This policy explains how Michael Drapper, a sole trader trading as Cove Flow ("we") handles personal data. It covers two different roles we play, so it is worth knowing which one applies to you.
- If you are a venue, or visit this website, we decide how your data is used and are the controller. This policy describes what we do.
- If you booked with, or are a member of, a venue that uses Cove Flow, that venue is the controller of your data and we process it on their instructions. Their own privacy notice applies, and you should contact them first about your data.
What we collect
When you visit this website
Our servers record basic request logs (IP address, browser, the page requested and when) to keep the service secure. We do not use advertising or analytics cookies (see our cookie policy). If you send us a message, we keep what you write and the details you give us.
When your venue signs up
The names, emails and roles of your account owners and staff, your venue's business details, your subscription and billing history, and records of sign-ins and important changes, kept for security.
When Square is connected
We store the access tokens Square gives us, encrypted, so Cove Flow can take payments into your Square account. We never see or store full card numbers; Square handles them.
Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing the service and support to venues | Contract |
| Billing, accounting and tax records | Legal obligation |
| Keeping the service and accounts secure | Legitimate interests |
| Replying to enquiries and demo requests | Legitimate interests |
| Occasional product news to venues that use Cove Flow. Every email has an unsubscribe link | Legitimate interests |
Who we share it with
We never sell personal data. We use these service providers, each bound by a contract to protect it:
| Provider | What for | Where |
|---|---|---|
| DigitalOcean | Runs our servers and stores the database and its encrypted backups | Servers in London, UK. DigitalOcean is a US company, so any access from the US is covered by the UK International Data Transfer Addendum |
| Resend | Sends booking confirmations, receipts and account emails | United States, under the UK International Data Transfer Addendum |
| Square | Takes card payments for venues, under each venue’s own Square agreement | UK, EU and United States |
We may also share data where the law requires it, for example with HMRC or the police.
How long we keep it
- Venue account data: while the account is open, then 30 days after it closes.
- Billing records: 6 years, as UK tax law requires.
- Website enquiries: up to 2 years after we last spoke.
- Server logs: up to 30 days.
- Backups: rolling, overwritten within 35 days.
We do not make decisions about you by automated means alone, and we do not use your data for profiling.
Keeping it safe
Every venue's data is kept separate from every other venue's. Data is encrypted in transit, Square tokens are encrypted at rest, staff passwords are hashed, and only the person running Cove Flow can reach production systems.
Your rights
Under UK data protection law you can ask for a copy of your data, and ask us to correct it, delete it, restrict or object to how we use it, or move it to another service. Email support@drapper.com. We will reply within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.