Privacy notice
This notice explains how Sauna Safe handles personal information. Sauna Safe is run by Hugh Dingwall, trading as Sauna Safe. You can contact us at hello@saunasafe.co.uk or by post at [business address to be added].
Two different roles
The venue is responsible for its own records. Venues use Sauna Safe to keep safety records, which can mention their staff, customers and others, for example in an incident report. For that information the venue is the controller and decides what is recorded and why. We store and process it only on the venue's instructions, under our data processing terms. If you're named in a venue's records and have a question, ask the venue first. We'll help them answer you.
We are responsible for account information. This is information about the people who sign in to Sauna Safe, and it's what the rest of this notice covers.
What we collect
- Account details: your email address, the name and role your venue gives you, and which organisation you belong to.
- Sign-in information: when you sign in, and a password if you choose to set one. We store passwords only in a form that can't be read back.
- Activity: a record of what you add or change, for example "Check recorded by Priya at 09:12". This is the venue's audit trail, so the venue's owners and managers can see it.
- Technical information: IP address, browser and device details, and error logs. Our hosting providers collect these to keep the service running and secure.
- Emails to us: anything you send to hello@saunasafe.co.uk.
Why we use it, and our lawful basis
| Running your account and signing you in | Contract with your venue, and our legitimate interest in providing the service to the people the venue invites |
|---|---|
| Morning digest and reminder emails to owners and managers | Legitimate interests: it's a core part of the service the venue has asked for |
| Keeping the service secure, investigating misuse, fixing faults | Legitimate interests |
| Telling you about changes to the service or these terms | Legitimate interests and contract |
| Keeping records the law requires | Legal obligation |
We don't sell personal information, use it for advertising, or make automated decisions about you that have legal or similarly significant effects.
Who we share it with
We share it only with the providers who run parts of Sauna Safe for us:
- Supabase: database and sign-in, with data stored in the EU.
- Vercel: delivers the app.
- Resend: sends emails.
- Cloudflare: DNS and email forwarding.
We may also share information if the law requires it. Some of these providers are based in the US. Information sent outside the UK goes to the EU, which the UK treats as adequate, or is protected by the UK–US data bridge or the ICO's International Data Transfer Addendum.
How long we keep it
- While you're a member: we keep your account details while you belong to an organisation.
- If a venue removes you, or you ask us to delete your account: you can no longer sign in. Your name stays on records you made, because venues must keep accurate safety records.
- When an organisation closes its account: we delete its data after 30 days, and backups within a further 30 days.
- Technical logs: kept for up to 30 days.
Cookies and storage on your device
Sauna Safe doesn't use advertising or analytics cookies. The app stores some information in your browser so it can work:
- your sign-in session
- whether a device is a shared venue tablet
- checks saved while you were offline, until they're sent
The app needs these to work, so it doesn't ask for consent. Signing out removes the session. Clearing your browser's site data removes everything else, including any checks that haven't been sent yet.
Your rights
You have the right to:
- access your personal information
- have it corrected or deleted
- restrict how we use it, or object to our using it
- receive a copy in a portable format
Email hello@saunasafe.co.uk to use any of these rights. We'll reply within one month. For information in a venue's records, we'll pass your request to the venue and help them answer.
If you're unhappy with how we've handled your information, please tell us. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
Changes
If we change this notice, we'll update the version date above. We'll tell owners in the app or by email if a change affects how we use information.