How we use your information

Who we are

The Tooth Fairy Teeth Whitening is the controller of the personal information described in this notice. You can contact us at info@thetoothfairytw.com.

Information we collect

• Your name, email address, telephone number, Instagram account identifiers and any Instagram or TikTok username you provide.
• Enquiries and messages you send to us, including Instagram direct messages and enquiries submitted through our website form.
• Appointment, treatment and attendance information needed to manage your booking.
• Payment amount, payment status and transaction references. We do not store your full card number.
• Our follow-up history, review requests and top-up reminders.
• How you heard about us, your optional marketing preference, and the date and version of the booking terms and suitability statement you accepted. Detailed clinical information is discussed with your practitioner.

Our enquiry form records your request to be contacted, where you say you found us, its source link and a submission reference so retries can be handled safely. It does not sign you up for marketing.

We receive this information directly from you and, where relevant, from Instagram/Meta, Acuity Scheduling and Stripe when you use those services to contact, book or pay us.

Why we use it

• To answer enquiries and follow up about services you asked about. This supports our legitimate interest in responding to potential customers.
• To arrange and deliver appointments, take deposits and manage payments. These are steps requested before entering into a contract and part of performing our contract with you.
• To keep financial and business records. This supports compliance with legal obligations and our legitimate interests in running and protecting the business.
• To send relevant appointment, review and top-up reminders. This supports our legitimate interest in customer care, or consent where the law requires it.

The Command Centre automates reminders and organises enquiries, but we do not make solely automated decisions about you that have legal or similarly significant effects.

Who processes it

We use trusted service providers to operate the business and this system, including Meta/Instagram, Acuity Scheduling (Squarespace), Stripe, Supabase, Vercel and Resend. They process information only for the services they provide to us and under their own security and privacy terms. Some providers may process data outside the UK; where they do, we rely on the safeguards required by UK data-protection law.

How long we keep it

We keep enquiry information only for as long as it remains useful for handling your request and maintaining an appropriate customer history. Booking, payment and accounting records may be kept for up to six years where needed for tax, accounting or legal purposes. We securely delete or anonymise information when it is no longer required.

Your rights

Depending on the circumstances, you may ask us for a copy of your information, ask us to correct or delete it, restrict or object to its use, or ask for it in a portable format. Where we rely on consent, you can withdraw it at any time. Email us to exercise a right. You can also complain to the UK Information Commissioner’s Office at ico.org.uk.