Privacy Policy

Last updated: 26 July 2026

1. About this policy

Forteel is a booking-protection platform for independent appointment providers. It helps providers manage availability, accept bookings and booking payments, apply cancellation terms, communicate with clients and offer suitable released appointments to eligible waitlist clients.

This Privacy Policy explains how personal data is collected, used, shared and protected when:

a provider creates or uses a Forteel account;
a client books an appointment through a Forteel-powered booking page;
someone joins a provider’s waitlist;
someone contacts Forteel or otherwise interacts with the platform.

2. Who we are

Forteel is operated by:

DUTYCREST LTD
Company number: 17001692
Registered in: England and Wales
Registered office: 128 City Road, London EC1V 2NX
Email: support@forteel.com

In this Privacy Policy, “Forteel”, “we”, “us” and “our” refer to DUTYCREST LTD.

DUTYCREST LTD is the data controller for personal data it processes in operating the Forteel platform, including provider accounts, subscriptions, platform administration and payment-status records.

Providers using Forteel may also act as independent data controllers for personal data relating to their own clients, services and professional relationships. Clients should contact the relevant provider where an enquiry relates specifically to the provider’s use of their personal data outside Forteel.

3. Personal data we collect

Provider information

When a provider creates and uses a Forteel account, we may collect:

name;
business name and business type;
email address;
telephone number;
account and authentication identifiers;
timezone;
availability and blocked dates;
session price and appointment duration;
deposit or full-payment settings;
cancellation-policy settings;
subscription status;
Stripe customer and subscription identifiers;
booking and cancellation activity;
communications with Forteel;
consent and onboarding records.

Client and booking information

When a client makes or manages a booking, we may collect:

name;
email address;
telephone number;
selected provider;
appointment date and time;
booking reference;
booking value;
deposit or full-payment amount;
cancellation deadline;
payment status;
cancellation and refund status;
booking source, including whether a booking followed waitlist outreach;
communications sent in connection with the booking.

Waitlist information

When someone joins a provider’s waitlist, we may collect:

name;
email address;
preferred date;
preferred time period;
relevant provider;
waitlist status;
whether outreach was sent;
whether a subsequent booking was completed.

Payment and transaction information

Payments are processed through Stripe. Forteel does not store full payment-card numbers or card security codes.

We may receive and retain payment-related information such as:

amount paid;
payment type;
currency;
Stripe Checkout Session identifiers;
Stripe payment identifiers;
payment status;
refund status;
subscription status;
transaction timestamps.

Technical and security information

When someone uses Forteel, we may process technical information necessary to operate and protect the service, including:

authentication and session information;
IP address;
browser and device information;
request timestamps;
security, diagnostic and error logs;
records of actions taken within the platform.

4. How we obtain personal data

We obtain personal data:

directly from providers when they create or manage an account;
directly from clients when they make, manage or cancel a booking;
directly from people who join a waitlist or contact us;
from Stripe when it provides payment, refund and subscription-status information;
automatically through essential authentication, security and service infrastructure.

5. How and why we use personal data

We may use personal data to:

create and administer provider accounts;
provide Forteel’s booking and payment functionality;
display provider availability;
create and confirm bookings;
process deposits and full payments through Stripe;
apply provider cancellation terms;
initiate eligible refunds;
send booking confirmations, reminders and cancellation communications;
notify providers about booking activity;
manage waitlist entries;
contact eligible waitlist clients when suitable appointments become available;
administer provider subscriptions;
provide support and respond to enquiries;
protect accounts and prevent fraud or misuse;
investigate errors, failed payments and operational incidents;
maintain financial, accounting and legal records;
establish, exercise or defend legal claims;
comply with legal and regulatory obligations;
administer and improve the reliability of the platform.

6. Our lawful bases

We rely on different lawful bases depending on why personal data is being used.

Contract

We may process personal data where necessary to:

create and operate a provider account;
provide the provider’s Forteel subscription;
create and administer a client booking;
process the required booking payment;
apply the relevant cancellation terms;
administer refunds and booking communications.

Legitimate interests

We may process personal data where necessary for our legitimate interests or those of a provider, provided those interests are not overridden by the individual’s rights.

These interests may include:

operating and administering Forteel;
keeping the platform secure;
preventing fraud and misuse;
maintaining accurate booking and payment records;
communicating about bookings;
investigating operational failures;
improving the reliability and performance of the service;
supporting providers in managing released appointment opportunities.

Legal obligation

We may process and retain personal data where required to:

comply with tax, accounting and company-law obligations;
respond to lawful requests from regulators, courts or public authorities;
meet record-keeping and reporting obligations.

Consent

Where we rely on consent for a specific activity, individuals may withdraw that consent at any time. Withdrawing consent does not affect processing that took place before the withdrawal.

Forteel does not currently use analytics or advertising cookies and does not currently send general marketing communications through the platform.

7. When personal data must be provided

Certain information is required to provide Forteel’s services. For example:

providers must provide sufficient account, business and subscription information to create and operate an account;
clients must provide sufficient contact, booking and payment information to complete a booking;
payment information must be entered through Stripe where a booking or subscription requires payment.

