HeyMakers Privacy Policy
Last updated: August 2026 | Applies to: HeyMakers website and mobile app
1. Who We Are
HeyMakers is operated by Ben Nobes, trading as HeyMakers, a sole trader based in the United Kingdom.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller is Ben Nobes.
Contact: datacontroller@heymakers.co.uk
2. What Data We Collect
Account Registration
- Name
- Email address
- Password (stored securely as a hash — we never see your actual password)
- Postcode (used for proximity alerts about new shops near you)
- County (optional)
- Marketing preferences (opt-in only)
Mobile App Usage
- App version number (stored on your account for support purposes)
- Last login date via the app
- Location data (only when you explicitly toggle "Include My Location" on a form — never in the background)
- Photos (only when you choose to attach one to a ticket or shop suggestion — never accessed without your action)
Shop Listings
- Shop name, address, postcode
- Contact email (optional)
- Website and social media links
- Uploaded images (logos and photos)
Payments
- Payment information is processed securely by Stripe. We do not store your card details on our servers.
- We store your Stripe customer ID and subscription ID to manage your account.
Automatically Collected
- Session cookies (website only — required for login)
- Aggregate page view counts (we count total page views per day — no individual user tracking)
3. Why We Collect Your Data
- Account management — to create and maintain your account, verify your identity, and enable login
- Service delivery — to provide access to shop listings, manage subscriptions, process support tickets, and send proximity alerts about new shops
- Payment processing — to handle subscription payments and renewals via Stripe
- Communication — to send transactional emails (verification, password resets, ticket updates, new shop alerts)
- Marketing — only where you have explicitly opted in
4. Legal Basis for Processing
- Contract — processing necessary to provide the service you've signed up for
- Consent — for marketing communications and location data (you can withdraw at any time)
- Legitimate interest — for platform security and service improvement
5. Who We Share Your Data With
We do not sell your personal data. We share data only with:
- Stripe — payment processing
- Supabase — database hosting (EU-based)
- Our email provider — transactional and marketing emails
6. How Long We Keep Your Data
- Account data — retained while your account is active, deleted upon request
- Payment records — 7 years (tax/legal compliance)
- Support tickets — 2 years after resolution
- Page view analytics — 12 months (aggregate only, no personal data)
7. Your Rights
Under UK GDPR, you have the right to:
- Access — request a copy of your personal data
- Rectification — correct inaccurate data (via your account page or by contacting us)
- Erasure — request deletion of your account and all personal data
- Portability — receive your data in a machine-readable format
- Withdraw consent — opt out of marketing at any time
- Complain — lodge a complaint with the ICO
How to Request Account Deletion
You can request complete deletion of your account and all associated personal data at any time. To do so:
- Email datacontroller@heymakers.co.uk from the email address associated with your account
- Include "Account Deletion Request" in the subject line
- We will verify your identity and process the request within 30 days
Upon deletion, we will permanently remove:
- Your account details (name, email, postcode, preferences)
- Any support tickets you've submitted
- Any shop suggestions or reports you've made
- Your referral history
- Your Stripe subscription (cancelled if active)
Payment transaction records may be retained for up to 7 years as required by UK tax law, but will be anonymised where possible.
Alternatively, you can raise a support ticket within the app requesting account deletion, and we will process it the same way.
8. Mobile App Permissions
The HeyMakers app may request the following device permissions:
| Permission | Why | When |
|---|
| Camera | Attach photos to tickets/suggestions | Only when you tap "Camera" on a form |
| Location | Include your location on reports/suggestions | Only when you toggle "Include My Location" |
| Internet | Communicate with our servers | Always (required for the app to work) |
We never access your camera, photos, or location in the background. All permissions are triggered by explicit user action only.
9. Children's Privacy
HeyMakers is not directed at children under 18. We do not knowingly collect personal data from children. If we become aware that a child under 18 has provided us with personal data, we will delete it promptly.
10. Security
- Passwords stored using bcrypt hashing
- All data transmitted over HTTPS
- Payment data handled exclusively by Stripe (PCI DSS compliant)
- Admin access protected by two-factor authentication
11. Changes to This Policy
We may update this policy from time to time. Registered users will be notified of significant changes by email. The date at the top indicates when it was last revised.
12. Contact
For questions about this policy, data requests, or account deletion:
Email: datacontroller@heymakers.co.uk
General support: support@heymakers.co.uk