Privacy policy

Pillowcase is a business tool used by campsite owners and their staff. This policy explains how we handle the personal data of our customers (account holders and staff users) and visitors to our website. Where our customers store their own guests' data in the platform, they act as the data controller for that data and we act as their data processor under our [Data Processing Agreement].

Account data. Name, business email address, phone number, business name and address, login credentials, and role/permission settings: provided when you or your organisation creates an account.

Billing and payment data. Subscription plan, billing address, VAT number, and transaction history. Card details are collected and processed directly by our payment processor, Stripe; we never store full card numbers.

Booking and usage data. Records you create in the app (bookings, pitches, pricing, reports) and how you use the platform: features used, pages visited, actions taken.

Technical data and cookies. IP address, browser and device type, operating system, and analytics data collected via cookies and similar technologies (see Section 8).

Communications. Emails, support requests, and any feedback you send us.

We do not knowingly collect data from anyone under 18, and the service is not directed at children.

We process your data on the following legal bases under the UK GDPR and EU GDPR:

To provide the service (contract). Creating and managing your account, processing bookings and subscriptions, providing support, and sending service messages such as invoices and security notices.

To improve and secure the service (legitimate interests). Analysing usage to improve features, monitoring for fraud and abuse, securing our systems, and enforcing our terms. We balance these interests against your rights and you may object at any time.

To market to you (consent or legitimate interests). Sending product updates and marketing emails to business contacts. You can unsubscribe at any time via the link in any email or by contacting us.

To meet legal obligations. Keeping tax, accounting, and other records required by law.

We share personal data only with service providers who process it on our behalf under contract, including:

• Payment processing: Stripe (subscription and transaction payments)
• Cloud hosting: Vercel and Railway (hosting the platform and databases)
• Email: Resend (transactional and marketing email)
• Analytics: first-party usage analytics built into Pillowcase; we do not use a third-party analytics provider

We may also disclose data where required by law, to protect our legal rights, or as part of a business sale or restructuring (in which case this policy will continue to apply). We never sell your personal data.

Your data is stored in [the UK / the EEA / specify region]. Where a service provider processes data outside the UK or EEA (for example, a US-based provider), we rely on UK and EU adequacy decisions or Standard Contractual Clauses (with the UK Addendum where applicable) to protect it.

We keep account data for the life of your account and delete or anonymise it within [e.g. 90 days] of account closure, except where we must keep records longer, for example billing records are retained for [6/7] years for tax purposes. Analytics data is retained for 22 months.

Under the UK GDPR and EU GDPR you have the right to access your personal data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time (without affecting processing before withdrawal). To exercise any right, email support@pillowcase.io. We will respond within one month.

You also have the right to complain to a supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, your local data protection authority.

We use essential cookies (required for login and security) and, with your consent, analytics cookies that help us understand how the website and app are used. You can manage non-essential cookies through our cookie banner or your browser settings. [Link to full cookie policy / cookie table listing name, purpose, duration for each cookie.]

We protect your data with encryption in transit and at rest, access controls, and regular security reviews. No system is completely secure, but we notify affected users and regulators of any breach as required by law.

We may update this policy from time to time. We will post changes here and, for material changes, notify you by email or in-app notice.

Pillowcase, 44 Aberdeen Road, Islington, support@pillowcase.io

[If required: our EU/UK representative is [Name, address]. Needed if you are established outside the UK/EU but serve users there.]