Last updated: 15 September 2026
Linxwell ("we", "us", "our") provides an AI-powered booking and receptionist platform, and the Linxwell Tap customer experience product, for businesses operating in the United Kingdom.
Contact: hello@linxwell.co.uk
This policy covers three distinct situations:
A — Business owners and staff using the Linxwell platform. We act as the data controller for your personal data and this policy explains how we collect and use your information to provide the service.
B — Customers of a business that uses Linxwell. The business you booked with acts as the data controller for your personal data. Linxwell acts as a data processor, handling your information only on that business's behalf and under their instructions.
C — People who tap or scan a Linxwell Tap device. When you interact with a Linxwell Tap device (NFC tap or QR scan), we process limited technical data to deliver the customer experience. The business that operates the Tap device is the data controller. Linxwell acts as a data processor.
We do not use your personal data for marketing without your explicit consent.
We share your data only where necessary to deliver our service:
We do not sell your personal data to third parties.
| Data | Retention |
|---|---|
| Account and profile data | Subscription duration + 12 months |
| Audit logs | 24 months |
| Financial and billing records | 6 years (UK legal requirement) |
| Support messages | 24 months from resolution |
| OTP security codes | Deleted immediately after use or expiry |
This section applies if you have called or booked with a business that uses Linxwell.
We use Stripe as our payment processor. Your card details are sent directly to Stripe and are never stored on our servers. Stripe processes payment data in accordance with PCI DSS Level 1 standards. For more information, see Stripe's Privacy Policy.
If you call a salon that uses Linxwell, your call may be answered by our AI assistant ("Sarah"). The assistant will identify itself as an AI at the start of every call. It can make, reschedule, or cancel bookings and transfer your call to a human if needed. You can ask for any AI-made booking to be reviewed or reversed by contacting the salon directly.
Call transcripts and audio recordings (where applicable) are retained for a maximum of 90 days and then permanently deleted.
We send SMS messages on the salon's behalf for booking confirmations, reminders, cancellations, and deposit payment links (transactional — always sent), and for promotional offers (only with your explicit consent). Every promotional SMS includes a STOP instruction. Replying STOP immediately removes you from all marketing messages from that salon.
Health, allergy, or medical information you provide via a consultation form is classified as special category data under UK GDPR Article 9. This data is accessible only to the salon owner and manager-level staff. The salon is responsible for obtaining your explicit consent before collecting this information.
| Data | Retention |
|---|---|
| Call transcript and AI summary | 90 days, then permanently deleted |
| Call recording (audio) | 90 days, then permanently deleted |
| Customer profile (name, phone, email, notes) | Until erasure requested, or anonymised after 24 months of inactivity |
| Booking records | 6 years minimum (UK financial records law) |
| Payment transaction records | 6 years minimum |
| Marketing consent records | Duration of active customer relationship |
This section applies if you have tapped or scanned a Linxwell Tap device in a business.
When you tap a Linxwell Tap device with your phone or scan its QR code, a customer experience page opens in your browser. We process the following technical data to deliver that experience:
We do not collect your name, email address, phone number, or any personal information when you tap or scan. No account or app is required.
If you choose the "Pay" action, you are directed to a payment page powered by Yapily, an FCA-authorised Payment Initiation Service Provider (PISP). Yapily initiates a bank-to-bank payment on your behalf using Open Banking.
Linxwell does not see, store, or process your bank login credentials, account number, or sort code. Your bank credentials are entered directly with your own bank via Yapily's secure redirect. We receive only a payment confirmation (amount, status, reference) to update the business's records.
Yapily processes payment data under its own privacy policy: yapily.com/legal/privacy-policy.
The Linxwell Tap customer experience page uses no advertising, tracking, or analytics cookies. A short-lived session identifier may be used to maintain your interaction state while the page is open. It is deleted when you close the page.
| Data | Retention |
|---|---|
| Tap/scan interaction logs (anonymous) | 12 months, then aggregated or deleted |
| Payment confirmation records | 6 years (UK financial records requirement) |
Some services we use to deliver the Linxwell platform are based outside the UK. All transfers to US-based services are covered by UK Standard Contractual Clauses or equivalent safeguards as required by UK GDPR.
Our database (Supabase) and workflow automation (n8n, self-hosted in the UK) do not transfer data outside the UK or EU. You can request details of the safeguards in place for any specific transfer by contacting us.
Under UK GDPR, you have the right to:
Business customers: your rights are exercised through the business that holds your booking. Contact the business directly, or contact us and we will route your request to the correct party.
Tap users: the Tap experience collects no personal data by default. If you made a payment via Tap Pay, contact the business or us to exercise your rights in relation to payment records.
We will respond to all rights requests within one calendar month. You also have the right to lodge a complaint with the ICO at ico.org.uk (0303 123 1113).
We use a small number of strictly necessary cookies to make the platform work:
We do not use any advertising, tracking, or analytics cookies. We do not build profiles for advertising purposes or share cookie data with third parties for marketing.
We implement appropriate technical and organisational measures to protect personal data, including:
In the event of a personal data breach, we will notify affected parties and the ICO in accordance with our legal obligations.
Our service is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child's data has been submitted to our platform, please contact us and we will delete it promptly.
We will notify salon owners of material changes by email at least 14 days before they take effect. The "Last updated" date at the top of this page reflects when the most recent changes were made.
For privacy enquiries, contact us at hello@linxwell.co.uk.