LEGAL
Privacy notice
A product about discretion that harvested its users would be a bad joke. Here is what is collected, why, and what is deliberately never written down.
Last updated 3 September 2026
Draft. This document describes how Shortyme actually operates today, but it has not yet been reviewed by a solicitor and is not a binding agreement. It will be replaced before the platform takes its first live payment.
What we collect
To make an account: email, display name, password (hashed, never stored readable). To verify you: a phone number, and for identity verification a government document checked by a third-party provider — we receive the outcome and never store the document. To take a booking: the space, the hours, and payment details held by our payment processor, not by us.
What is encrypted
Host addresses, guest phone numbers and two-factor secrets are encrypted at rest with a key held outside the database. Someone with a copy of the database does not have them.
What we never write down
We do not record why you booked a space. There is no purpose field, no notes column a staff member fills in, and no inference model guessing. A platform that knew why would eventually be asked to hand that over.
We do not publish where anyone has booked. Public profiles show a verification tier and a join date — never a booking history. That omission is the single most load-bearing decision in this product.
Who sees what
A host sees that a guest is verified, not who they are, until they accept. A guest sees the exact address once a booking is confirmed, not before. Staff cannot browse customer records — the admin console requires a search and refuses to list everyone, and every lookup of a customer record is logged permanently.
Who we share it with
Our payment processor, our identity verification provider, our email and hosting providers. That is the list. We do not sell personal data, and we do not share booking history with advertisers.
How long we keep it
Booking and financial records are kept as long as UK tax and anti-money-laundering law requires — currently six years. Verification outcomes are kept while your account is open. Photographs rejected in moderation are deleted.
Your rights
Under UK GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Deletion is honoured except where we are legally required to keep a financial record — in which case we tell you precisely what is being retained and why, rather than refusing the whole request.
You can complain to the Information Commissioner’s Office at any time. We would rather you told us first.