Privacy notice
How we use and protect your personal information under UK data protection law.
To confirm with the studio owner
- Registered company name and number, and the postal address for data requests.
- The country or region the Cloud database is hosted in, so it can be named here.
- The payment provider and email provider once each is appointed.
- The retention periods set out below.
Who is responsible for your information
The Vault MCR is the data controller for the information described here. You can reach us at thevaultstudio.mcr@gmail.com or by post at 17-23 Broughton Lane, Cheetham Hill, Manchester M8 9TY.
We do not have a statutory data protection officer, so questions and requests come to the studio owner directly.
What we collect
When you book we collect your name, email address, phone number, the date and hours you booked, the add-ons and notes you added, and the payment result.
When you send a message we collect your name, email address, subject and message. If you create an account we store your profile details, your sign-in record and your newsletter preference.
We never see or store full card numbers or security codes. Payment details go straight to the payment provider.
Why we use it and our lawful basis
Booking details are used to take steps at your request and to perform the booking contract.
Account details are used to give you your account and booking history, based on the contract and our legitimate interest in running the service.
Contact messages are used to answer your enquiry, based on your request and our legitimate interest in customer service.
Marketing emails rely on your consent. The newsletter box is unticked by default and you can withdraw consent at any time using the link in any email or by replying to us.
A small amount of record keeping is based on our legal obligations, for example keeping accounting records of payments.
Information collected automatically
Our hosting and database provider records technical information needed to run the site securely: your IP address, browser and device details, the pages requested, and server and error logs. This is used to keep the site available, to investigate faults and to protect against abuse, based on our legitimate interest in security and reliability.
These logs are kept for a short period by the provider and are not used to profile you or to advertise to you.
Where your information is held
Our hosting, database and authentication run on Lovable Cloud. Data is held in UK or EU data centres [TBC with client].
Some providers may process information outside the UK. Where that happens it is protected by the safeguards UK data protection law requires, such as UK approved transfer terms or the UK addendum to the standard contractual clauses, so your information keeps the same level of protection.
Who processes it
We share your information only with the providers who run the service for us, and only with what each one needs. None of them use it for their own purposes.
| Lovable Cloud | Lovable Cloud, which stores the website data, accounts, bookings and messages |
|---|---|
| Payment provider | To be appointed, which processes the card payment |
| Email provider | To be appointed, which sends booking confirmations and replies |
| Maps | Google Maps, only when the map on the contact page is loaded |
How long we keep it
We keep information only as long as we need it, then delete it. Payment related records are kept for six years because tax law requires it.
| Booking and payment records | 6 years from the end of the relevant tax year |
|---|---|
| Account records | Until you delete the account, then 12 months |
| Contact messages | 12 months |
| Marketing consent records | Until you withdraw consent, then a record of the withdrawal |
How we keep it safe
Access to booking and account records is restricted to the studio owner. The site is served over HTTPS, passwords are stored hashed, and database access rules limit each account to its own records.
Your rights
You can ask for access, correction, deletion, restriction, objection or a portable copy of your information where the relevant right applies. You can withdraw consent at any time, which does not affect use that was lawful before.
Email thevaultstudio.mcr@gmail.com to make a request. We may need to check your identity, and we reply within one month. If you are unhappy with our response you can complain to the UK Information Commissioner's Office at ico.org.uk.
Complaints and the regulator
Email thevaultstudio.mcr@gmail.com if you are unhappy with how we have used your information. We aim to reply within five working days and to answer any formal request within one month.
You can also complain to the Information Commissioner's Office at ico.org.uk, or call its helpline. We would rather hear from you first so we can put things right.
Changes to this notice
We update this notice when the way we handle information changes, for example when a payment or email provider is appointed. The date at the top shows the current version, and we recommend checking it before you book.
Last updated 11 September 2026
Registered company name and number: [TBC with client]