Privacy Policy

Effective: February 2026

1. Introduction

This Privacy Policy explains how Bright Machine Ltd (“we”, “us”, “our”), trading as GroomlyHQ, collects, uses, and protects personal information when you use our pet grooming booking platform and related services (the “Service”).

Bright Machine Ltd is registered in England and Wales with company number 7611291, and our registered address is 133a Rye Lane, London, SE15 4BQ. Our VAT number is 130801753.

We are committed to protecting your privacy and handling your data in an open and transparent manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

We collect the following categories of information:

Groomer Account Information

When you create an account, we collect your name, email address, and password (stored in encrypted form). We also collect your business name, business address, contact details, and chosen subdomain.

Client Booking Data

When Clients book through a Groomer’s booking page, we collect their name, email address, phone number, and any notes they provide. This data is collected on behalf of the Groomer.

Pet Details

We collect information about pets associated with bookings, including pet name, breed, size, and any special requirements or notes provided by Clients or Groomers.

Usage and Analytics Data

We collect information about how you use the Service, including page views, feature usage, and technical information such as browser type and device information.

Payment Information

Payment processing is handled by Stripe. We do not store your full credit card details. We receive and store only limited payment information from Stripe, such as the last four digits of your card, card type, and billing address for invoicing purposes.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process bookings and manage appointment schedules
• Send booking confirmations, reminders, and notifications to Clients on behalf of Groomers
• Process your subscription payments and manage your account
• Send you service-related communications (e.g., account verification, billing notifications, security alerts)
• Respond to your enquiries and provide customer support
• Analyse usage patterns to improve and develop new features
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations

4. Data Roles

The Service involves two distinct data relationships:

Groomer Account Data

We are the data controller for Groomer account information. This means we determine how and why your personal data is processed when you create and manage your GroomlyHQ account.

Client Booking Data

We are a data processor for Client booking data. The Groomer is the data controller for their Clients’ personal information. We process this data on the Groomer’s behalf to provide the booking and scheduling service. Groomers are responsible for ensuring they have a lawful basis for collecting their Clients’ data and for responding to any data rights requests from their Clients.

5. Legal Basis for Processing

Under the UK GDPR, we process your personal data on the following legal bases:

• Contract: Processing necessary to perform our contract with you (providing the Service, managing your account, processing payments, handling bookings)
• Legitimate Interests: Processing necessary for our legitimate interests, such as improving the Service, ensuring security, and preventing fraud, where these interests are not overridden by your rights
• Legal Obligation: Processing necessary to comply with our legal obligations (e.g., tax and accounting requirements)
• Consent: Where we rely on your consent (e.g., for sending Clients booking reminders via SMS on behalf of Groomers), you may withdraw it at any time

6. Data Sharing and Third Parties

We share personal data with the following categories of third parties:

Service Providers

• Stripe: Payment processing. Stripe handles all payment transactions and stores payment card details in accordance with PCI-DSS standards.
• Email provider: For sending transactional emails such as booking confirmations and reminders.
• SMS provider: For sending booking reminders and notifications to Clients on behalf of Groomers.
• Cloud infrastructure: For hosting the Service and storing data securely.

Legal Requirements

We may disclose your information if required to do so by law, or if we believe in good faith that such action is necessary to comply with legal obligations, protect our rights or property, or ensure the safety of our users.

7. Custom Subdomains

Each Groomer receives a custom subdomain (e.g., yourname.groomlyhq.com) for their public booking page. Please be aware that:

• Your business name and service information will be publicly visible on your booking page
• Clients can access your booking page without creating an account
• We use cookies on booking pages for essential functionality (see Cookies section below)
• Subdomain names cannot contain offensive or misleading content and are subject to our acceptable use policy

8. International Data Transfers

Our primary data storage is in the United Kingdom. However, some of our service providers, including Stripe, may process data in the United States or other jurisdictions.

Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the UK Information Commissioner’s Office (ICO), or transfers to countries with adequate data protection laws.

9. Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected:

• Groomer Account Data: Retained for the duration of your account. When you delete your account, you have 30 days to export your data before it is permanently deleted.
• Client Booking Data: Retained for the duration of the Groomer’s account and deleted within 30 days of account closure.
• Pet Details: Retained alongside booking data and subject to the same retention period.
• Billing Records: Retained for 7 years after the end of the financial year in which the transaction occurred, as required by UK tax law.

10. Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can ask us to correct inaccurate or incomplete data.
• Right to Erasure: You can request deletion of your personal data in certain circumstances.
• Right to Restrict Processing: You can ask us to limit how we use your data.
• Right to Data Portability: You can request your data in a structured, commonly used, machine-readable format.
• Right to Object: You can object to processing based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month.

Clients: If you are a Client who has booked through a Groomer’s page, please contact the Groomer directly to exercise your data rights, as they are the data controller for your booking information. If the Groomer is unable to assist, you may contact us and we will help facilitate your request.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. You can contact the ICO at ico.org.uk or by calling 0303 123 1113.

11. Cookies

We use cookies and similar technologies to operate the Service. Cookies are small text files stored on your device.

Essential Cookies

These cookies are necessary for the Service to function and cannot be disabled. They include session cookies for authentication and security, and cookies that remember your preferences.

Managing Cookies

You can control cookies through your browser settings. However, disabling essential cookies may affect the functionality of the Service.

12. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL
• Encryption of data at rest
• Secure password hashing
• Regular security assessments and updates
• Access controls limiting data access to authorised personnel

13. Children

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately at [email protected] and we will take steps to delete such information.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on the Service prior to the change becoming effective. We encourage you to review this page periodically for the latest information on our privacy practices.

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: