that books you in over the phone may give it to us so we can send you the confirmation.

Why we collect it

We process your phone number and name under UK GDPR Article 6(1)(b) (contract performance). We use these details for three purposes:

• To create your booking
• To send you a booking confirmation, by WhatsApp or, when a shop books you in over the phone and gives us your email address instead of a mobile number, by email
• To send you a reminder the day before your appointment

These are transactional messages, not marketing. No opt-in or consent is required for any of them. We also keep an abuse-prevention record, described in the next section.

Keeping the booking page from being abused

Anyone can open a shop's booking page, and the phone number typed into it is not always the number of the person typing. To stop the page being used to send someone repeated unwanted messages, we keep a brief record of each confirmed booking (the phone number, the shop and the time) and cap how many confirmations one number can receive in an hour.

That record is deleted automatically after two hours. We do this under UK GDPR Article 6(1)(f) (legitimate interests): our interest is to protect people from unsolicited messages sent in our name, and to stop a shop's messaging costs being run up by someone who is not their customer.

The shop's own record of your visit

The shop can keep a short note on your booking for their own records, for example why an appointment was cancelled, or anything they need to remember for next time. If you do not turn up, that is recorded too. None of it is shown to you, sent anywhere, or shared with another shop. We do this under UK GDPR Article 6(1)(f) (legitimate interests): the shop's interest is to keep track of its own day. You can ask the shop to correct or remove any of it.

Paying a deposit to book

Some shops ask for a deposit when you book. If so, your card is collected and charged by Stripe, our payment processor, directly into that shop's own account — we never see or store your card details ourselves. We process this under UK GDPR Article 6(1)(b) (contract performance) — it is how the shop takes the deposit you agreed to pay when booking.

If you cancel, the deposit is refunded. If you do not turn up for your appointment, the shop keeps it. The shop can also choose to refund a kept deposit at their discretion. We hold a reference to the payment (never your card details) against your booking, for as long as the booking record itself is kept — see "How long we keep it" below.

If you own a shop: your billing information

Your billing name, billing email address and card details are collected and held by Stripe, our payment processor — never by us directly. Stripe processes this under its own privacy policy and data processing agreement. We hold only what Stripe tells us about your subscription: its status, and a reference we use to look it up.

We process this under UK GDPR Article 6(1)(b) (contract performance) — it is how we bill you for the plan you chose. New shops run free of charge for their first ten completed bookings; no card is charged until then. If ten bookings has not happened within 365 days of starting your trial, billing begins anyway at that point — whichever comes first.

Separately from your Stripe billing details, we hold your sign-in email address and — as a practitioner in your own shop — your contact details, covered in the next section.

Your own contact details as a practitioner

When you set yourself up as a practitioner — today, that's the shop owner during onboarding — we hold your name, your mobile number and your email address. Clients never see your mobile or email; they're for running your own account, not for anyone booking with you. We message your mobile via WhatsApp if a card payment fails or your trial is ending, and to send a one-time code confirming the number is really yours before your shop goes live — we record when that confirmation happened, not the code itself. Your email is where takings and receipts land — it's separate from the email you sign in with. We process these under UK GDPR Article 6(1)(b) (contract performance): they are what's needed to run the practitioner side of your account.

We keep these details for as long as your account is open. You can request deletion at any time — see "Your rights" below. Clients never see your email or mobile number. If you work at a shop, the owner can see it too — that's how they run their team; nobody outside the shop can.

To check that email address is really yours, we send a one-time confirmation link to it through Resend, who we use to deliver it. The link works for 7 days and then stops; the cap on how many links we'll send in a day self-clears within 24 hours either way. We keep no record of the link itself once it's used or expires — just the date you confirmed, on your own account. To stop that confirmation link being hammered by an automated script, we briefly count visits to it against the IP address they come from — never against you personally. We do this under UK GDPR Article 6(1)(f) (legitimate interests): protecting the confirmation link from abuse. As with the booking-address check below, the IP address is stored as a one-way hash, not in the clear, and the count is deleted automatically after 24 hours at the latest.

Going live also uses that same email, via the same Resend delivery: a one-time link, sent only when you ask for it, that works once and expires after 30 minutes — separate from, and shorter-lived than, the 7-day confirmation link above. It is offered alongside the WhatsApp code as a second way to finish going live; we process it under UK GDPR Article 6(1)(b) (contract performance), the same basis as the rest of this section.

Checking a booking address during shop setup

When you're choosing your shop's booking address during onboarding, we check whether it's already taken as you type. To stop that check being used to hammer our systems or to probe for other shops' addresses, we briefly count checks against the IP address they come from — never against you personally. We do this under UK GDPR Article 6(1)(f) (legitimate interests): protecting the booking-address check from abuse. The IP address is stored as a one-way hash, not in the clear, and the count is deleted automatically after 24 hours at the latest.

Visiting a shop's booking page

Every time a shop's booking page is loaded, we briefly count that load against the IP address it comes from, to stop the page being used to hammer us. We do this under UK GDPR Article 6(1)(f) (legitimate interests): protecting the booking page from abuse. As with the booking-address check above, the IP address is stored as a one-way hash, not in the clear, and the count is deleted automatically after one hour at the latest. If the address doesn't match a live shop, the booking-address check above (up to 24 hours) applies to that visit instead.

