Privacy policy

Who is responsible for your data

For almost everything on the platform, the business you dealt with is the data controller — it decides why your information is collected and it is who you should contact first about it. Blinds Base is that business's data processor: we store and process the information on the business's behalf and on its instructions, under a written agreement, and we do not use it for our own purposes.

Blinds Base is the controller only for the accounts of the people who sign in to the platform (the business's staff) and for our own records of the businesses that subscribe.

What we process

• Staff accounts: name, work email, role, sign-in records.
• Customer records the business enters or receives: name, contact details, address and postcode, the blinds you asked about, appointment times, quotes, invoices, payments and documents, and the emails exchanged with you.
• Facebook lead forms: when a business connects its Facebook Page, Meta sends us the details you typed into that business's lead form (typically name, email, phone, postcode and your answers), the name of the form and campaign, and the Page the form belongs to. We also keep the emails the business then exchanges with you, and the appointment if one is booked.
• Email the business connects: where a business links its own mailbox, the messages in it that relate to customer enquiries and bookings.
• Technical records: server logs, delivery receipts for emails we send, and an audit trail of who did what inside the platform.

Why, and on what basis

We process this information so the business can do what you asked of it: reply to your enquiry, arrange and confirm a measuring visit, quote, invoice and keep a record of the work — the business's legitimate interests and, where applicable, the contract between you and the business. Staff accounts are processed to run the service the business has subscribed to. We do not use your information for advertising, for profiling unrelated to your enquiry, or for anything the business has not asked us to do.

Where a business turns on automatic replies, the text of an enquiry and the reply being drafted is sent to our AI provider (Anthropic) to generate a suggested or automatic response. It is used only to produce that reply and is handled under our contract with the provider; the business can switch this off at any time.

Facebook and Meta data — our commitments

• Information received from Meta (Page details, lead form definitions and lead submissions) is used solely on behalf of, and at the direction of, the business that connected the Page, to respond to and book the enquiry.
• We never sell Meta data or any other personal information, and we do not share it with anyone other than the business it belongs to and the sub-processors listed below.
• Each business's Facebook access tokens are encrypted at rest and are never shown to the browser, written to logs or sent anywhere but Meta.
• When a business disconnects Facebook, its tokens are revoked and removed at once. Lead data is deleted on the business's request, when the business closes its account, or when you ask — see how to have your data deleted.
• We comply with Meta's Platform Terms and Developer Policies, and we will tell the business and, where required, Meta and the ICO promptly of any security incident affecting their data.

Who else sees it (sub-processors)

The platform runs on trusted providers that process data only on our instructions:

• Vercel — hosting of the application.
• Supabase — the database and file storage.
• Resend — sending, and where enabled receiving, the emails the platform exchanges with you.
• Anthropic — AI drafting of replies, only where a business has switched it on.
• Meta — the source of Facebook Page and lead-form data, where a business has connected its Page.

How long we keep it

Customer and enquiry records are kept for as long as the business keeps them — typically while it is trading with you and for the period it needs for its own legal and accounting duties — and are removed when the business deletes them, closes its account, or a valid deletion request is honoured. Technical logs are kept for a short, fixed period and then discarded.

Your rights

Under UK GDPR you have the right to ask for a copy of the information held about you, to have it corrected, to have it deleted, to restrict or object to its processing, and to data portability. Ask the business you dealt with first — it is the controller and can act on all of these directly inside the platform. You can also write to us at support@blindsbase.com and we will pass the request to the business and help it respond, or act ourselves where we are the controller. If you are unhappy with how your information has been handled you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Cookies

The platform uses only the cookies needed to keep a signed-in staff member signed in. There are no advertising or tracking cookies.

Changes

We will update this page when the platform changes in a way that affects personal information, and change the date at the top when we do.