1. Who We Are
HeyMakers is operated by Ben Nobes, trading as HeyMakers, a sole trader based in the United Kingdom.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller is Ben Nobes.
Contact: datacontroller@heymakers.co.uk
2. What Data We Collect
We collect the following personal data when you use HeyMakers:
Account Registration (Makers & Shop Owners)
- Name
- Email address
- Password (stored securely as a hash — we never see your actual password)
- County (optional)
- Marketing preferences (opt-in only)
Shop Listings
- Shop name, address, postcode
- Contact email (optional)
- Website and social media links
- Uploaded images (logos and photos)
Payments
- Payment information is processed securely by Stripe. We do not store your card details on our servers.
- We store your Stripe customer ID and subscription ID to manage your account.
Automatically Collected
- Session cookies (required for login functionality)
- Server logs (IP address, browser type, pages visited) — standard web server operation
3. Why We Collect Your Data
We use your personal data for the following purposes:
- Account management — to create and maintain your account, verify your identity, and enable login
- Service delivery — to provide access to shop listings, manage subscriptions, and process support tickets
- Payment processing — to handle subscription payments and renewals via Stripe
- Communication — to send transactional emails (account verification, password resets, ticket updates, subscription confirmations)
- Marketing — only where you have explicitly opted in, to send news, tips, and partner offers
- Platform improvement — to understand how the platform is used and improve it
4. Legal Basis for Processing
Under UK GDPR, we process your data on the following bases:
- Contract — processing necessary to provide the service you've signed up for (account, subscriptions, listings)
- Consent — for marketing communications (you can withdraw at any time)
- Legitimate interest — for platform security, fraud prevention, and service improvement
5. Who We Share Your Data With
We do not sell your personal data to third parties. We share data only with:
- Stripe — for payment processing (Stripe Privacy Policy)
- Supabase — our database provider, hosted in the EU (Supabase Privacy Policy)
- Our email provider — for sending transactional and marketing emails
If you opt in to partner marketing, we may share your name and email with trusted partners. You can opt out at any time via your account settings.
6. How Long We Keep Your Data
- Account data — retained while your account is active, deleted upon request
- Payment records — retained for 7 years for tax and legal compliance
- Support tickets — retained for 2 years after resolution
- Server logs — automatically deleted after 30 days
7. Cookies
HeyMakers uses only essential session cookies required for the platform to function (login sessions). We do not use tracking cookies, analytics cookies, or advertising cookies.
| Cookie | Purpose | Duration |
|---|---|---|
| heymakers_maker | Maker login session | Browser session |
| heymakers_shop | Shop owner login session | Browser session |
8. Your Rights
Under UK GDPR, you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — correct any inaccurate data (you can do this directly via your account page)
- Erasure — request deletion of your account and personal data
- Portability — receive your data in a structured, machine-readable format
- Withdraw consent — opt out of marketing at any time via your account settings
- Complain — lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk
To exercise any of these rights, contact us at datacontroller@heymakers.co.uk.
9. Security
We take appropriate measures to protect your data including:
- Passwords stored using industry-standard hashing (bcrypt)
- All data transmitted over HTTPS encryption
- Payment data handled exclusively by Stripe (PCI DSS compliant)
- Admin access protected by two-factor authentication
- Regular monitoring of systems for vulnerabilities
10. Changes to This Policy
We may update this privacy policy from time to time. We will notify registered users of significant changes by email. The "last updated" date at the top of this page indicates when it was last revised.
11. Contact
If you have questions about this policy or how we handle your data, please contact us:
Email: hello@heymakers.co.uk