Your privacy matters.

Controller and contact

Niall Patterson, trading as Heldly, is responsible for Heldly’s processing of your personal information. Contact hello@heldlypay.com about privacy or your rights.

Business correspondence address

What we collect and where it comes from

You provide account details, your chosen profile content, booking information, messages, support requests and any dispute evidence. A booking requester may provide the other participant’s name and optional email or phone number. Stripe supplies payment references, payment status and the payer email collected at checkout. Supabase supplies authentication and verification status. Hosting and security systems process technical request and security logs. Heldly does not store your plaintext password or full payment-card details.

Why we use information

We use account, booking and payment information to provide the service you request and perform our agreement with you. Our legitimate interests are preventing fraud and misuse, keeping the service secure, handling support and resolving disputes; this includes sending a booking invitation where another participant supplied your details. We use financial and audit records where needed to meet legal obligations. Optional navigation storage and visitor analytics use your separate consent. Public profile publication is an optional feature you request and can switch off. We do not use booking emails as marketing consent.

Optional visitor analytics

Only after you consent, Heldly measures general page views, referral website hostnames, visits, device/browser categories, screen-size bands and approximate countries. Random browser identifiers are separate from accounts and are not linked to your name, email or payment history. IP addresses are used transiently for local country lookup when configured and are not saved in analytics. Records are deleted after 90 days by a daily job. These are pseudonymous measurements, not guaranteed anonymous data. Use Cookie settings to withdraw permission and remove the identifiers; prior collected records expire under the retention schedule. See the Cookie policy for cookie lifetimes and contact us about your rights.

Private accounts and optional public profiles

Profiles are private by default. Other participants see information needed for a booking shared with them; authorised administrators can access information needed for support, payment operations and disputes. If you publish a profile, anyone can see your display name, services, location, photos, social links, public contact details and policies. The public page does not include your legal account name, account email, booking history, payment history or identity-review record. Choose a professional alias if you prefer. Making the profile private stops future public access through Heldly, but cannot recall copies already saved elsewhere.

Guest payments and booking links

You do not need an account to pay, but Stripe checkout requires an email address. We associate the payment with that email. If you later create an account and verify the same email, previous payments can appear in your account. A private payment link gives its holder access to the booking summary; protect it like an invitation and contact the requester if it has been shared incorrectly.

Service providers and sharing

We use SiteGround for website hosting and email delivery, Supabase for authentication, database and storage services, and Stripe for payment processing and payout onboarding. Stripe also processes information under its own privacy notice for its payment and verification services. Information may be shared with the other booking participant, authorised support/review staff, professional advisers or authorities where necessary and lawful. We do not sell your personal information. External websites linked from profiles have their own privacy practices.

Where information is processed

Heldly’s Supabase project is configured in Ireland. Providers may also process information through international support or subprocessors. Provider agreements and the applicable UK transfer safeguards must be confirmed before public launch; we cannot currently promise that all processing stays within the UK. Contact hello@heldlypay.com for information about the providers and safeguards relevant to your information.

Retention and deletion

Account information is needed while you use the service. Booking, payment, dispute and audit records may need to remain after account closure to resolve outstanding bookings, refunds or claims and meet financial or legal obligations. Retention decisions depend on the record type, outstanding matters and applicable obligations; a fixed retention schedule and routine deletion process remain to be finalised before public launch. A deletion request is reviewed and does not immediately erase financial records. We will explain any information we need to retain when responding to your request.

Optional identity verification

When enabled, Stripe Identity offers an optional ID-document and matching-selfie check. Stripe collects the images directly and explains its biometric processing and consent before capture. Heldly stores the verification reference, consent version, status and timestamps, not copies of the images or biometric templates. Authorised Stripe administrators may access verification information in Stripe. Your public alias stays unchanged; legal identity details are not published on your profile or bookings. You can decline verification and use Heldly without a badge, or withdraw in Settings to remove the badge and request deletion from Stripe. Processing checks must finish before deletion; Stripe says redaction can take up to four days. Unfinished checks are queued for deletion after 30 days, and closed or suspended accounts are queued for deletion by the scheduled worker. A minimal status record remains with your account. You may instead choose manual verification: Heldly privately stores your submitted legal name, ID photo and selfie for authorised administrators to compare. This manual route does not use automated facial recognition. Both images are queued for deletion after a decision, withdrawal or 30 days without a decision; the legal name and review outcome remain in the restricted account record. Admin email alerts contain no identity documents or legal names. Verification is not a background check or a guarantee of conduct. Stripe payout checks are separate. Do not email identity documents.

Your rights and choices

You can ask for access, correction, deletion, restriction or portability where applicable. Settings offers an account data download and a deletion-request option; contact hello@heldlypay.com for a complete access request, including if you paid as a guest. We may need proportionate proof that the information is yours. You can withdraw optional cookie consent through Cookie settings and unpublish your profile through Settings.

Your right to object

You can object to processing based on our legitimate interests by emailing hello@heldlypay.com and explaining your circumstances. We will consider your request and explain any grounds for continuing. You can object to direct marketing at any time; we do not currently use the booking email service for marketing.

Complaints and decisions

Contact hello@heldlypay.com if you are unhappy with how we use your information. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. Automated booking and payment rules apply the recorded terms; unresolved financial disputes require human review. Contact support if you believe an outcome is wrong. Required account or checkout information is necessary to provide those features; optional public-profile information is not required to hold a private account.