CastleRunner

Privacy Policy

Last updated: February 2026

1. Who We Are

CastleRunner is a booking and route management platform operated for bouncy castle and inflatable hire companies. This privacy policy explains how we collect, use, store, and protect personal data when you use our services.

For data protection enquiries, please contact us at: privacy@castlerunner.co.uk

2. What Data We Collect

We collect the following personal data:

  • Customer booking data: Name, phone number, email address, delivery and collection addresses
  • Location data: Delivery and collection coordinates (derived from addresses for route planning)
  • Staff accounts: Email address, username, hashed password
  • Communication records: SMS messages sent (ETA notifications), email correspondence related to bookings
  • Waiting list: Name, email address, and optional company name when you sign up for beta access

3. How We Use Your Data

We process personal data for the following purposes:

  • Booking fulfilment: Managing deliveries and collections of inflatables (legal basis: contract performance)
  • Route optimisation: Planning efficient delivery routes using addresses and coordinates (legal basis: legitimate interest)
  • Customer communication: Sending ETA notifications via SMS when a driver is on the way (legal basis: legitimate interest)
  • Account management: Authenticating staff access to the platform (legal basis: legitimate interest)
  • Waiting list: Contacting you about CastleRunner beta access when available (legal basis: consent)

4. Third-Party Services

We share personal data with the following processors:

  • Twilio (US) – SMS delivery service. Receives customer phone numbers and message content for ETA notifications.
  • Google Maps Platform (US) – Address geocoding and route distance calculations. Receives delivery addresses and coordinates.
  • Anthropic (US) – AI-assisted PDF parsing for bulk booking imports. Receives booking schedule images temporarily during processing.
  • Resend – Email delivery service. Receives staff email addresses for password reset emails only.
  • Supabase (EU) – Database hosting. Stores all booking and account data.

Where data is transferred outside the UK/EEA, we rely on appropriate safeguards including standard contractual clauses.

5. Data Retention

  • Active bookings: Retained while the booking is active and for up to 7 years after completion for tax and legal purposes.
  • Archived bookings: Can be permanently deleted by an administrator at any time.
  • Staff accounts: Retained while the account is active. Deleted upon request.
  • Communication logs: SMS send timestamps retained with the booking record.
  • Waiting list: Retained until beta launch completes or until you request removal by emailing privacy@castlerunner.co.uk.

6. Your Rights

Under UK GDPR, you have the right to:

  • Access – Request a copy of all personal data we hold about you
  • Rectification – Request correction of inaccurate data
  • Erasure – Request deletion of your personal data (subject to legal retention requirements)
  • Data portability – Receive your data in a machine-readable format
  • Object – Object to processing based on legitimate interest
  • Restrict processing – Request limitation of how we use your data

To exercise any of these rights, contact us at privacy@castlerunner.co.uk. We will respond within 30 days.

7. Cookies

We use only essential cookies:

  • Session cookie (next-auth.session-token) – Authenticates your login session. Expires when you close the browser or after the session timeout.

We do not use any analytics, advertising, or third-party tracking cookies.

8. Security

We protect your data using industry-standard measures including encrypted connections (HTTPS/TLS), hashed passwords (bcrypt), secure authentication tokens, and role-based access controls. Our database is hosted on infrastructure with encryption at rest.

9. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date.

Terms & Conditions← Back to login