Privacy Policy

Last updated: 2 November 2026

Soopaspace ("we", "our", "us") provides software that helps self-employed practitioners run their businesses — including a booking page customers can use to schedule sessions with them. This policy explains what personal data we collect, why we collect it, and your rights under UK GDPR and the Data Protection Act 2018.

If you have any questions about this policy or how your data is handled, email us at hello@soopaspace.com.

1. Who we are

Soopaspace is operated by Black Isle Group Limited, a company registered in Scotland (company number SC809719), with registered office at 5 South Charlotte Street, Edinburgh, Midlothian, EH2 4AN. We are the data controller for personal data we collect about practitioners (account holders) and for our own purposes, such as our mailing list and our own site analytics.

When a practitioner uses Soopaspace to keep their clients' details (names, contact details, bookings, answers to booking questions and notes), the practitioner is the controller and we are their processor. That relationship is set out in our Data processing terms, which form part of our Terms & Conditions.

Contact: hello@soopaspace.com (also our Data Protection contact — we have not appointed a separate Data Protection Officer at this stage).

2. What personal data we collect

From practitioners (people who sign up to run their business through Soopaspace)

• Account identity: email address, name, business name (optional)
• Signing in with Google (optional): if you sign in with Google, Google shares your name, email address and profile picture with us so we can create and identify your account. We never see your Google password, and signing in with Google does not give us access to your calendar or any other Google data.
• Profile information: bio, location, photos, banner image, services offered, pricing
• Business operations: bookings received, customers who book with you, schedule and availability data
• Payment-related: a Stripe customer ID linking to your subscription billing record and, if you connect your own Stripe account to take card payments, your Stripe account ID and the amount and status of each payment. We never receive your full bank or payment card details, or your customers': these are held by Stripe directly.
• Calendar and video connections (optional): if you connect a calendar or video-meeting service, we store encrypted sign-in credentials so we can add your bookings and check when you're busy on your behalf. They're encrypted at rest and removed when you disconnect.
• Billing help: your conversations with our billing assistant and any request you ask us to review, so we can check what was agreed and sort out problems. You can also choose to send supporting documents with a review request (for example a hospital letter), which may include health information.

From customers (people who book sessions through a practitioner's page)

• Booking details: your name, email address, phone number (optional)
• Who the booking is for: if you book for someone else or for your pet, the name you give for them. It is shown only to the business you booked with and in your own booking emails.
• Answers to the business's booking questions, if they ask any (for example a child's age, an emergency contact or medical notes). See “Health information” and “Children booked by a parent or guardian” below.
• Marketing preferences: whether you've consented to receive marketing emails from the practitioner you booked with
• Booking history: which sessions you've booked, when, with whom

Health information in booking answers

Some businesses ask booking questions whose answers can include health information, such as medical notes, allergies or injuries. Under UK data protection law this is special category data.

• The business you book with decides what to ask and is responsible for that information (they are the controller). They must have a lawful reason to ask for it and should only ask for what they need to run the session safely. We do not ask for health information ourselves, and no business is required to ask for it.
• We hold it for them as their processor, under our Data processing terms, only to provide the service: showing it on the booking and on the business's client records and session register.
• We never use it for our own marketing, advertising or profiling.
• It is protected like all other client data: encrypted in transit and at rest, and each business can only see its own records.
• It is kept until the business deletes it or closes its account (see section 6). To ask for it to be corrected or deleted, contact the business, or email us and we will pass your request to them and help them respond.

Children booked by a parent or guardian

Soopaspace accounts are for adults (18 or over). Many businesses run sessions for children; in that case a parent or guardian completes the booking, gives the child's name, answers the business's questions and pays.

• We treat the adult who completes the booking as acting for the child. Booking emails, reminders and messages go to that adult, not to the child.
• The business is the controller for the child's details and we are its processor, as above. The business remains responsible for its own safeguarding duties.
• We do not use children's data for our own marketing, we do not show third-party advertising on booking pages, and we never sell it.
• A parent or guardian can ask about the child's data (to see, correct or delete it) by contacting the business, or by emailing us and we will pass the request on and help them respond.

Automatically (everyone)

• Authentication cookies: a session cookie issued by our authentication provider (Supabase) so you stay signed in
• Server logs: IP address, request paths, error events — retained for up to 30 days for operational and security purposes
• Visits to our public marketing pages, counted by us (no third-party service): the page, the site or link you came from, your type of device, roughly where you are (country and town), how long you stayed and how far you scrolled. A random code in a cookie (sp_vid, 13 months) lets us recognise the same browser when it returns. If you create an account, start a website scan or join a list, we link the visits made on that browser to you, so we can see what brought you to Soopaspace and improve it. We never store your IP address with this. Our lawful basis is our legitimate interest in understanding and improving our service. After 13 months we remove the visitor code, town and browser details from anonymous visits, so what is left cannot be linked to anyone; if your account is closed, the link between your visits and your account is deleted with it. You can opt out at any time on our cookie policy page, and we respect Global Privacy Control
• Visits to a business’s booking page, counted by us: which page was visited and, for each thing the business offers there, whether a visit saw it, opened it or started to book or buy it. This uses a random code that lasts only for that page load and is never stored in your browser. We do not record your IP address, your browser or device details, or who you are with these counts; we keep the code (scrambled, with a key that changes daily) for two days only so a visit is not counted twice, and after that only totals remain. The business sees these totals to understand what its clients are interested in. Our lawful basis is our legitimate interest, and the business’s, in understanding and improving the booking page. You can opt out on our cookie policy page
• We do not use third-party analytics or advertising cookies, and we do not track you across other websites

3. Why we collect it (purposes and legal basis)

We may also use aggregated and anonymised data — combined across businesses and stripped of anything that identifies you or your customers — to improve and develop our services. This includes market benchmarks, such as typical prices and booking patterns for a type of service in a region, that we may show to other businesses. As this data does not identify any individual, it is not personal data.

4. Who we share your data with

We use a small set of trusted sub-processors to operate the platform:

• Supabase (database and authentication) — hosts your personal data, processes magic-link logins
• Vercel (hosting, analytics and performance measurement) — runs the Soopaspace web application, including Vercel Analytics, which helps us understand aggregate site traffic, and Vercel Speed Insights, which measures how quickly pages load on real devices. Vercel states that Analytics does not use cookies, does not collect personal data, and does not track individuals across sites or devices. Neither is used for advertising.
• Resend (email delivery) — sends booking confirmations and other transactional emails on our behalf
• Sentry (error monitoring): receives technical reports when part of the site fails, so we can fix it. Reports are stored in the EU (Germany). We strip names, email addresses, phone numbers, IP addresses and private link codes from them before they are sent.
• Stripe (payment processing) — processes the practitioner subscription for paid Soopaspace accounts. Where a practitioner connects their own Stripe account, it also processes their customers' card payments for bookings and purchases. Those payments go straight to the practitioner's Stripe account: the practitioner is the merchant, and we do not receive card details. Stripe is an independent controller for the payment data it collects.
• Google (Gemini AI) (assistant + written summaries) — powers the in-app assistant and, when a practitioner chooses to record one, turns their spoken post-session note into a written recap for you. What is sent: the practitioner's question or recording, plus the business context needed to answer it, which can include booking, customer and financial details from their account. Voice recordings are sent once and are not stored by us — only the resulting text, after the practitioner has reviewed it, is saved. Google processes this as our processor and does not use it to train their models. It also powers the billing assistant, which sees your Soopaspace billing details (plan, payments and invoices) and what you write to it, and summarises a written review request for our team. Supporting documents are never sent to Google or any AI; only a member of our team views them.
• Google Maps (location embeds) — when a practitioner displays a map of their venue on their booking page, the map is loaded from Google. Your IP address may be visible to Google when the map renders, subject to Google's own privacy policy.
• Twilio (text messages): sends text messages to customers, only when a practitioner chooses to use texts. It processes the customer's phone number and the message, in the United States.
• Calendar and video-meeting services (only when a practitioner connects one): we write booking events into the practitioner's calendar, read busy times only (never event titles, descriptions or attendees) to prevent double-bookings, and create meeting links for online bookings.

When you connect a Google account, Soopaspace's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use it only to provide the calendar features you turned on. We don't sell it, use it for advertising, or use it to train AI models, and no person at Soopaspace reads it unless you ask us to for support, it's needed for security, or the law requires it.

When you book through a practitioner's page, your booking details are shared with that practitioner so they can deliver the session. The practitioner is independently responsible for how they use your data after that booking (for example, the marketing emails they may send you if you've consented).

How we protect your data

We protect the personal data we hold about practitioners and their clients with the following measures.

• Encryption in transit: all traffic to and from Soopaspace uses HTTPS (TLS).
• Encryption at rest: our database and file storage are encrypted at rest by our hosting providers (Supabase and Vercel).
• Access control: each business can only reach its own records, and this is enforced in the database itself as well as in the app. Our own team accesses production data only when needed for support or security.
• Payment details: we never receive full card or bank details. These are held by Stripe.
• Google account data: if you connect Google Calendar, your Google sign-in credentials are encrypted with AES-256 before they are stored, and the encryption key is kept separately from the data. They are only ever used on our servers, never sent to your browser or shown to anyone. We ask Google for the minimum access we need: to add your bookings to your calendar, and to see when you are busy (never event titles, descriptions or attendees).
• Disconnecting: when you disconnect Google Calendar, we delete the stored credentials and ask Google to revoke our access. You can also remove our access at any time from the permissions page of your Google Account, and we stop using the connection as soon as Google tells us access has been withdrawn.

5. International transfers

Most of our infrastructure is hosted in the EU (Ireland) under the UK's data adequacy decision for the EEA. Some of our hosting (Vercel) operates from multi-region serverless infrastructure including the UK (London) and the United States (Virginia). Sub-processors operating from outside the UK/EEA — including Vercel's US functions, Stripe, Twilio, Google Maps, and connected calendar and video-meeting services — process data under the EU-US Data Privacy Framework (DPF) and/or Standard Contractual Clauses (SCCs), maintaining UK-GDPR-compliant data protection commitments.

6. How long we keep your data

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data (the "right to be forgotten"), subject to legitimate retention requirements
• Restrict processing in certain circumstances
• Object to processing — including direct marketing, which you can opt out of at any time
• Portability — receive your data in a structured, machine-readable format
• Withdraw consent where consent is the legal basis (such as marketing communications)

To exercise any of these rights, email hello@soopaspace.com. We aim to respond within one month.

If you're unhappy with how we handle your data, you can lodge a complaint with the UK Information Commissioner's Office (ICO): https://ico.org.uk.

8. Marketing communications

Soopaspace's own updates

If you join our list (on our website or at the end of one of our guides), we use your email address to send you tips for running a small business and news about Soopaspace. When you join, we send one email asking you to confirm. We only send you anything else if you confirm, and every email has a link to unsubscribe. If you don't confirm, we delete your address after 30 days. If you unsubscribe, we keep a note of your address only so we never email you again.

If you open a Soopaspace account, we also send you our monthly newsletter about Soopaspace, unless you tick the box at sign-up to say no. You can switch it off at any time in Account, or with the unsubscribe link in every email.

If you tick the box at sign-up, or switch it on in Account, someone from the Soopaspace team may email you personally to ask for your feedback and offer help setting up. This is separate from the newsletter. If you are on a paid plan and give us a phone number for this, we may also call you. We use the number only for this, and you can remove it, or switch personal help off, in Account at any time, or with the link in any of these emails.

If you start signing up and give us your email address but don't finish, we may send you one email to help you finish, and our monthly newsletter unless you ticked the box to say no. Every email has an unsubscribe link.

Our other products, inside your account

Black Isle Group Limited also makes other products and services, such as tools for sports coaches. If you run a business on Soopaspace, we may show you messages about them inside your Soopaspace account (for example, a card on your dashboard), chosen using your account details, the type of business you run and the services you offer. We do this whether or not you have signed up for marketing emails.

• We only do this inside your account. We will not email or text you about our other products unless you have said yes to hearing about them.
• We never use your clients' details for this, and never use any data from your Google account.
• We do not share your details with anyone else to do this.
• You can ask us to stop at any time by emailing hello@soopaspace.com.

News from Soopaspace, if you book with businesses

If you have a Soopaspace account as someone who books with businesses, you can choose to hear from Soopaspace itself: news about Soopaspace and offers from us. This is separate from any emails a business sends you, and from the emails your account needs (like sign-in codes and booking confirmations).

• Our lawful basis is your consent. The box is never ticked for you, and saying yes is never a condition of booking, of having an account or of agreeing to our terms.
• We keep a record of your choice: your account, the email address, yes or no, when, where you made it and which wording you saw. We keep it so we can show you agreed, and so we never email you after you have said no.
• You can stop at any time by unticking the box in your account, or with the unsubscribe link in any of these emails (it works without signing in).
• We never use a business's list of clients to find people to market to. Businesses cannot see whether you have said yes or no.
• The record of your choice is kept for as long as you have your account, and deleted with it.

From the business you booked with

If you've ticked the marketing consent checkbox when booking, the practitioner you booked with may send you marketing emails. You can withdraw consent at any time by:

• Clicking the unsubscribe link in any marketing email
• Emailing the practitioner directly
• Emailing us at hello@soopaspace.com

Withdrawal of consent doesn't affect the lawfulness of processing done before the withdrawal.

9. Cookies

We use a small number of cookies and similar technologies. Most are needed for the service to work: keeping you signed in, protecting a calendar or video-meeting connection, and confirming a password reset. We also remember a referral code if you arrive through a referral link, and our own anonymous visitor counting on the marketing pages keeps a random visit code in your browser tab until you close it.

The full list, with what each one does and how long it lasts, is in our Cookie policy.

We do NOT use third-party tracking cookies, advertising cookies, or analytics that profile you across sites.

10. Changes to this policy

We may update this policy from time to time. If we make material changes we'll notify you by email and update the "Last updated" date at the top.

11. Contact us

For any privacy questions, data subject requests, or complaints:

Email: hello@soopaspace.com

You can also lodge a complaint with the UK Information Commissioner's Office (ICO) at https://ico.org.uk.