Serveasy Privacy Policy

Last updated: 13/03/2026

This Privacy Policy explains how Serveasy ("us", "we", or "our") collects, uses, stores, and protects your personal data when you use the Serveasy platform (the "Service"). We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

The data controller responsible for your personal data is:

Serveasy
Email: seb@serveasyapp.com

2. Data Controller vs Data Processor

Serveasy operates in two roles depending on the data involved:

Data Controller: We are the data controller for account holder data (business owners who sign up to Serveasy). We determine the purposes and means of processing this data.
Data Processor: When businesses use Serveasy to manage their customers' bookings and data, we act as a data processor on behalf of the business (who is the data controller for their end-customers' data). Businesses are responsible for ensuring they have a lawful basis to input their customers' data into Serveasy.

If you are a customer of a business that uses Serveasy, please refer to that business's own privacy policy regarding how they handle your data. Any data subject requests relating to end-customer data should be directed to the relevant business in the first instance.

3. Information We Collect

We collect the following categories of personal data:

Account Data

Email address
Business name and address
Account preferences and settings

Staff Data

Staff member names and contact details (email, phone number)
Staff availability and service assignments
Service capability information

Booking and Customer Data

Customer contact information (name, email, phone number)
Booking details and preferences
Service delivery addresses

Location Data

Service delivery addresses
Latitude and longitude coordinates
Postal codes and city information

Technical and Analytics Data

Browser type and version
Pages visited and interactions (if analytics cookies are accepted)
Error and crash reports
IP address (anonymised where possible)

4. Lawful Basis for Processing

Under UK GDPR, we rely on the following lawful bases for processing your personal data:

Contract (Article 6(1)(b)): Processing account data, booking data, and staff data is necessary to provide the Service to you under our Terms of Service.
Legitimate Interest (Article 6(1)(f)): We process technical data for error monitoring and service improvement. We process location data to optimise service delivery. Our legitimate interest is to maintain and improve a reliable service.
Consent (Article 6(1)(a)): We process analytics data (via PostHog) only where you have given consent through our cookie banner. You may withdraw consent at any time.
Legal Obligation (Article 6(1)(c)): We may process data where required to comply with applicable laws or regulations.

5. How We Use Your Data

To provide and maintain the Service
To manage and coordinate service bookings
To assign appropriate staff to bookings
To facilitate communication between businesses and customers
To optimise service delivery routes and scheduling
To send booking confirmations and status updates
To notify you about changes to our Service
To provide customer care and support
To detect, prevent, and address technical issues
To analyse usage patterns and improve the Service (with consent)

6. Automated Processing

Our Service includes automated processing of data to:

Calculate staff availability and requirements
Automatically update booking statuses based on time
Send automated booking confirmations and updates
Process location data for service delivery

This automated processing does not involve profiling or automated decision-making that produces legal effects or similarly significant effects on individuals.

7. Data Sharing and Sub-Processors

We use the following third-party service providers (sub-processors) to operate the Service:

Supabase (database hosting and authentication) — stores account data, booking data, and all Service data. Data is stored in the EU/US. Supabase operates under Standard Contractual Clauses (SCCs) for international transfers.
PostHog (analytics) — collects anonymised usage data only if you consent to analytics cookies. Data may be processed in the US under SCCs.
Sentry (error monitoring) — collects error and crash data to help us fix bugs and improve reliability. Data may be processed in the US under SCCs.
Vercel (hosting) — hosts the Service. Requests are processed through Vercel's infrastructure. Data may be processed in the US under SCCs.

These processors only access personal data to the extent necessary to perform their services and are contractually obligated to protect your data.

We may also disclose your personal data where we have a good faith belief it is necessary to:

Comply with a legal obligation
Protect and defend our rights or property
Prevent or investigate possible wrongdoing in connection with the Service
Protect the personal safety of users of the Service or the public

8. International Data Transfers

Some of our sub-processors are based outside the UK. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including the use of Standard Contractual Clauses (SCCs) approved by the ICO, or transfers to countries that have received a UK adequacy decision. You may request a copy of the relevant safeguards by contacting us.

9. Data Retention

We retain your personal data as follows:

Account data: Retained for the duration of your account and deleted within 30 days of account closure, unless we are required to retain it for legal or regulatory purposes.
Booking data: Retained for up to 6 years after the booking date to comply with tax and accounting obligations.
Staff data: Retained for the duration the staff member is active in the system. Deleted within 30 days of removal by the business.
Analytics data: Anonymised analytics data is retained for up to 24 months.
Error monitoring data: Retained for up to 90 days.

10. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of access: You can request a copy of the personal data we hold about you (a Subject Access Request).
Right to rectification: You can request that we correct any inaccurate or incomplete data.
Right to erasure: You can request that we delete your personal data, subject to any legal obligations we have to retain it.
Right to restriction of processing: You can request that we restrict the processing of your data in certain circumstances.
Right to data portability: You can request a copy of your data in a structured, commonly used, and machine-readable format.
Right to object: You can object to our processing of your data where we rely on legitimate interest as our lawful basis.
Right to withdraw consent: Where processing is based on consent (e.g. analytics cookies), you can withdraw consent at any time. This does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us at seb@serveasyapp.com. We will respond to your request within one month. In complex cases, we may extend this by a further two months, but we will inform you of any extension within the first month.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. Cookies

We use the following types of cookies:

Essential cookies: Required for basic site functionality, authentication, and security. These cannot be switched off and do not require consent.
Analytics cookies (PostHog): Used to understand how visitors interact with the Service so we can improve it. These are only set if you give consent via our cookie banner. You can withdraw consent at any time by clearing your browser cookies or contacting us.

We do not use advertising or marketing cookies.

12. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS), access controls, and regular security reviews. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

13. Children's Data

Our Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us and we will take steps to delete such information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. For significant changes, we will make reasonable efforts to notify you via email or through the Service. We encourage you to review this policy periodically.

15. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how we handle your data, please contact us at seb@serveasyapp.com.