Privacy notice

Who we are

Levy First is run by [legal name of you or your company], [address], the data controller for the information below. ICO registration number: [ICO number].

What we collect, and why

What we collect

Information	Why	Lawful basis
Your email address	Signing you in, the reminders you choose, receipts	Contract
An account id from Google or Apple, if you sign in with them (never your password)	Recognising you next time	Contract
Sign-in history: when, how, and a rough device such as “Chrome on Mac”	Showing you recent sign-ins and spotting misuse	Legitimate interests (security)
Booking records you add: reference, property, dates, nights, amounts, number of guests, levy collected	Working out the levy and your council return	Contract
Property and business details: name, address, postcode, unavailable dates, licence references, photos and listing links you add	Receipts, the return, the 70-night test and the property’s details	Contract
Email addresses you share your records with	Giving them read-only access	Contract, at your request
A record of changes to your records (the person stored as a code)	So your figures can be checked later	Legal obligation and legitimate interests
Mailing list address, if you join	Telling you when features open	Consent; leave at any time

What we don’t collect

Guest names, guest contact details and card details. A booking export is read on your own device, and guest names and phone numbers are removed before anything is sent. The free booking check sends nothing to us at all. Photos are made smaller in your browser before upload, which removes hidden camera details, including location.

Who processes it for us

• Vercel hosts the site and counts page visits with Vercel Web Analytics, which uses no cookies and doesn’t identify you.
• Upstash stores account data, in [storage region].
• Stripe handles payments and holds your billing details under its own privacy notice. We keep your Stripe customer and subscription ids and your plan.
• Resend sends our emails.
• Google and Apple, only if you choose them to sign in.
• postcodes.io receives a postcode, and nothing else, to find a property’s council and map position.
• Google Maps (or OpenStreetMap) shows a property’s map when you open its details, and receives your IP address and the property’s location, as any embedded map does.

Where a provider handles data outside the UK, it does so under the UK’s approved safeguards. We don’t sell data or use advertising.

How long we keep it

Booking records and returns: the five years you must keep levy records, plus a year, then deleted automatically. Sign-in history: your last 10 sign-ins. Change records: the last 1,000 changes. Everything else: until you delete your account.

Your rights

Download everything we hold about your account, or delete it, at any time from your account page. Deleting removes your records, settings, photos, shares and sign-in history, and signs you out everywhere. To correct or restrict your data, or object to how it is used, email [contact email]. You can complain to the Information Commissioner’s Office at ico.org.uk.

Cookies

Only the ones the site needs to work: one keeps you signed in, and two short-lived ones protect a sign-in while it happens. Your choices such as row height are kept in your own browser. There are no analytics or advertising cookies, so there is nothing to consent to.