1. Who we are
Velixa App Ltd ("Velixa", "we", "us") is the controller for the personal data we collect about you when you visit velixa.co.uk, create a customer account, or operate a Merchant account on the platform. Velixa App Ltd is registered in England & Wales, company number 17185369, with registered office at Office 1168, 60 Tottenham Court Road, Fitzrovia, London, United Kingdom, W1T 2EW. For booking data that a Merchant collects through Velixa, the Merchant is the controller and Velixa is the processor — see the Data protection page.
2. What we collect
- Customer accounts: name, email, phone, hashed password, marketing preferences (per Merchant), login and security events.
- Bookings: service booked, date/time, staff member, price, payment status and the Merchant you booked with.
- Merchant accounts: business name, address, staff members, services, working hours, time-off, subscription billing details, and connected Stripe account ID (we do not see your Stripe credentials).
- Reviews and photos: any user-submitted content for moderation and public display.
- Technical: IP address, user-agent, session cookie, CSRF cookie, visitor-tracking events (HMAC-signed) and audit logs.
3. Lawful bases (UK GDPR)
- Contract — delivering the bookings, account features, and the Merchant subscription.
- Legitimate interest — security, fraud prevention, debugging, and aggregated analytics about how the platform is used.
- Consent — marketing emails from Velixa and from Merchants you have opted in to.
- Legal obligation — tax records, regulatory requests, fraud reporting.
4. How customer data is shared with Merchants
Your Velixa account is one global identity that works across the platform. When you book at a Merchant, only the data needed to fulfil that booking is shared with that Merchant: your name, email, phone, the booking, and the marketing preference you have set for them. Merchants cannot see your bookings at other Merchants, your marketing preferences for other Merchants, or your password. Customer-spend totals shown to a Merchant are calculated only from their own bookings with you.
5. Sub-processors
| Provider | Purpose | Region |
|---|---|---|
| Stripe Payments UK Ltd | Card payments & subscription billing | UK / EU |
| OpenAI, Inc. | Automated moderation of reviews and photos | USA (with UK GDPR safeguards) |
| SMTP / email provider | Transactional and (opted-in) marketing email delivery | UK / EU |
| Hosting provider | Application hosting and database | UK / EU |
An up-to-date sub-processor list is available on the Data protection page.
6. Marketing
We only send marketing emails where you have given explicit, recorded consent, and we maintain an audit log of opt-in/opt-out events with timestamp, IP and source. You can withdraw consent at any time from Marketing preferences or via the unsubscribe link in every marketing email. Transactional messages (booking confirmations, reminders, receipts, account security) are sent under contract performance and are not opt-out.
7. Payments
Card details are entered into Stripe’s hosted fields and never reach Velixa servers. Stripe is PCI-DSS Level 1 certified. See Stripe’s privacy policy.
8. Cookies
We use a small set of strictly-necessary first-party cookies (session, CSRF). We do not use third-party advertising cookies. See the Cookie policy.
9. Data retention
- Booking and payment records: 6 years (UK tax law).
- Marketing-consent logs: 3 years after consent ends.
- Visitor-tracking events: 13 months, then aggregated.
- Customer accounts: kept until you delete them — from the website at velixa.co.uk/account-deletion or by emailing [email protected]. Merchants delete from the dashboard under Settings → Business settings → Account info → Delete this account (owner only). Deletion removes personal identifiers and anonymises historic bookings to “Deleted customer”. See the full Account deletion page for what is kept and why.
- Merchant subscription records: kept for the life of the subscription plus 6 years.
10. Your rights
You have the right to access, rectify, port, restrict, object to, and erase your personal data, and to withdraw consent. Email [email protected]. You may also complain to the UK Information Commissioner’s Office (ico.org.uk).
11. Security
All traffic is encrypted with TLS. Passwords are hashed with bcrypt. Sessions use HTTP-only, SameSite cookies and CSRF tokens. Multi-tenant data isolation is enforced by middleware. Access to production data is restricted and logged.
12. Contact
Privacy enquiries: [email protected]. Postal: Velixa App Ltd, Office 1168, 60 Tottenham Court Road, Fitzrovia, London, W1T 2EW.
Last updated: April 2026