Privacy Policy

1. Introduction

This Privacy Policy explains how William Brett-Atkin trading as Sway ("Sway", "we", "us") collects and uses personal data when you use our website, booking platform, and native mobile apps (iOS and Android) at https://www.usesway.co.uk, including public booking pages, embedded booking widgets, and business account areas (together, the "Service").

The Service is intended for users in the United Kingdom only at this time. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Who we are

William Brett-Atkin trading as Sway is the data controller for personal data we collect about business account holders and visitors to our platform, except where we act as a data processor on behalf of a business (see section 4).

Business address: Container E Lanteague, Scotland Rd, Zelah, Truro TR4 9JG. You can contact us about privacy at support@usesway.co.uk.

We are not VAT registered.

3. What this policy covers

• Business users who create a Sway account, subscribe to a plan, connect Stripe, manage staff, or operate a booking page — including via the Sway Business mobile app.
• Customers who browse, book, or pay for appointments with a business through Sway (website or customer app, when available).
• Visitors who contact us, use our marketing pages, or interact with support.
• This policy does not cover third-party websites linked from the Service (for example, a business's own site outside our embed).

4. Our role vs your business's role

When a customer books with a business through Sway, the business is generally the data controller for that customer's booking and service-related data. Sway provides the booking technology and, for that data, typically acts as a data processor processing personal data on the business's instructions.

When you create a Sway business account, subscribe, or use platform features, Sway is the data controller for your account and platform usage data.

Businesses using Sway should have their own privacy information for their customers and, where required, a data processing agreement with Sway covering customer booking data we store on their behalf.

5. Personal data we collect

• Identity and contact: name, email address, phone number (where provided).
• Account and profile: business name, description, address, postcode, images, public slug, staff details, team invites.
• Booking data: appointment times, service, staff member, customer name and email, optional notes, payment status and Stripe identifiers (we do not store full card numbers).
• Communications: messages sent through Sway between customers and businesses, and messages you send to our support team.
• Billing: subscription plan, Stripe customer and Connect account identifiers, payment and payout metadata.
• Technical: IP address, browser type, device information, and usage data collected through hosting and analytics (see section 12).
• Mobile apps: push notification device tokens (for example Expo push tokens) when you allow notifications; photos or camera images you choose to upload for business profile or service imagery.
• Optional location: latitude and longitude derived from UK postcodes you enter (via postcodes.io). We do not use device GPS location in our mobile apps.

6. How we use personal data

• Provide, operate, and improve the Service, including availability, calendars, payments, and notifications.
• Create and manage accounts, authenticate users, and prevent fraud or abuse.
• Process subscriptions and booking payments through Stripe (including via secure browser checkout from our mobile apps).
• Send transactional emails (for example booking confirmations and account messages) via our email provider.
• Send push notifications about bookings, messages, and support when you have granted notification permission on your device.
• Respond to enquiries and provide customer support.
• Comply with legal obligations and enforce our Terms of Service.
• Understand how the Service is used through privacy-oriented analytics (see section 12).

7. Lawful bases (UK GDPR)

We rely on different lawful bases depending on the processing:

• Contract: to provide the Service you or your business have signed up for, including bookings and payments.
• Legitimate interests: to secure and improve the platform, prevent misuse, and understand aggregate usage, balanced against your rights.
• Legal obligation: where we must retain or disclose data to comply with law.
• Consent: where we ask for your consent (for example optional marketing communications, if offered, or device permissions such as notifications, camera, or photo library). You may withdraw consent at any time, including by changing device settings.

8. Who we share data with

We share personal data with service providers who help us run the Service. They process data only on our instructions or as independent controllers under their own terms:

We do not sell your personal data. We may disclose data if required by law, court order, or to protect rights, safety, and security.

• Supabase — authentication, database, and file storage.
• Stripe — subscription billing and Connect payments for businesses.
• Resend (or configured email provider) — transactional email.
• Vercel — website hosting and Web Analytics.
• Expo / push delivery partners — delivery of push notifications to your device when enabled.
• postcodes.io — UK postcode lookup (postcode only).

9. International transfers

Some providers may process data outside the United Kingdom (for example in the United States). Where this occurs, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) and/or UK Addendum to EU Standard Contractual Clauses, as applicable, and provider contractual commitments.

10. How long we keep data

We keep personal data for as long as needed to provide the Service and meet legal, accounting, or dispute requirements. Business account holders may delete their business profile through account settings, which removes associated business data subject to backup and legal retention limits.

Booking records may be retained for a period after deletion where required for financial records, fraud prevention, or legal compliance.

Push notification tokens are kept while your account remains active and notifications are enabled, and removed or invalidated when you sign out, revoke permission, or delete your account.

11. Your rights

Under UK data protection law you may have the right to access, rectify, erase, restrict processing, object to processing, and data portability, subject to conditions and exemptions.

To exercise your rights, contact support@usesway.co.uk. If you booked with a business through Sway, the business may also hold your data — contact them directly for service-related requests.

You may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data lawfully.

12. Cookies and similar technologies

We use strictly necessary cookies and similar storage to keep you signed in, remember interface preferences (such as theme and sidebar state), and operate the Service.

We use Vercel Web Analytics to understand how pages are used. Vercel Web Analytics is designed to be privacy-friendly and typically does not use advertising cookies or cross-site tracking. Analytics data may include page views and referrers.

We do not use advertising or social media tracking cookies at this time. If we introduce non-essential cookies in future, we will update this policy and, where required, ask for your consent before setting them.

You can control cookies through your browser settings. Blocking necessary cookies may affect how the Service works.

13. Mobile apps

Our native apps (including Sway Business) use the same accounts and data as the website. In addition to the processing described above:

• Authentication: you sign in with email and password; session tokens are stored securely on your device.
• Camera and photo library: used only when you choose to take or select images for your business profile or services. You can deny or revoke these permissions in your device settings.
• Push notifications: if you allow them, we store a device push token to deliver alerts about bookings, messages, and support. You can turn notifications off in device settings at any time.
• Payments: subscription and Connect billing continue to use Stripe in a secure browser session; we do not process full card numbers inside the app.
• We do not use Apple App Tracking Transparency identifiers (IDFA) for advertising, and we do not sell mobile advertising identifiers.

14. Security

We implement appropriate technical and organisational measures to protect personal data, including access controls and encryption in transit. No method of transmission over the internet is completely secure; we cannot guarantee absolute security.

15. Children

The Service is not directed at anyone under 18. You must be at least 18 years old to create an account or use Sway. We do not knowingly collect personal data from children. If you believe a person under 18 has provided us data, contact us and we will take appropriate steps.

16. Sensitive information in booking notes

Optional booking notes are intended for scheduling information only. Please do not include health or other special category data unless the business has made clear it is necessary and lawful. Businesses are responsible for how they use information their customers provide.

17. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new 'Last updated' date. Significant changes may be notified through the Service or by email where appropriate.