In short
- We never sell your details.
- Our public pages set no cookies and use no analytics or advertising, and the quiz doesn't ask who you are.
- What a bakery records about its customers and staff belongs to the bakery.
- You can see, correct or delete your details: write to privacy@slinkystoat.com.
Who we are
Slinky Stoat Ltd runs Slinky Bakehouse and is responsible for the personal details this notice describes. Our registered office is 14 Alma Green, Stoke Row, RG9 5PB, and we're registered with the Information Commissioner's Office under number ZC282125. Write to us about privacy at privacy@slinkystoat.com.
If your details are in a bakery's workspace
Each bakery that uses Slinky Bakehouse decides what it records about its customers, contacts and staff, and is responsible for that data. We handle it for the bakery under contract and only on its instructions. If a bakery holds your details and you want to see, correct or delete them, ask the bakery. If you ask us, we pass your request to the bakery.
What we collect and why
Our website and mailing list
Site and app visitors
- What we keep
- Your IP address, in the technical log Vercel keeps of each visit and in our error reports.
- Why
- To keep the site secure and working.
- Legal basis
- Legitimate interests.
Quiz takers
- What we keep
- Your answers and the time you sent them. We don't connect them to the mailing list or to anything else about you.
- Why
- To learn how bakeries work and decide what to build.
- Legal basis
- Legitimate interests.
Bakeries asking for early access
- What we keep
- Your first name, your bakery's name and your email address, which of our two choices you ticked (nothing is ticked for you), when you joined, and the date of this notice, so we can show what you asked for.
- Why
- To reply to you and offer you early access.
- Legal basis
- Legitimate interests.
News subscribers
- What we keep
- The same details.
- Why
- To email you news about Slinky Bakehouse.
- Legal basis
- Consent.
People who ask us to stop
- What we keep
- Your email address, on a list of people we must not contact.
- Why
- So that we never write to you again.
- Legal basis
- Legitimate interests.
Bakeries we talk to
- What we keep
- Your name, your bakery, your work contact details and our notes of the conversation.
- Why
- To follow up and, where the law allows, send you news about Slinky Bakehouse.
- Legal basis
- Legitimate interests, or consent where email law needs it.
Using Slinky Bakehouse
People who sign in
- What we keep
- Your name, work email, when and how you sign in, your two-step sign-in settings, and a record of what you change in your bakery's workspace.
- Why
- To give you access, keep accounts secure and show your bakery who did what.
- Legal basis
- Legitimate interests.
The person who pays for a bakery
- What we keep
- Your name, your business's details, your email address and your billing history.
- Why
- To take payment, invoice you and keep accounting records.
- Legal basis
- Contract or legitimate interests; tax law for accounting records.
Support contacts
- What we keep
- Your name, your email address and what you tell us.
- Why
- To answer you and improve our help.
- Legal basis
- Legitimate interests.
Everyone using the service
- What we keep
- Counts of users, last sign-in, the outcome of scheduled jobs, and de-identified information such as which features are used.
- Why
- To keep the service running and improve it.
- Legal basis
- Legitimate interests.
Bakeries that connect Google Drive
- What we keep
- The connected Google account's email address, the folder's ID and a token, stored encrypted.
- Why
- To save the reports the bakery asks for in its own Drive.
- Legal basis
- Legitimate interests.
Giving us your details is up to you, but without them we can't reply to you, give you access or bill you. Most come from you; if your bakery invited you, your name and email address came from its administrator. We don't make decisions about you by automated means.
How long we keep it
We keep your details only as long as we need them:
Visit logs and error reports
- How long
- Up to 90 days.
Quiz answers
- How long
- We review answers after 12 months and delete those we no longer need.
A request to try early
- How long
- Until early access ends, when we delete your request.
Your details for our news
- How long
- Until you ask us to stop, or we stop sending news. The list of people we must not contact lasts as long as we send news.
Sign-in accounts and the record of changes
- How long
- While your bakery's workspace exists. When a workspace closes, we delete it 90 days after suspension, and backups are gone within 30 days more.
Billing and accounting records
- How long
- 6 years after the end of the financial year they relate to, as tax law requires.
Support emails, notes of our conversations, and requests or complaints about your details
- How long
- 3 years after our last contact about them.
Cookies
Signing in and the app use only these cookies:
Sign-in cookies (names beginning sb-)
- What it does
- Keep you signed in.
- How long
- Until you sign out or the session ends.
session_deadline and session_idle_minutes
- What it does
- Sign you out after a period of inactivity.
- How long
- Your session.
last_sign_in_method
- What it does
- Remembers that you last signed in with Google, so we can remind you.
- How long
- One year. Choose Forget on the sign-in page to remove it.
The first two are strictly necessary; the third remembers a preference.
If your bakery connects Google Drive
A bakery's administrator can connect a Google account so that Slinky Bakehouse saves the bakery's reports in its Google Drive. We can then see the account's email address, to show which account is connected, and create a folder called Slinky Bakehouse to save reports in. We can open only the files and folders we create, and nothing else in that Drive.
We use this access only to save the reports the bakery asks for. We don't sell this information, use it for advertising or use it to train AI models, and only our suppliers handle it for us. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
The connection lasts until an administrator disconnects it on the Integrations page, or the account's owner removes our access in their Google Account. When an administrator disconnects, we cancel the token with Google and delete it. Reports already saved stay in the bakery's Drive.
Who we share it with
We use trusted suppliers to host the service, send our emails, report errors, hold our own email and keep encrypted backups. They work under contracts that let them use your details only on our instructions. Stripe takes card and Bacs payments as a separate controller, under its own privacy notice; we never see your full card number. We also share details with our accountant and advisers, with authorities where the law requires, and with a buyer of our business if we ever sell it.
We keep the service's data in London. Some of our suppliers handle data outside the UK. When they do, either the UK has judged the destination to protect it adequately, or we use contract terms approved for use in the UK. Ask us for details.
Your rights
You can ask us to:
Get a copy
See what we hold about you, in a form you can take elsewhere.
Correct them
Put right anything that is wrong or incomplete.
Delete them
Erase your details where we have no need to keep them.
Stop a use
Object at any time to a use we base on legitimate interests, or ask us to pause one while a question is settled.
Where we rely on your consent, such as for our news, you can withdraw it at any time by replying to one of our emails. For anything else, email privacy@slinkystoat.com and we'll reply within a month.
Complaints
If you're unhappy with how we've handled your details, email privacy@slinkystoat.com. We'll acknowledge your complaint within 30 days and tell you what we've done about it.
You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes to this notice
We update this notice when what we do changes, and show the date at the top. If a change affects you significantly, we tell you by email.