Where required information is not provided, Forteel may be unable to create an account, process a booking, accept payment or provide the requested service.

8. Who we share personal data with

We may share personal data with service providers that help us operate Forteel.

Stripe

Stripe processes:

booking payments;
subscription payments;
payment-status information;
eligible refunds;
payment and fraud-prevention checks.

Full card details are entered into and processed through Stripe’s payment flow rather than stored by Forteel.

Supabase

Supabase provides services including:

account authentication;
database infrastructure;
secure session management;
storage of provider, booking and operational records.

Resend

Resend is used to deliver transactional communications such as:

booking confirmations;
provider booking notifications;
cancellation notices;
refund communications;
waitlist confirmations;
released-slot outreach.

Vercel

Vercel provides website hosting, application infrastructure and operational delivery services.

Other disclosures

We may also disclose personal data:

to professional advisers, including accountants, lawyers and insurers;
to regulators, courts, law-enforcement bodies or public authorities where required by law;
to prevent or investigate fraud, abuse or security incidents;
in connection with a business sale, restructuring, merger, investment or acquisition, subject to appropriate safeguards.

We do not sell personal data to third parties.

9. Providers and client information

Providers use Forteel to offer and administer their own services.

A provider may independently determine how it uses client information outside the Forteel platform, for example in relation to:

providing the booked service;
maintaining professional or service records;
communicating directly with the client;
meeting sector-specific legal or regulatory obligations.

That provider may therefore be an independent controller for those activities.

Forteel is not responsible for a provider’s separate privacy practices. Clients should review any privacy information supplied by the relevant provider.

10. International transfers

Some of Forteel’s service providers may process personal data outside the United Kingdom or use international subprocessors.

Where personal data is transferred internationally, we will take steps intended to ensure that an appropriate legal transfer mechanism is used. Depending on the destination and service provider, this may include:

UK adequacy regulations;
the UK International Data Transfer Agreement;
the UK Addendum to the European Commission’s Standard Contractual Clauses;
another transfer mechanism permitted by UK data-protection law.

11. Cookies and similar technologies

Forteel currently uses cookies and similar technologies that are necessary to:

keep users securely signed in;
maintain account sessions;
support essential booking and payment functionality;
protect the platform against misuse;
preserve required service state.

Forteel does not currently use analytics, behavioural-advertising or targeted-advertising cookies.

Further information will be provided in Forteel’s Cookie Policy.

12. How long we retain personal data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, operational, dispute-resolution and security requirements.

Retention may depend on:

whether a provider account remains active;
whether a booking or payment remains open;
whether information is required to process a refund;
whether the information forms part of financial or accounting records;
whether a dispute, complaint or legal claim remains possible;
whether records are needed to prevent fraud or investigate misuse;
whether deletion is required or permitted by law.

Different categories of information may be retained for different periods, including:

provider account and subscription records;
bookings and transaction records;
cancellation and refund records;
waitlist entries;
support communications;
security and technical logs;
legal and accounting records.

13. Data security

We use technical and organisational measures intended to protect personal data against:

unauthorised access;
accidental loss;
misuse;
alteration;
disclosure;
destruction.

Access to personal data is limited according to operational need. We also use specialist providers for authentication, hosting, payments and transactional communications.

No online platform or transmission method can guarantee absolute security.

14. Your data-protection rights

Depending on the circumstances and the lawful basis used, individuals may have the right to:

request access to their personal data;
ask for inaccurate or incomplete data to be corrected;
request deletion of personal data;
request restriction of processing;
object to certain processing;
request transfer of eligible data in a portable format;
withdraw consent where processing relies on consent;
raise concerns about how personal data is used.

These rights are not absolute. In some circumstances, we may be required or permitted to retain or continue processing information.

To exercise a right, contact: support@forteel.com

We may need to verify the requester’s identity before responding.

15. Automated decision-making

Forteel does not currently make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.

Forteel may automatically apply factual booking rules, such as:

whether a cancellation occurred before or after the provider’s stated cancellation deadline;
whether a booking slot remains available;
whether a waitlist preference corresponds to a released appointment.

These operational rules support the booking service but are not currently used to create an unexplained behavioural or credit-style score.

16. Children’s data

Forteel is designed primarily for use by adult providers and adult clients.

Where an appointment concerns a child or young person, the person making the booking must have appropriate authority to provide the required information and arrange the appointment.

Providers remain responsible for complying with any additional legal, professional or safeguarding obligations that apply to services involving children.

17. Complaints

Please contact us first if you have concerns about how we use personal data: support@forteel.com

You also have the right to complain to the UK Information Commissioner’s Office.

18. Changes to this policy

We may update this Privacy Policy when:

Forteel’s services change;
our use of personal data changes;
service providers change;
legal or regulatory requirements change.

The current version will be published on this page with its latest revision date.

Where a change materially affects how personal data is used, we may provide an additional notice through the platform or by email.

19. Contact us

Questions about this Privacy Policy or Forteel’s use of personal data can be sent to:

DUTYCREST LTD
Forteel Privacy Enquiries
128 City Road
London
EC1V 2NX
United Kingdom

Email: support@forteel.com