Privacy policy

Your privacy, in plain English first

Effective date: 12 September 2026. The full policy is below the summary - same rules, just the whole wording.

• No cookies and no advertising trackers on our marketing pages.
• We collect only what we need to run your bookings: your name, contact details, booking history and any brief service notes.
• We never see or store your card numbers - Stripe and SumUp handle those.
• Texts from us are practical (confirmations, reminders). Reply STOP any time.
• Ask us for your data at any point and we will give it to you or delete it.

1. Who we are

Calma Quick Spa Ltd, trading as Cappa, 4 Charles House, Charles Street, Worcester, WR1 2AQ, is the data controller for your personal data. Contact: cappaquickspa@gmail.com or 07470 303576.

2. What we collect

• Your name, phone number and email address.
• Your booking and service history: service, length, room choices, date and time.
• Membership status and billing events, handled by Stripe. We never store card numbers.
• Payment events handled by SumUp. We never store card numbers.
• The texts we send you and your consent to receive them.
• Where we keep them, brief service notes about your visits - for example an estimated age range, gender, and short observations - used to tailor your sessions and keep people safe.
• Messages you send us by phone, text, WhatsApp or email.

We never buy data about you from anyone. Any service notes we keep are brief and used only to run your sessions well and keep people safe.

3. Cookies and tracking

Our marketing pages set no cookies and run no advertising trackers or analytics scripts. The booking page may store a small note on your own device (browser local storage) so it can offer to repeat your last session; that note stays on your device until you book. If you tap Get directions you leave our site, and Google Maps’ own privacy policy then applies. Our hosting provider, Vercel, keeps standard technical logs needed to serve the site securely.

4. How we use your data

• To fulfil and manage your bookings and sessions.
• To send confirmations, reminders and waitlist alerts you have agreed to.
• To run memberships and payments.
• To keep people safe, through health declarations and our safety rules.
• To improve the service in aggregate, for example which session lengths people choose.
• To answer your messages.
• To meet legal and tax obligations.

5. Our legal bases

Consent, for texts. Contract, for bookings and memberships. Legitimate interests, for security, fraud prevention, running and improving the service you asked for, and for any brief service notes we keep. Legal obligation, for keeping financial records.

6. Who we share it with

• Supabase, which stores our booking database.
• Vercel, which hosts this website.
• Stripe, which runs membership billing.
• SumUp, which takes payments.
• Twilio, which delivers our text messages.

We never sell or rent your personal data. Each of these providers receives only what it needs to do its job.

7. Storage and security

Your data is stored in our Supabase database with controlled access, and our admin tools are password protected. Card details never touch our systems. We keep booking and financial records for as long as we need them to run the service and meet UK law - typically six years for financial records - and then delete or anonymise them.

8. Your rights

Under UK GDPR you have the right to request access to your personal data, correction of inaccurate data, deletion of your data, and to object to or restrict processing. Email or call us and we will act within one month. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, though we would love the chance to put things right first.

9. Children and text messages

Our services are for over-18s only, and we do not knowingly collect data from anyone under 18. We use text messages to send booking confirmations, reminders and waitlist alerts. Message and data rates may apply. Reply STOP to any message to opt out at any time, and HELP for assistance. We do not send marketing texts without your separate consent.

10. Changes to this policy

We may update this policy from time to time. The latest version is always posted on this page with a new effective date.