Privacy
policy.
Last updated 26 October 2026.
Who we are
This policy explains how AYS Concierge ("AYS", "we") uses personal data when you use our website, apps and services. We are the controller of that data. You can reach us about anything in this policy at office@aysconcierge.co.uk.
What we collect
| Data | Who | Why |
|---|---|---|
| Name, email, password (stored only as a secure hash) | Everyone with an account | To create and secure your account |
| Phone number, job address and notes | Customers | So the pro you booked can do the job |
| Business name, bio, phone, services, prices, postcode districts covered | Pros | To show your profile and match you with customers |
| Photo ID, insurance, qualifications, DBS certificates | Pros | To check pros before they can take bookings |
| Bookings, quotes, cancellations, payment status | Customers and pros | To run bookings, payments, refunds and support |
| Messages you send us, and your email if you join a waiting list | Anyone | To reply to you or tell you when booking opens |
| IP address, device and browser details, sign-in times | Everyone | Security, preventing abuse and fraud, keeping sessions signed in |
We do not ask for, and pros must not upload, more than the documents need to show. DBS certificates can contain criminal record information: we use them only to decide whether a pro can work on AYS, and only authorised AYS staff can open them.
Card details are entered directly with our payment provider. AYS never sees or stores your full card number.
Our lawful basis
- Contract: running your account, bookings, quotes and payments.
- Legal obligation: keeping financial records, and responding to lawful requests.
- Legitimate interests: keeping the platform safe, checking pros, preventing fraud and spam, and improving our service. We balance these against your rights.
- Consent: waiting list emails. You can withdraw at any time by replying to any email or contacting us.
Where DBS information is processed, we rely on the conditions for criminal offence data in the Data Protection Act 2018, Schedule 1, and keep a written policy on how we handle it.
Who we share it with
We never sell personal data and we do not use advertising trackers. We share data only as needed to run AYS:
- Between customers and pros: when a booking is confirmed, the pro sees your name, job address and phone number, and you see the pro's business name and phone number. Before that, pros see the job and the postcode area only.
- Cloudflare: hosting, security, spam protection (Turnstile) and private storage of pro documents.
- Neon: database hosting.
- Stripe: card payments and paying pros. Stripe also acts as a separate controller for its own legal and fraud checks.
- Resend: sending account and booking emails.
- Have I Been Pwned: when you set a password we check it against known leaked passwords. Only the first 5 characters of a hash of the password are sent, never the password itself.
- Authorities: if the law requires it, or to protect someone's safety.
Some of these providers process data outside the UK. When they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum, so your data stays protected.
How long we keep it
- Account data: while your account is open. When you delete your account, we remove your name, email and phone number straight away and close your sessions.
- Booking and payment records: 6 years after the booking, for tax and accounting law. Records of deleted accounts are kept without your name or contact details.
- Pro documents: while the pro account is open and up to 12 months after it closes, in case of a dispute or a safety concern.
- Messages to us and waiting list emails: up to 2 years, or until you ask us to delete them.
- Security logs: up to 12 months.
Your rights
Under UK data protection law you can ask to access, correct or delete your data, to restrict or object to how we use it, and to receive it in a portable format. Signed-in users can download their data and delete their account from account settings. For anything else, email office@aysconcierge.co.uk. We reply within one month.
If you are unhappy with how we handled your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk.
How we protect it
Connections are encrypted. Passwords are stored only as secure hashes. Pro documents are kept in private storage that is not reachable from the internet, and every time a staff member opens one it is logged. Staff accounts that can review pros must use two-step sign-in. Only the people who need data to do their job can see it.
Children
AYS is for adults. You must be 18 or over to create an account.
Changes to this policy
If we make an important change, we will tell signed-in users by email or in the app before it applies. The date at the top shows the latest version.