Privacy policy

1. Who we are and who is the controller

Anvul Ltd is a company registered in England & Wales, company number 17111703, with its registered office at 16 Radford Road, Stoke-on-Trent ST4 7DA. We build and host websites for local businesses and run the booking, orders and enquiries engine behind them, for a one-off build fee and a flat monthly fee.

Who the data controller is depends on how you reached us:

• If you are a business owner — you signed up on anvul.co.uk, used the wizard or the console, messaged our team, or pay us — Anvul Ltd is the data controller for your account, your billing and our messages with you.
• If you are a customer of a business whose site we run — you booked an appointment, placed an order, bought a gift card or sent an enquiry on that business's website — that business is the data controller. It decides how your details are used to serve you. Anvul Ltd acts as its data processor: we handle your details only to run the business's website, bookings, orders and reminders on its instructions, under written processor terms. Anvul remains the controller only for the underlying platform security logs and de-identified service analytics we need to run the platform itself.
• If you are just visiting anvul.co.uk, Anvul Ltd is the controller for the limited technical data described below.

You can reach our data protection contact at privacy@anvul.co.uk.

2. What personal data we collect

We collect only what we need to do the job you asked for.

From business owners (we are the controller)

From a business's customers (we are the processor)

When you book, order or enquire on a business's website that Anvul runs, we handle — on that business's behalf — the details you enter: typically your name and contact details (email and/or phone), your appointment or reservation (service, staff member, date and time), your order or gift-card details, any notes you add, and the reminders and confirmations sent to you. If you pay a deposit or buy a gift card, the payment is taken by Stripe and goes to the business's own Stripe account — Anvul takes no cut of it and never sees your full card number.

We do not deliberately collect special-category data (such as health or ethnicity). Please do not include it in free-text notes.

3. Why we use your data and our lawful basis

Under UK GDPR we must have a lawful basis for each use. Ours are:

• To provide the service you asked for — build and host your website, run bookings, orders, reservations and enquiries, deliver your leads to your dashboard, send confirmations, reminders and your review link, and take payment. Basis: performance of a contract, or the steps you asked us to take before one (your wizard brief).
• To process a customer's booking, order or enquiry for a business — as that business's processor, on its instructions. The business's own lawful basis applies to its use of your data.
• To run, secure and improve the platform — fraud prevention, security logging, and aggregated, de-identified service analytics. Basis: legitimate interest.
• To send you marketing — only where permitted, and you can unsubscribe at any time. Basis: consent (or the limited existing-customer email rule, with an opt-out in every message).
• Non-essential cookies and analytics — Basis: consent (PECR), captured through our cookie banner.
• To meet legal obligations — for example tax and accounting record-keeping. Basis: legal obligation.

Where we rely on legitimate interest, we have balanced it against your rights; you can object at any time (see "Your rights").

4. Who we share it with

We share the minimum needed, and we never sell personal data — and a business's leads and customer lists are never resold or shared with its rivals. Recipients can include:

• Stripe — our payment provider. It processes the business's £99 / £99-per-month payments to Anvul, and customer deposits and gift cards paid to the business's own Stripe account. Stripe is its own controller for the payment data it needs (see Stripe's privacy policy).
• Resend — our transactional email provider, which delivers sign-in codes, receipts, booking confirmations, reminders and review links on our instructions.
• Our cloud infrastructure providers — hosting, content delivery, database and file storage for the platform and the sites we run. They act only on our instructions under written terms.
• The business you booked with — if you are a business's customer, your booking, order or enquiry is delivered to that business; it is their customer relationship.
• An SMS provider — where a business has text reminders switched on, to deliver those texts.
• Authorities — where we are required to by law, or to establish, exercise or defend legal claims.

5. How long we keep it

We keep personal data only as long as we need it:

• Business accounts and site content — kept while your subscription is active. If you cancel, you can export your site and your data; we then delete or anonymise your account data within a reasonable period, except what we must keep (below).
• Billing and tax records — kept for up to six (6) years after the tax year they relate to, as HMRC requires.
• A business's customer data (bookings, orders, enquiries) — held on that business's behalf while it uses Anvul, and deleted or returned to the business when it leaves or instructs us to, subject only to the legal duties above.
• Signup briefs that never become a build — kept while we follow up and for a reasonable period afterwards, then deleted or anonymised.

When we erase a record at your request, we remove the details that identify you; where a residual record must be kept (for example in billing history), it is no longer linked to you by name wherever possible.

6. Where your data is stored

Our infrastructure stores data primarily in the UK and the European Economic Area (EEA). Some of our providers — including Stripe and Resend — process data in the United States. Where personal data leaves the UK/EEA, we rely on a UK International Data Transfer Agreement (IDTA) or Addendum, or the appropriate Standard Contractual Clauses, with additional safeguards where required.

7. How we protect it

We use encryption in transit (HTTPS), access controls, and tenant separation that keeps each business's data — and its customers' data — segregated from every other business's. Sign-in codes are short-lived and single-purpose; where any password exists it is stored only as a salted hash; sensitive actions are audit-logged. No system is perfectly secure, but we take technical and organisational measures appropriate to the data we hold.

8. Your rights

Under UK GDPR (Articles 15–22) you have the right to:

• Be informed — which is the purpose of this policy.
• Access — get a copy of the data we hold about you (Art 15).
• Rectification — have inaccurate data corrected (Art 16).
• Erasure — ask us to delete your data, subject to the retention duties above (Art 17).
• Restriction — ask us to pause processing while a query is resolved (Art 18).
• Portability — receive your data in a machine-readable format (Art 20). A business can export its site, content and leads at any time.
• Object — opt out of legitimate-interest or marketing processing (Art 21).
• Not be subject to solely automated decisions with legal or similarly significant effect (Art 22). We make no such decisions about you — sites are built and reviewed by people, and bookings follow the rules the business sets.

We respond within one month as required by UK GDPR. If you are the customer of a business whose site we run, that business is the controller for your booking, order or enquiry data — it may handle your request, and we will help route it and carry out its instructions.

9. Cookies

We use a small set of cookies and similar technologies. The full list, what each does, and how to turn the optional ones off, are in our cookie policy.

10. Complaints

If you are unhappy with how we handle your data, please contact us first at privacy@anvul.co.uk so we can put it right. You also have the right to complain to the UK's supervisory authority, the Information Commissioner's Office (ico.org.uk) — you do not have to use our process first.

11. Changes to this policy

If we make a material change we will update the effective date above and, where the change requires it, ask again for your consent on cookies or marketing.