Privacy Policy

1. Who we are

Carely is the data controller for personal data processed through this service. For any privacy request, contact privacy@carelynk.co.uk.

2. What we collect

• Account: name, email, password hash, role (family/carer).
• Profile: phone, postcode, bio, avatar, care needs or skills.
• Compliance (carers): DBS certificate, right-to-work document, references. Stored encrypted; access limited to authorised staff.
• Bookings & payments: booking details, Stripe customer/account IDs. Card details are handled directly by Stripe — we never see or store them.
• Messages: in-platform messages between families and carers.
• Technical: IP address, browser, session data, error logs.

3. Lawful bases

We rely on contract (to provide the service), legitimate interests(safety, fraud prevention, service improvement), legal obligation(safeguarding, tax records), and consent (marketing emails, non-essential cookies).

4. Sharing

Your data is shared with:

• The other party in a booking or conversation (limited profile info only).
• Sub-processors: Supabase (hosting/DB, EU), Stripe (payments), Resend (transactional email), Sentry (error monitoring).
• Authorities where required by law or safeguarding duties.

We do not sell personal data.

5. Retention

• Account data: until you delete your account.
• Booking & payment records: 7 years (HMRC requirement).
• Messages: 2 years after last activity.
• Compliance documents: for the duration of your carer account, plus 12 months.

6. Your rights

Under UK GDPR you can request access, rectification, erasure, restriction, portability, or object to processing. Email us to exercise these rights. You can also delete your account from your dashboard settings. You may complain to the ICO (ico.org.uk).

7. International transfers

Some sub-processors process data outside the UK/EEA under UK IDTA or SCCs with appropriate safeguards.

8. Cookies

See our Cookie Policy.

9. Changes

We will notify registered users of material changes by email.