Privacy Policy

This Privacy Policy explains how JTWI Ltd (trading as ServeBusiness)(“ServeBusiness”, “we”, “us”) collects, uses and protects personal data, in accordance with the UK GDPR and the Data Protection Act 2018. We are registered with the Information Commissioner’s Office (ICO) under registration [ICO registration number].

1. Our two roles

• As a controller, for the personal data of the business owners and staff who hold ServeBusiness accounts (your account, billing and usage data). We decide how that data is used.
• As a processor, for the personal data about your customers that you enter into or collect through the platform (e.g. names, contact details, bookings). You are the controller of that data; we process it on your behalf and under your instructions to provide the Service, as set out in our Terms and any data processing terms.

2. Data we collect

• Account & business data, name, email, phone, business details, and login credentials (passwords are stored hashed).
• Billing data, subscription and payment status. Card details are handled by Stripe; we do not store full card numbers.
• Your customers’ data, the customer and booking information you add to the platform (as processor, on your behalf).
• Usage & technical data, IP address, device/browser information, and activity logs used for security, diagnostics and improving the Service.
• Communications, messages you send us (e.g. support requests).
• Cookies, see our Cookie Policy.

3. How we use data & our legal bases

4. Who we share data with

We use trusted service providers (processors) to run the Service, including:

• Stripe, payment processing;
• Supabase, database and authentication hosting;
• Vercel, application hosting;
• Resend, transactional and marketing email delivery;
• The SMS Works, SMS delivery;
• Upstash, rate-limiting and caching.

We only share what is necessary and require providers to protect the data. We may also disclose data where required by law, to enforce our terms, or in connection with a business transfer. We do not sell personal data.

5. International transfers

Some providers may process data outside the UK. Where they do, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses. [Confirm each provider’s transfer mechanism.]

6. Retention & deletion

While your account is active, we retain your data so we can provide the Service. When your account ends (for example if you cancel), we keep the data you stored, including your customers’ details and bookings, for 2 months, so you have time to export anything you need. It is your responsibility to download your data within this window. After 2 months, we permanently delete that data from our live systems.

The only thing we keep beyond that 2-month window is a pseudonymised record of our own fee income from your account, with personal identifiers removed, which we retain for approximately 6 yearsto meet our own HMRC and legal obligations. Everything else you stored, including your customers’ details, bookings and your invoices, is permanently deleted. If you need to keep your own financial records for your tax obligations, please export them during the 2-month window.

You can request deletion of your data sooner by contacting hello@servebusiness.co.uk (subject to the fee-record exception above).

7. Your rights

Under UK GDPR you have the right to:

• access a copy of your personal data;
• rectify inaccurate data;
• erasure (“right to be forgotten”) in certain circumstances;
• restrict or object to certain processing;
• data portability;
• withdraw consent at any time (where processing is based on consent).

To exercise any right, contact hello@servebusiness.co.uk. If your request concerns data we process on behalf of a business (as processor), we will refer you to, or act on the instructions of, that business as the controller. You also have the right to complain to the ICO at ico.org.uk.

8. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and row-level security on our database. No system is completely secure, and you are responsible for keeping your credentials safe.

9. Children

The Service is not directed at children and is intended for use by businesses.

10. Changes

We may update this policy from time to time. We will post the updated version here and, for material changes, provide additional notice.

11. Contact

Data controller: JTWI Ltd (trading as ServeBusiness), 6 Bream, Tamworth, B77 1HR, United Kingdom. For any privacy question or to exercise your rights, email hello@servebusiness.co.uk.