What we keep, and why.

Two kinds of information, two people responsible

A business’s records about its customers belong to that business. It decides what to keep and why, and we store and handle it on its behalf. If you are a customer of a business that uses Packed Day, that business is the one to ask about your details, and we will help it answer.

Accounts, and this website, are ours. For those, we decide what is kept and we are the ones to ask.

What is kept

• If you have an account: your name and email address, which businesses you work in, when you last signed in and whether that was on the web or the phone app, and, if you use the phone app, a token that lets us send it notifications. There are no passwords. Sign-in codes are stored scrambled and stop working after ten minutes.
• If a business keeps you as a customer: what it enters, which is usually your name, contact details and address, what it does for you and any access notes, the bookings it has made and whether they have been paid for, and its notes and tasks about you.
• If you exchange messages with a business: the messages both ways. Ours go to you by email; what you write back is typed on the reply page each message links to, which is the only way back.
• If you book a time on a business’s booking page: the details you type in, such as your name, email address, phone number, address and what the booking is for, and the time you picked. The booking goes straight onto that business’s schedule and you become one of its customers. Once that business confirms the booking, we email you a confirmation on its behalf, and if you write back on the link in it, what you write is kept with your other messages to that business.
• If you use a form on a business’s own website that sends to Packed Day: what the form asks for, such as your name, email address, phone number and message, and, if you book through it, the time you picked. You become one of that business’s customers, your message is kept with your other messages to it so it can reply, and a booking goes onto its schedule as if you had used its booking page. If that business’s records can’t be reached at that moment, what you sent is held, encrypted and unread, until they can, and deleted from there once it has been passed on.

What is not

• This website has no advertising. Visits to its public pages, and how quickly they load, are counted by Vercel, which sets no cookies and keeps no record of who you are; the admin, the booking pages and the pages customers reply on are not counted at all. It uses one cookie, to keep you signed in, and remembers whether you chose the light or dark theme in your own browser.
• The phone app can use your location to put the day’s bookings in the order you will reach them. That happens on the phone: your location, and the map positions worked out from customers’ addresses by Apple’s or Google’s location service, are never sent to us.
• Nothing is sold, used for advertising, or used to track you across other apps.

Why it is used

To provide the service a business has signed up for, which is the contract between us; to keep it secure and working, which is in our legitimate interest and yours; and where the law requires it. Each business has its own lawful reasons for the customer records it keeps.

Who else handles it

A few companies run parts of Packed Day for us, and only on our instructions:

• Neon hosts the databases every account and every business's records live in.
• Vercel runs the website, the admin and the servers the phone app talks to, and counts visits to the pages of this website, and how quickly they load, without cookies and without identifying you.
• Resend sends email: sign-in codes, messages to customers and confirmations.
• Expo delivers notifications to the phone app, through Apple's and Google's own services.

Someone in a business can also connect an AI assistant, such as Claude or ChatGPT, to its workspace. That is their choice and not ours: while it is connected, what they ask it about the business, customers’ details and conversations included, goes to that assistant’s provider under the business’s own agreement with them. It sees only the one business, as that person, and stops the moment it is disconnected.

Some of them may handle information outside the UK. Where they do, it is protected by the safeguards UK data protection law requires for that transfer.

How it is kept safe

Every business’s records live in a database of their own, separate from every other business’s, and the details for reaching those databases are stored encrypted. Everything travels over an encrypted connection, and nobody signs in with a password that could be guessed or reused.

How long it is kept

• An account is kept until it is removed.
• A business’s records are kept while it uses Packed Day. It can delete a customer, and everything about them, at any time. When a business leaves, its database is deleted.
• Our database provider keeps backups for a limited time, so deleted information can take a little while to leave them.

Your rights

You can ask to see what is kept about you, to have it corrected or deleted, to have its use restricted, to object to how it is used, or to have a copy to take elsewhere. For a business’s customer records, ask that business first; for anything else, email hey@packed.day. If you are not happy with the answer, you can complain to the Information Commissioner’s Office at ico.org.uk.

Children

Packed Day is a tool for businesses and is not meant for children.

Changes

When what we do with information changes, this page changes with it and the date at the top moves. Questions about any of it go to hey@packed.day, or see Contact.