Privacy Policy

Data controller

The data controller responsible for your personal data is:

Personal data we collect

We collect the following categories of personal data depending on how you interact with Jollee:

Data you provide

• Account information — Name, email address, phone number, password
• Profile information — Profile photo or logo, biography, service categories, and supplier details
• Contact information — Postal address, business address
• Payment information — Billing address; card details are processed by Stripe and never stored on our servers
• Communications — Messages sent through the platform, support enquiries, reviews
• Verification documents — Insurance certificates, checks, identity documents, and other supplier documents

Data collected automatically

• Usage data — Pages visited, search queries, features used, timestamps
• Device data — Browser type, operating system, screen resolution, IP address
• Location data — Approximate location based on IP address or postcode (used for search results)
• Cookies — See our Cookie Policy for details

How and why we use your data

Under the UK GDPR, we must have a lawful basis for processing your personal data. The table below sets out our purposes and the legal basis we rely on for each.

Third-party processors

We share personal data with the following third parties who process data on our behalf:

Where data is transferred outside the UK/EEA, we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) or adequacy decisions.

Calendar connections (Google and Microsoft)

Suppliers can connect a Google Calendar or Microsoft calendar from the Calendar page in their Jollee dashboard. Connecting is optional and only happens when a supplier chooses it and approves the access request from Google or Microsoft. This section explains what that connection does with calendar data.

What we access and why

• Your list of calendars: so you can choose which calendars Jollee checks and which one new bookings are added to. For Google this uses the calendar.calendarlist.readonly permission.
• Events on the calendars you choose: we receive event details from Google or Microsoft but save only start and end times and whether you are busy; event titles are discarded unless you turn on “Store external event titles”. We read this so parents cannot book a time you are already taken. For Google this uses the calendar.events permission; for Microsoft it uses Calendars.ReadWrite.
• Adding confirmed bookings: when a parent confirms a booking, we create an event for it in your chosen calendar. It contains the service name, the start and end times, and a private internal booking reference used to update or remove it if the booking changes. It never includes the parent's name, contact details, notes or location.
• Your account email and name: openid, email and profile permissions (for Microsoft also User.Read and offline_access), used to show which account is connected and keep the connection working.

We use this information only to show accurate availability and to keep your calendar up to date with your Jollee bookings. We do not use it for anything else.

What we store

• Busy times: the start and end time of events on your chosen calendars, and whether they mark you as busy or free.
• Event titles: we do not store the titles of your external calendar events unless you switch on “Store external event titles” in your calendar settings. It is off by default. Events Jollee creates for its own bookings carry the service name.
• Connection details: the email address and display name of the connected calendar account, the calendars you picked, and your sync settings.
• Access tokens: the tokens Google or Microsoft gives us to read and update your calendar. We store them encrypted and use them only to sync your calendar.

What we never do

• We do not sell calendar data or share it with data brokers.
• We do not use it for advertising, including personalised or retargeted ads.
• We do not use it to develop, improve or train generative AI or other machine learning models.
• Our staff do not read your calendar data unless you ask us to for support, we need to troubleshoot a sync problem you have reported, it is needed to investigate abuse or a security issue, or the law requires it.
• We do not transfer it to anyone else except our hosting and infrastructure providers listed above, who process it for us only to run the service, or where the law requires it.

Disconnecting and deleting your calendar data

You are in control. On the Calendar page in your dashboard you can choose either of these:

• Disconnect: syncing stops straight away, we delete the stored access tokens, and we delete the busy times and events we saved. We keep the connection record (account email, display name and chosen calendars) so you can reconnect easily, until you choose Remove.
• Remove: deletes the connection record, your calendar routing settings, the stored tokens and all saved busy times and events.

Disconnecting or removing a calendar in Jollee does not revoke the permission at Google or Microsoft. You can also revoke our access at any time from your Google account at myaccount.google.com/permissions or from your Microsoft account permissions page. If access is revoked, syncing stops and we ask you to reconnect. Booking events already added to your own calendar stay there until you delete them in your calendar. We keep a short record that a connection was made or removed, and technical sync logs showing status and counts but no event content, for security and accountability.

We keep calendar data only while the connection is active. Busy times are refreshed each time we sync and removed when you delete the event in your calendar. They are deleted when you disconnect or remove the connection, and within 30 days of account closure. Your Jollee booking records are kept as described under Data retention.

Google API Services User Data Policy

Jollee's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data retention

We retain your personal data only for as long as necessary:

• Account data — Retained while your account is active. Deleted within 30 days of account closure, unless required for legal purposes.
• Booking records — Retained for 6 years after the booking date for tax and legal compliance.
• Payment records — Retained for 6 years per HMRC requirements.
• Verification documents — Retained while the supplier account is active, deleted within 30 days of account closure.
• Analytics data — Anonymised and aggregated; individual session data retained for up to 12 months.
• Marketing preferences — Retained until you unsubscribe or close your account.

Your rights under UK GDPR

You have the following rights regarding your personal data:

• Right of access — Request a copy of the personal data we hold about you
• Right to rectification — Ask us to correct inaccurate or incomplete data
• Right to erasure — Ask us to delete your personal data ("right to be forgotten")
• Right to restrict processing — Ask us to limit how we use your data
• Right to data portability — Request your data in a structured, machine-readable format
• Right to object — Object to processing based on legitimate interests or direct marketing
• Right to withdraw consent — Where we rely on consent, you can withdraw it at any time

To exercise any of these rights, email us at [email protected] with the subject line “Data Rights Request”. We will respond within 30 days.

Children's privacy

Jollee is not intended for children under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe we have collected data from a child, please contact us and we will delete it promptly.

Changes to this policy

We may update this privacy policy from time to time. Material changes will be communicated via email or a notice on the platform. We encourage you to review this page periodically.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Contact us

For any questions about this privacy policy or how we handle your data, contact us at [email protected].