Legal

Privacy policy

How The Messy Crafters collects, uses and protects your information.

Who we are

The Messy Crafters is a small children's activity business based in Edwinstowe, Nottinghamshire. We are the data controller for the information described here. Contact: hello@themessycrafters.co.uk.

What we collect and why

Booking details — your name, email and mobile number, plus your child's first name and date of birth so we can run age-appropriate sessions safely. Legal basis: contract.
Payment — payments are processed by Stripe. We never see or store your card number. We keep a record of the amount paid and Stripe's payment reference. Legal basis: contract and legal obligation (accounting).
Account — a sign-in code is emailed to you so you can view your bookings without a password. Legal basis: contract.
Marketing — only if you tick the marketing box. You can unsubscribe at any time from any email or from your account. Legal basis: consent.
Enquiries — party, childminding and contact messages are stored so we can reply. Legal basis: legitimate interests.

Who we share it with

Trusted service providers who process data on our behalf: Supabase (database and login), Stripe (payments), Resend (email) and Vercel (hosting). We never sell your data.

How long we keep it

Booking and payment records are kept for 6 years to meet accounting requirements. Enquiries are kept for 12 months. You can ask us to delete your account at any time — we will anonymise personal details while keeping the financial record we are legally required to hold.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, or withdraw marketing consent. Email hello@themessycrafters.co.uk and we will respond within one month. You can also complain to the ICO (ico.org.uk).

Cookies

We use strictly necessary cookies to keep you signed in and to process your booking. Optional Google Analytics cookies are only set if you choose “Allow analytics” on the cookie banner, and you can change your mind at any time. There are no advertising cookies. See our cookie policy for details.

What we collect and why

Booking details — your name, email and mobile number, plus your child's first name and date of birth so we can run age-appropriate sessions safely. Legal basis: contract.

Payment — payments are processed by Stripe. We never see or store your card number. We keep a record of the amount paid and Stripe's payment reference. Legal basis: contract and legal obligation (accounting).

Account — a sign-in code is emailed to you so you can view your bookings without a password. Legal basis: contract.

Marketing — only if you tick the marketing box. You can unsubscribe at any time from any email or from your account. Legal basis: consent.

Enquiries — party, childminding and contact messages are stored so we can reply. Legal basis: legitimate interests.