1. Who is responsible for your data
Tribe & Toast is the “controller” of personal data processed through the platform. Tribe & Toast is a trading name of [registered company name] ([company number]), registered address [registered address], United Kingdom. For any privacy matter, contact us at support@tribeandtoast.com.
2. The personal data we collect
Information you provide
- Account details — your name, email address, and password (or a Google sign-in identifier if you use Google).
- Client profile — optional preferences such as event types, postcode/town and the services you’re interested in.
- Vendor profile (if you list a business) — business name, description, category, location, phone number, social links, pricing/packages, photos and videos, FAQs and tags.
- Enquiries, quotes and bookings — your contact name, email and phone number, and event details such as type, date, location, guest numbers, budget and any notes you include.
- Messages — the content of messages you exchange with other users through the platform.
- Reviews — ratings and written reviews you submit, and vendor responses.
Information we collect automatically
- Technical and usage data — limited information needed to operate the service securely, such as your authentication session and basic device/log information generated by our hosting provider.
- Cookies and local storage — see our Cookie Notice. We do not use advertising or third-party tracking cookies.
3. How and why we use your data (legal bases)
| Purpose | Legal basis |
|---|---|
| Create and manage your account; provide the platform | Performance of a contract |
| Pass enquiries, quotes, bookings and messages between Clients and Vendors | Performance of a contract |
| Send service emails (e.g. confirmations, magic links, message and review notifications) | Performance of a contract / legitimate interests |
| Display vendor listings and genuine reviews; keep the marketplace safe and trustworthy | Legitimate interests |
| Improve and secure the platform, and prevent abuse | Legitimate interests |
| Comply with legal obligations and respond to lawful requests | Legal obligation |
| Any optional marketing or non-essential features we may add | Consent |
4. How your data is shared
- Between Clients and Vendors. The platform’s core function is to connect you. When you send an enquiry, quote, booking or message, the relevant contact and event details are shared with the other party so they can respond. Vendor profile information is shown publicly.
- Service providers (processors) who help us run the platform, under contract and only on our instructions: Supabase (database, authentication and file storage), Resend(transactional email delivery), Google (where you choose Google sign-in), Vercel(website hosting), and postcodes.io (UK postcode/town lookup during onboarding).
- Legal and protection. We may disclose data where required by law, to enforce our terms, or to protect the rights, safety and security of our users or the public.
We do not sell your personal data.
5. International transfers
Some of our service providers may process data outside the UK. Where they do, we rely on appropriate safeguards recognised under UK data protection law (such as UK adequacy regulations or the International Data Transfer Agreement / Standard Contractual Clauses) to ensure your data remains protected.
6. How long we keep your data
We keep personal data for as long as your account is active and as needed to provide the service. If you delete your account, we delete or anonymise your personal data, except where we need to retain limited information to comply with legal obligations, resolve disputes or enforce our agreements. Records of a booking may be retained by the other party to that booking.
7. Your rights
Under UK data protection law you have the right to:
- access a copy of your personal data;
- have inaccurate data corrected;
- have your data erased (you can delete your account from your settings);
- restrict or object to certain processing;
- data portability;
- withdraw consent where we rely on it.
To exercise any of these rights, email support@tribeandtoast.com. We will respond within the time limits required by law.
8. Security
We use technical and organisational measures to protect your data, including encryption in transit, access controls and row-level security on our database. No system is completely secure, but we work to protect your information and to handle any incident appropriately.
9. Children
The platform is not intended for anyone under 18, and we do not knowingly collect data from children.
10. Third-party links
Vendor profiles may link to external websites or contact methods (such as WhatsApp or a vendor’s own site). We are not responsible for the privacy practices of those third parties.
11. Changes to this notice
We may update this notice from time to time. We will revise the “last updated” date and, where changes are significant, take reasonable steps to notify you.
12. Complaints
If you have a concern, please contact us first. You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk.