Privacy notice

Hannah Swift, a sole trader trading as Laundro, is the controller responsible for Laundro's use of your personal information.

Email hello@laundro.co.uk for privacy requests, enquiries or complaints. You can also message us on WhatsApp, or call 07490 935948 by telephone or WhatsApp. We do not offer SMS messaging. Customer support operates Monday to Friday; we aim to reply within two working days. Privacy-rights response times are explained in section 8.

Business correspondence address: 16 Lodge Road, Bradford, West Yorkshire, BD10 0RF.

Collection and delivery only. Our premises are not open to customers. We cannot accept customer visits, laundry drop-offs or pick-ups.

We receive information you give us through accounts, bookings, forms, calls, email and WhatsApp, including:

• Your name, email, telephone number, account details and collection/return address.
• Services, quantities, prices, dates, instructions, authorised safe-place arrangements and order history.
• Payment, invoice, subscription, refund and dispute references/statuses.
• Enquiries, requested postcode-area alerts and relevant complaint evidence you supply.
• Website/session, basket and booking information; technical information processed by our hosting and website tools.

Supabase handles account authentication. Stripe handles card entry on its payment pages; Laundro's website does not collect full card numbers. We still receive relevant billing and transaction information. Never send card details, passwords or unnecessary sensitive information in booking notes, email or WhatsApp. We do not request diagnoses to assess laundry suitability. No routine garment or doorstep photography is currently used.

Essential contact, address and booking information is needed to arrange and fulfil a collection. Without it, we may be unable to provide the requested service.

We use information necessary to take requested pre-contract steps and perform your contract: managing accounts and bookings, checking coverage, collecting and caring for laundry, returning it, communicating about the service, and handling payments or refunds.

Selected customers can arrange regular services directly with us. Stripe supports manually arranged subscriptions and invoices, or automatic card payment where expressly agreed. There is no website subscription enrollment. A stored card alone does not authorise a new payment.

We rely on these lawful bases for the relevant purposes:

• Contract or your requested pre-contract steps: necessary account and booking details, coverage checking, collection, laundry care, return, factual service messages, payments and refunds.
• Legal obligation: necessary tax/accounting records and compliance with applicable legal requirements.
• Legitimate interests: protecting accounts and our service against misuse or fraud, keeping the website reliable, resolving enquiries and complaints, and establishing or defending legal claims. These interests must be balanced with your interests and rights. We use only the information necessary for the purpose.
• Consent: the optional website measurement and separate email/WhatsApp promotional choices you make. You can withdraw consent at any time without affecting earlier lawful processing or necessary service functions.

A request for a postcode-area alert is used to provide that particular requested information. We retain only the necessary preference/request and suppression evidence to honour your choices and demonstrate how they were obtained. We do not treat acceptance of this notice as blanket consent.

Factual booking confirmations, collection/return windows, changes, payment matters and support are service communications. They are separate from optional promotions.

We currently send no promotional campaigns. Optional promotions have separate, unticked choices for email and WhatsApp. You may choose either, both or neither without affecting booking. You can unsubscribe from promotional email or ask us to stop WhatsApp promotions. Withdrawal does not affect earlier lawful processing. Minimal suppression records help prevent unwanted future messages; a new booking will not automatically restart marketing.

A requested postcode-area availability alert is limited to that request, not automatic newsletter enrollment. You can withdraw the request. Reorder reminders, offers and abandoned-basket messages are promotional, rather than necessary administration of an existing booking.

Business-side access is currently limited to Hannah and the person helping her with collections and deliveries. Providers also process relevant information for their services:

Supabase

Accounts, profiles, orders, instructions, enquiries and notification records.

Stripe

Payments, manually arranged billing, transaction details and relevant order information.

Resend and IONOS email services

Resend sends website confirmation emails. IONOS hosts our business email and domain services; mailbox correspondence and internal order confirmations can include address, phone and instructions.

Google Calendar and private Discord channels

Scheduling and operational order details, including contact/address details, services, dates and instructions.

WhatsApp Business

Messages and calls you exchange with us; used on personal devices.

Postcodes.io

Our server submits the postcode for a coverage lookup, without your name, contact details or street address.

Vercel

Hosting and, if you opt in, the website-use and performance measurement described below.

Statsig

Server-side global feature settings using a shared service context, with possible aggregate operational counts and SDK error reports.

Providers do not all have the same role for every activity. Some process information on our instructions, while also handling information for their own service administration, security or legal purposes. Their notices explain those separate activities. For example, Stripe can act as a processor or controller depending on the activity; see Stripe's privacy policy.

Some processing or access takes place outside the UK. The following published provider information explains the relevant locations and transfer arrangements:

• Supabase: processes our account and booking records on our behalf. Our primary database is hosted in London, United Kingdom (AWS region eu-west-2). Supabase's international support and operations can involve Singapore, the United States and other locations. Its data-processing terms include Standard Contractual Clauses and a UK Addendum for covered UK transfers. Its data-residency and transfers FAQ explains why a London database does not keep every type of processing or access in the UK.
• IONOS: hosts our business email and provides our domain services. Its published data-processing agreement covers processing on customers' instructions and provides for processing in the UK or European Economic Area, with necessary processing elsewhere subject to applicable international-transfer requirements. This does not mean that every email recipient or external email service is in those locations.
• Resend: processes website email delivery on our behalf. Its data-processing terms identify primary processing in the United States and include Standard Contractual Clauses with the UK Addendum for covered UK transfers.
• Vercel: provides our website hosting and optional measurement. Its privacy notice and data-processing terms describe processing in the United States and other countries. Its published processor terms for Pro and Enterprise plans include Standard Contractual Clauses and a UK transfer addendum; its notice also explains its own controller activities.
• Statsig: provides server-side global on/off settings. These checks use a fixed shared service context; we do not supply customer accounts, email, roles, IP addresses, request headers or cookies for them. Individual feature-exposure logging and SDK diagnostics are disabled, but the SDK may still send aggregate check counts and operational error reports. This server configuration is separate from optional browser measurement. Statsig's privacy information describes international processing, including the United States, and its published data-processing terms include contractual transfer safeguards for the processing they cover.
• Google Calendar and Discord: hold operational scheduling and order information. Google's privacy policy describes processing on servers worldwide, and its transfer information describes transfer safeguards, including the UK Extension to the EU-US Data Privacy Framework. Discord's privacy policy describes storage and processing in the United States and other countries and its use of transfer mechanisms, including that UK Extension. A private calendar or channel does not mean the provider processes information only in the UK.
• WhatsApp Business: the app is provided to UK businesses by WhatsApp LLC in the United States. Its Business App privacy policy and linked privacy information explain its own processing and global operations, including Meta infrastructure. Its business data-processing terms cover customer contact information processed on a business's behalf, with a UK transfer addendum for the transfers it covers. WhatsApp also determines some purposes of processing, as explained in its privacy notice. We use the app on personal devices and have not configured a WhatsApp cloud backup.
• Postcodes.io: provides the public postcode API maintained by Ideal Postcodes, as described in its official documentation. Our lookup sends the postcode from our server rather than making a direct request from your browser.

You can use the links above to read the published safeguards or contact hello@laundro.co.uk for further information or a copy of the safeguards applicable to your information. Provider-wide information does not mean that every listed processing location or subprocessor receives your information.

Requested account/login, basket, booking and security functions use necessary technologies independently of optional measurement. Our cookie and device storage notice explains the relevant storage and your choices.

Optional website analytics and performance measurement remain off until you opt in. You can accept or reject optional measurement and change your choice through Cookie settings in the website footer. Website choices are separate from email/WhatsApp marketing choices.

We use the following purpose-specific retention schedule:

Routine Calendar events, private Discord order alerts and duplicate internal confirmation emails

Review monthly; remove routine copies older than 90 days after service completion, preserving relevant active complaint/dispute/legal evidence and necessary authoritative records. This is not automatic deletion on day 90.

Ordinary enquiry/support correspondence

12 months after closure, subject to ongoing instructions, active matters and justified evidence needs. Mixed WhatsApp conversations require selective review.

Necessary sole-trader tax/accounting records

Normally at least five years after the relevant tax year's 31 January submission deadline; longer where required by law or an enquiry.

Inactive accounts/saved contact details

Review after 24 months without meaningful activity or an order; give at least 30 days' factual notice before closure. Exclude active/upcoming/recurring services and unresolved payment/support. Keep necessary evidence separately.

Postcode-area requests

Up to 12 months after signup unless withdrawn/fulfilled sooner; remove routine contact details within 30 days after the requested alert. Keep only justified request/withdrawal/suppression evidence separately.

Necessary order/contract/claim evidence

A minimal, restricted record normally for six years after service, reviewed for need; longer only for an active claim, legal obligation or other documented reason. This is not a customer claim deadline or a rule to retain every message.

Technical and security records

Routine logs follow the relevant service's configured retention cycle. Keep information only while needed to operate, secure or diagnose the service. Preserve relevant extracts separately only for an identified fault, security incident, complaint or legal need; review them when the matter is resolved and apply the justified evidence period above where necessary.

Preference, consent and suppression evidence

Keep the current choice and the evidence needed while administering or relying on it. After withdrawal, retain only necessary evidence of the earlier choice or use for accountability or an actual complaint. Keep a minimal record of a suppressed email address or telephone number while needed to prevent its reintroduction into marketing; review that need when the relevant channel or marketing purpose ends. Do not keep the entire customer record solely for suppression.

Overlapping requirements are assessed separately; a six-year evidence period does not shorten a longer tax obligation. Privacy requests are assessed independently of routine account-closure notice. These periods and review criteria require routine review; they are not a promise that every provider automatically deletes every copy on the same date.

Where recovery backups are maintained, copies expire through the configured rolling recovery cycle rather than individual records necessarily disappearing immediately from every backup. Recovery copies are for restoring the service, not routine use or marketing. A restore must reapply relevant corrections, deletions and restrictions before the restored information is used again. We assess any separately retained legal evidence for necessity and restrict its use. Providers may also retain information for their own lawful purposes, as explained in their notices; this does not extend Laundro's purposes for using it.

Depending on the processing and applicable conditions, you can request access, correction, erasure, restriction or portability, and object to processing, including use based on legitimate interests. You can object to direct marketing and withdraw consent at any time.

Use the contact details above; no special form, legal wording or logged-in account is required. We may ask proportionate identity questions where necessary. We respond without undue delay, normally within one calendar month, applying lawful clarification or extension rules and explaining any permitted extension. Normal handling is free. The two-working-day support aim is not the substantive rights deadline.

Some necessary records may be retained for legal obligations or justified claims; we will explain applicable limits. Section 7 explains our retention periods and criteria, including technical records, recovery copies and preference evidence. You can ask us how these apply to your information.

If you are unhappy with how we handle your personal information, contact hello@laundro.co.uk or use our other contact details above. You do not need to use legal wording or a particular form.

We will acknowledge your complaint within 30 days, investigate appropriately without undue delay, keep you informed of progress and explain the outcome without undue delay. Our usual aim to reply within two working days still applies; 30 days is the complaint-acknowledgement deadline, not a promised final-resolution period.

This complaints procedure is separate from the response periods for privacy-rights requests in section 8. If a complaint also includes a request for access, correction or erasure, we will handle the applicable rights request alongside the complaint.

You can also complain to the Information Commissioner's Office.