Privacy notice
The short version
There are two different relationships in this notice, and they carry different duties.
When you visit this website or email us, Vangarde Limited decides why and how your data is used. We are the controller.
When a salon uses Purebook to run its business, the salon decides what client information to record and why. The salon is the controller; Vangarde Limited is the processor, acting on that salon's instructions. If you are a client of a salon and want your records changed or erased, ask the salon — they hold that decision, and we act on their instruction.
Who we are
Purebook is a service of Vangarde Limited, registered in England and Wales, company number 14906264, registered office Mansion House, Manchester Road, Altrincham, Cheshire, WA14 4RW.
Write to us at Purebook, Vangarde Limited, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, or email support@purebook.co.
Our registration with the Information Commissioner's Office is in progress. The registration number will be published here once it has been allocated.
Where we are the controller
Visitors to this website
This site is deliberately plain. It sets no advertising or analytics cookies and embeds no third-party trackers. If that changes, this notice changes with it and a cookie banner appears.
People who contact us
If you email us, we hold your address, your message and our reply so we can answer you and keep a record of what was agreed. Our lawful basis is legitimate interests — responding to someone who has asked us something — or, where you are a customer, performance of a contract. We keep enquiries for 24 months after the conversation ends.
Salon accounts
For each salon we hold the business details, the contact details of the people who administer the account, and billing records. Lawful basis: performance of the contract, and legal obligation for records we must keep.
Where we are the processor
Salons use Purebook to hold information about their own clients and staff. Typically that includes names, contact details, appointment history, treatment records, notes the salon writes, and payment records.
Some of that can be health information — patch test results, allergies, skin conditions, or notes about a client's health where the salon records them. That is a special category of data under the UK GDPR. The salon decides whether to record it and on what basis; we hold it on the salon's behalf, apply the protections described below, and do not use it for anything other than providing the service.
We do not sell salon data, do not use it to train models, and do not use one salon's data to benefit another.
Who else processes data, and where
We use these sub-processors. Each is bound by a contract restricting them to our instructions.
| Provider | What for | Where |
|---|---|---|
| Vercel | Application hosting | EU (London region) |
| Neon | Database hosting | EU (London region) |
| Stripe | Payments and card processing | EU and US, under its own terms with each salon |
| Resend | Transactional email | EU and US |
| Vonage | SMS and messaging | EU and US |
Where a provider processes data outside the UK, that transfer relies on the UK International Data Transfer Addendum or an adequacy decision.
How long we keep things
Salon data: for as long as the salon's account is open. When an account closes, we delete or return the data within 30 days, except anything we must keep by law.
Billing records: six years, as UK tax law requires.
Enquiries: 24 months after the conversation ends.
How data is protected
- Data in transit is encrypted with TLS; data at rest is encrypted by our hosting providers
- Passwords are hashed, never stored in readable form
- Each salon's data is isolated from every other salon's, and that isolation is tested automatically on every change to the software
- Access by our staff is limited to what is needed to run and support the service
Your rights
Under the UK GDPR you may ask for a copy of your data, ask for it to be corrected or erased, object to or restrict how it is used, or ask for it in a portable form. You can also withdraw consent where consent is the basis.
If you are a client of a salon, contact that salon — they decide, and we act on their instruction. If you are unsure who to ask, email us and we will point you to the right salon.
You can complain to the Information Commissioner's Office at ico.org.uk. We would rather you raised it with us first.
Changes
If this notice changes materially we will tell account holders by email. The date at the top always shows the current version.