Privacy policy
Last updated: 20 October 2026
Who we are
Bookastall is run by Yvette Lamb, a sole trader trading as Bookastall. We decide how your personal information is used on bookastall.com, which makes us the "controller" under UK data protection law. Our ICO registration number is ZC279268. For anything about your data, email info@bookastall.com.
What we collect and why
| What | Why | Legal basis |
|---|---|---|
| Account details: name, email, password (stored scrambled, never readable) | To run your account | Contract |
| Maker profile: name, location, bio, photos and their descriptions, links, fairs you're attending | To show your public profile | Contract |
| Fair listings: fair details and the organiser's contact details | To show the fair in the directory | Contract, or legitimate interests for fairs we list ourselves |
| Saves, RSVPs and alert settings | To remember your fairs and send the alerts you asked for | Contract |
| Membership and payment records: plan, dates, amounts, Stripe customer ID (never your full card number) | To run your membership and keep tax records | Contract and legal obligation |
| Your cancellation acknowledgement at checkout: the wording you saw, your plan and the time | To show what you agreed to | Legal obligation and legitimate interests |
| Reports you make, and reports about your listing or profile | To keep the directory safe from fake fairs and misuse | Legitimate interests |
| Emails you send us | To answer you | Legitimate interests |
| Newsletter sign-up | To send the newsletter | Consent (unsubscribe at any time) |
| Technical data: IP address, browser type, error logs | To keep the site secure and working | Legitimate interests |
What's public. Maker profiles and fair listings are public and can appear in search engines. Your email, saves, payments and reports are never public.
Photos. When you upload a photo, we remove hidden data from it, including the location where it was taken.
Reports. We never tell an organiser or maker who reported them. We only share report details if the law requires it, for example with the police or Trading Standards.
Profiles from the old Bookastall site
If you had a profile on the old Bookastall site, we've moved it to the new site as a free profile, so the makers and organisers who found you before can still find you. We do this on the basis of legitimate interests, and we email you to let you know. You can claim your profile, change it, or ask us to remove it at any time.
Who we share it with
We don't sell your data. We use these providers to run Bookastall, and they only use your data to provide their service to us:
| Provider | What they do |
|---|---|
| Supabase | Database and photo storage (UK, London) |
| Vercel | Website hosting |
| Cloudflare | Domain, security and speed |
| Resend | Account and alert emails |
| Stripe | Payments. Stripe also uses some payment data for its own fraud checks, under its own privacy policy |
| Google Workspace | Our email inbox |
| Substack | The newsletter |
Some of these providers store data outside the UK, mainly in the US. Where they do, the transfer is protected in the way UK law requires, such as the UK-US data bridge or standard contract clauses.
How long we keep it
| What | How long |
|---|---|
| Account and profile | While your account is open. Deleted within 30 days of you closing it |
| Membership, payment and cancellation records | 6 years, for tax and legal reasons |
| Reports | 2 years after the report is closed |
| Emails to us | 2 years |
| Technical logs | 30 days |
Your rights
You can ask us to give you a copy of your data, correct it, delete it, limit how we use it, or send it to you in a format you can reuse. You can also object to us using it on the basis of legitimate interests, and withdraw consent at any time. Email info@bookastall.com and we'll reply within one month.
If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Children
Bookastall is for people aged 18 and over. We don't knowingly collect data from children.
Changes
If we change this policy in a way that matters, we'll email account holders before it applies.