How long we keep it

Booking records are retained for 24 months from the appointment date. After that period, your phone number, your name and any note the shop kept on your booking are anonymised. The booking row itself is kept for the shop's own analytics, but it can no longer be associated with you. If we hold your email address, it is kept with the booking on the same terms as your phone number and name.

The abuse-prevention record described above is separate and much shorter-lived; it is deleted automatically after two hours; the booking-address check and the confirmation-link check are each deleted after 24 hours at the latest, and the booking-page-visit check is deleted after one hour at the latest (up to 24 hours where the address didn't match a live shop yet). When a shop books you in by phone and gives us your email address, or you add your own address after booking, we keep a scrambled form of that address, never the address itself, to limit how many of these emails one address receives in a day (UK GDPR Article 6(1)(f), legitimate interests); it is deleted once it is more than two days old, the next time any email is counted for any shop or customer. Shop billing records are kept longer than 24 months; six years, the period we understand UK tax law requires records like these to be kept for (UK GDPR Article 6(1)(c), legal obligation), separate from the contract basis we bill you under.

Note: the 24-month period is an engineering placeholder reflecting reasonable utility for returning customers, and the six-year billing-records figure is our own understanding of the applicable tax rule. Neither has been confirmed by a solicitor. Both will be reviewed before Velkome operates at any significant scale. The 24-month anonymisation does not yet clear the payment reference held against a booking that took a deposit — this is a known gap, tracked internally, and will be closed before Velkome operates at any significant scale.

Understanding how Velkome is used

We keep count of things like bookings made and confirmations sent, so we can see what is working and what needs fixing. These counts are tied to a one-way code, never to your name, phone number, or email. Those are never sent. The information is held in the EU by PostHog, who process it only on our instructions.

We do this under UK GDPR Article 6(1)(f) (legitimate interests) to improve the service, and only ever with information that cannot be traced back to you.

For shop owners: connecting Stripe

If you connect an account to take card payments, the details you enter (your legal name, date of birth, address and bank account) go directly to Stripe, our payments partner. We never see or store this ourselves; the only Stripe details we hold are your connection status and account type. We ask for this under UK GDPR Article 6(1)(b) (contract performance): Stripe cannot verify a payout account without it. Stripe processes it under their own privacy policy.

Cookies and similar technologies

Card payments and fraud checks (Stripe)

We use Stripe to take card payments. Stripe's code (Stripe.js) runs on every shop's booking pages, whether or not that shop takes a deposit. It also runs on the pages where a shop owner pays for Velkome or sets up card payments.

While it runs, Stripe's code collects information about your device and how you use the page, and sends it to Stripe. This includes your IP address, your browser and device type, your screen size, and signals such as how quickly a form is filled in or whether a card number is pasted rather than typed. Stripe uses this information to detect and prevent fraud, including automated attempts to test stolen card numbers. Stripe may also run hCaptcha, a check that tells people apart from automated programs. It usually runs without you noticing, and occasionally asks you to complete a short puzzle.

Stripe's code stores these cookies on your device:

Why we do not ask for your consent to these cookies. The Privacy and Electronic Communications Regulations 2003 (regulation 6 and Schedule A1) allow a cookie to be stored without consent where it is strictly necessary to provide a service you have asked for. The law gives preventing or detecting fraud in connection with that service as an example. You can pay a deposit on a booking page, and a shop owner pays for Velkome on its billing pages. These cookies are how Stripe checks those payments for fraud. Stripe states that this information is not used for advertising, and is not sold, rented or given to advertisers.

Who is responsible for this information. When Stripe processes a payment, it acts on behalf of the shop or of Velkome. When Stripe uses this device information to prevent fraud, it decides how the information is used, so it is a separate controller and is responsible for that use under its own privacy notice.

Our lawful basis. We let Stripe collect this information on our pages under UK GDPR Article 6(1)(f) (legitimate interests). Our interest, and that of the shops, is to prevent fraudulent payments and card testing on booking and billing pages. UK GDPR recognises that processing strictly necessary to prevent fraud is a legitimate interest. Stripe relies on its own lawful basis for its use, which is explained in its notice.

Stripe's own notices. Stripe's privacy policy: stripe.com/privacy. Stripe's cookie policy: stripe.com/cookies-policy/legal. Each Stripe cookie and its lifetime: stripe.com/gb/cookie-settings.

Your rights

Under UK GDPR, you have the right to access, correct, or request deletion of your personal data. The current process is manual:

1. Contact the shop directly (via your booking confirmation message)
2. The shop owner will forward your request to Velkome
3. We will action the request within 30 days

If you cannot reach the shop, contact us directly at hello@velkome.app.

If you're a shop owner asking about your own account or billing information, email us directly at the same address — there's no shop to go through first.

Marketing

Velkome does not currently send marketing messages. If this changes, we will request your separate consent before sending anything. It will not be bundled into the booking confirmation process.

Contact

For any privacy-related question or data request: hello@velkome.app