Privacy notice

Who is responsible

Made By Night Ltd, company number 17519652, of 128 City Road, London, EC1V 2NX, is the data controller for the personal data described here. Questions and requests about your data go to hello@madebynight.co.uk, and we answer within a month.

Forms and bookings on our customers’ websites

If you filled in a form, joined a mailing list or made a booking on a website we run for one of our customers, that business is responsible for your data and we handle it only on their behalf. Their own privacy notice applies, and requests about that data go to them. If you write to us instead, we pass your request on and help them answer it.

What we collect and why

• When you ask for a quote: your business name, your name, your email address, your phone number if you give it, and your answers to the questions about your site. We use these to write your quote and to reply to you. The lawful basis is taking the steps you asked for before a contract.
• When you have an account in our customer app: your name, your email address and a password, which we store only as a hash. We use these to sign you in, to show you your quotes, plans and invoices, and to email you about them. The lawful basis is the contract between us.
• When you pay for a plan: your business’s billing address and the record of what you paid. Your card details go straight to Stripe and never reach us. The lawful basis is the contract, and the law that requires us to keep accounting records.
• When you email us: what you wrote and your address, so we can answer. The lawful basis is our legitimate interest in running the business and helping you.
• When you visit our website: nothing about you. We use Cloudflare Web Analytics, which counts visits without cookies and without identifying anyone.
• When you use the customer app: a record of sign-ins and of the changes made to your account, including the time and the network address they came from, kept so we can keep accounts secure and investigate anything unexpected. The lawful basis is our legitimate interest in security.

Cookies

Our website, madebynight.co.uk, sets no cookies, which is why it has no cookie banner.

The customer app, app.madebynight.co.uk, sets one cookie when you sign in. It keeps you signed in and nothing else, it is strictly necessary for the app to work, and it is removed when you sign out.

Who we share it with

We share personal data only with the companies that help us run the service, and only what each needs. We do not sell it or share it for advertising. They are:

• Cloudflare, which hosts our website and the customer app, stores the files we generate for you, such as quotes and invoices, and measures visits to our website without cookies. Data is processed in the United Kingdom, European Union and United States.
• Stripe, which takes card payments for hosting and care plans and stores your card details; they never reach us. Data is processed in the United States.
• Resend, which sends our email to you, such as your quote, invoices and account messages. Data is processed in the United States.
• Sentry, which receives error reports from the customer app so we know about a fault before you do; a report may carry your account id and the page you were on, never your password or card details. Data is processed in the United States.

Data outside the UK

Stripe, Resend and Sentry are based in the United States. Transfers to them are covered by the UK extension to the EU-US Data Privacy Framework where the company is certified under it, and otherwise by the International Data Transfer Agreement that UK law provides for. You can ask us for a copy of the safeguards.

How long we keep it

• A quote request we did not go on to build: 12 months, then deleted.
• Your account and your business’s records: for as long as you have an account with us, then deleted when you close it, apart from the records below.
• Invoices and payment records: 6 years after the end of the tax year they belong to, because HMRC requires it. When you close your account the invoices are kept, but your name and contact details are removed from everything else.
• Sign-in and security records: 12 months.
• Email: for as long as it is useful for helping you, and no longer than 3 years.

How we protect it

Everything travels over encrypted connections. Passwords are stored only as hashes. Staff accounts require two-step sign-in. Each person can see only the businesses they belong to. Our logs never contain names, email addresses or card details. If a breach ever put your rights at risk, we would tell you and the Information Commissioner’s Office without undue delay, and within 72 hours of knowing.

Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to limit what we do with it, ask for it in a form you can take elsewhere, and object to our using it where we rely on legitimate interests. None of our decisions about you are made automatically.

To use any of these rights, email hello@madebynight.co.uk. We answer within a month and we do not charge. If you are not happy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you told us first so we can put it right.

Changes to this notice

The date at the top says when this notice last changed. If a change matters to you, such as a new company receiving your data, we email account holders before it takes effect.