Privacy
What we hold, why we hold it, and what we will never do with it. In plain words, because a privacy notice nobody can read protects nobody.
Last updated 3 September 2026
Who holds your data
PocketPro is operated by DarkSolutionsUK (Ben Darlington), a sole trader trading from 19 Osier Court, Thornton-Cleveleys, FY5 4QS. For a business's own account details that operator is the data controller; for a business's customer list it is the processor, acting on the business's instructions. Data protection questions go to privacy@mypocketsalon.app.
Two kinds of person
This product has businesses — sole traders of every kind, from stylists to plumbers to tutors — and it has their customers, and the difference matters. A business is our customer. A business’s customers are the business’s — we hold their details on the business’s behalf and under the business’s instructions. In data protection terms the business is the controller of its own customer list and we are its processor.
What we hold about a business
Your name and email, which come from the account you sign in with. Your business’s name, trade, address, phone, opening hours, services and prices. Your branding. What you have taken, what we have charged and what has been paid out to you.
What we hold about a business’s customers
Whatever the business puts in: name, email, phone, booking history, notes the business writes, whether they have agreed to marketing, and — where the business uses them — patch test dates and signed forms. We store it so the business can run its diary. We do not use it for anything of our own.
Health information
Where a business uses consultation or patch-test forms, a form can ask about allergies, skin conditions, medication and pregnancy. That is health information, which the law treats as a special category. It is collected only when a business asks for it, only with the customer’s explicit agreement on the form itself, and it is held for the business alone — never used, shared or analysed by us. The signed form is kept as the business’s record. A business whose trade has no such forms holds no health information here at all.
Why we are allowed to
We hold a business’s account details because we have a contract with the business. We hold a customer’s booking details because the business needs them to provide what was booked, and we send the confirmation and reminder on the same basis. We keep records of payments because tax law says we must. We look for fraud in payments because it is in everyone’s legitimate interest that we do. Marketing to a customer happens only with that customer’s consent, and health information only with their explicit consent.
Card details
We never see them. Card numbers go straight to Stripe, who are the ones authorised to handle them; we receive back that a payment happened, for how much, and the last four digits. There is no card number in our database to lose.
What we send to a business’s customers
In the business’s name, never ours: a confirmation when they book, a reminder before the booking, and — only where the business records that the customer agreed to it — a note when a regular is overdue. That last one is marketing and carries a one-click unsubscribe. An unsubscribe is final and cannot be switched back on from inside the app.
What we never do
We do not market our own product to your customers. We do not sell or share your customer list. We do not let another business, or anyone who referred you, see your diary, your customers or your takings. A referrer sees the commission a business generated and nothing else about it.
Who else is involved
Stripe, for payments and payouts — card details go to them, not us. Google, whose mail service delivers the emails above. OpenAI, in the United States, which powers the assistant: when a business or a customer asks it something, the words of that question and the diary details needed to answer it are sent to OpenAI under their data-processing terms and the UK’s international transfer addendum, and are not used to train their models. Miluma, which publishes the social posts a business approves. Hetzner, who host the servers, in Germany. The sign-in service, which is run by the same operator under the Darks Games name. Each of them sees only what that job needs, and none of them may use it for anything else.
How long we keep it
A business’s data for as long as the business has an account. Records of payments for six years after the payment, because tax law requires it. Where a business uses consultation and patch-test forms, a customer’s signed forms for as long as the business instructs — three years after their last booking unless the business says otherwise, which is what their insurers ask for. Conversations with the assistant on our public pages for ninety days. Server logs for thirty days. When a business closes its account, everything else is deleted within thirty days.
Getting your data out
Settings has a Your data panel: customers, bookings and takings, each as a spreadsheet, downloadable whenever you like. There is nothing to request and nobody to ask. If you want your account deleted entirely, write to us.
Your rights
Under UK GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Write to privacy@mypocketsalon.app. If you are unhappy with our answer you can complain to the Information Commissioner’s Office at ico.org.uk.
Cookies
We use no advertising cookies and no third-party tracking. The app stores a sign-in token in your browser so you do not have to log in on every page, and remembers a referral code if you arrived through someone’s link. That is all.