Privacy policy

This matters for understanding the rest, so it comes first.

If you run a business that uses Olou, we hold data about you — your name, email and business details. For that, we decide how it's used, and this policy explains it.

If you are a customer of one of those businesses — say your plumber uses Olou — then that business decides what to record about you, not us. We only store it on their behalf. Contact them directly about your data; if you contact us we will pass it on to them.

Olou is operated by Sajib Ahmed, trading as Olou. You can reach us at privacy@olou.co.uk.

For data protection purposes we are the controller of the account data described below, and a processor for everything a business puts into the app about its own customers.

• Your name, email address and the role you hold in your business.
• Your business name, and the web address used for your public booking page.
• A securely hashed version of your password. We never store or see the password itself.
• Basic technical records — sign-in times, and server logs kept for security and fault-finding.
• If your business uses the Olou Assistant: the messages sent to it, and a running count of usage so cost can be capped.

We do not use tracking or advertising cookies. The only cookies set are the ones required to keep you signed in.

• To provide the service you signed up for — this is the main one, and covers your account, your business's records and everything the app does.
• Our legitimate interests — keeping the service secure, preventing abuse, fixing faults, and contacting you about your account.
• Legal obligations — where we're required to keep records, for example for tax.

We don't sell data and we don't share it for marketing. We do use these suppliers to run the service:

Where a supplier is outside the UK, the transfer is covered by the UK International Data Transfer Addendum or equivalent safeguards.

Business records are stored in the United Kingdom. We keep your data for as long as your account is open. If you close your account we delete or anonymise it within 90 days, unless we're required to keep something longer for legal reasons.

Some things are kept deliberately rather than deleted immediately: a cancelled job stays in the calendar as history, and a staff member who has been removed still appears on work they did. This is so the business record stays truthful. Full deletion is available on request.

Under UK data protection law you can ask us to:

• Give you a copy of the personal data we hold about you.
• Correct anything that's wrong.
• Delete your data, where we don't have a legal reason to keep it.
• Restrict or object to how we use it.
• Provide it in a portable format so you can move elsewhere.

Email privacy@olou.co.uk and we'll respond within one month. If you're not happy with our response you can complain to the Information Commissioner's Office at ico.org.uk.

Every business's data is isolated at the database level, not just hidden in the interface, so one business cannot read another's records even by manipulating requests. Data is encrypted in transit and at rest, passwords are hashed, and access within a business is limited by role.

If a breach occurs that puts your rights at risk, we'll tell you and the ICO as required by law.

If we change this policy in a way that materially affects you, we'll let account holders know by email before it takes effect.