Privacy notice

OrdoBook is operated in the United Kingdom by Josh Pickles, trading as OrdoBook. You can contact us about privacy or data protection at contact@ordobook.uk.

A salon or other business using OrdoBook normally decides why customer and booking data is collected and how it is used. That business is generally the data controller for those records, and OrdoBook generally processes them on its behalf.

OrdoBook is separately a controller for information used to operate our own service, such as business-account details, security and audit records, support communications, service administration and future billing records.

Depending on how you use OrdoBook, we may process:

• names, email addresses, telephone numbers and account identifiers;
• salon, team-member, service and availability information;
• booking details, appointment times, notes and booking history;
• login, device, security, audit and technical diagnostic information;
• emails and other communications sent through or about the service;
• support requests and correspondence with us; and
• subscription and billing information when paid plans are introduced.

OrdoBook does not currently provide customer-list imports or customer accounts. If these features are introduced, this notice will be updated before they are used.

We use personal information where necessary to:

• provide and secure booking, scheduling and account features;
• send booking confirmations, changes, cancellations and service messages;
• support salons and investigate faults, misuse or security incidents;
• maintain records, prevent fraud and enforce our terms;
• improve reliability and understand how the service performs; and
• meet legal, regulatory, tax and accounting obligations.

The lawful bases we rely on may include performance of a contract, legitimate interests, compliance with legal obligations and, where required, consent. A salon is responsible for identifying and communicating the lawful basis that applies to its own customer data.

We use trusted service providers to host and operate OrdoBook, including Supabase for database, authentication and storage services, Vercel for application hosting and Resend for transactional email delivery. They process information under contractual terms and only as needed to provide their services.

We may also disclose information where required by law, to protect rights or security, or as part of a business reorganisation. We do not sell personal information.

Some service providers may store or access information outside the United Kingdom. Where this happens, we use appropriate safeguards required by data protection law, such as an adequacy decision or approved contractual protections.

Booking and customer records are normally retained for up to 24 months after the most recent relevant booking or interaction. A salon may apply a different lawful retention period for its own records.

We may keep certain information for longer where needed for legal, tax, accounting, dispute-resolution, fraud-prevention or security purposes. Information is deleted or anonymised when it is no longer required.

We use access controls, encryption in transit, tenant-isolation controls, audit measures and other technical and organisational safeguards designed to protect personal information. No online service can guarantee absolute security.

Depending on the circumstances, you may have rights to access, correct, erase, restrict or object to the use of your information, and to receive certain information in a portable format. Where processing relies on consent, you may withdraw that consent at any time.

For booking information held for a salon, contact the salon first because it is generally the controller. You can also contact us at contact@ordobook.uk. You also have the right to complain to the UK Information Commissioner’s Office.

See our cookie notice for details of the essential technologies used by OrdoBook.

We may update this notice as the service develops or legal requirements change. The latest version will always be published on this page with its update date.