Privacy Policy — PootlrHost

Who we are

PootlrHost is run by Pootlr, a trading name of Thokki Digital Ltd, registered in England and Wales, company number 14359285, registered office 82 Oswald Road, Scunthorpe, DN15 7PA. When we say "we", "us" or "our" in this policy, we mean Pootlr (Thokki Digital Ltd). When we say "PootlrHost", we mean the online platform we run for campsites: the dashboard, campsite websites, booking pages, booking widgets and guest pages.

We are committed to protecting your privacy and handling your personal data transparently and fairly, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Our role: campsites and their guests

PootlrHost is used by campsites ("Hosts") to run their websites and bookings. Who is responsible for your data depends on who you are:

Campsite owners and their staff — we are the controller of your account, billing and support data.
Guests booking a campsite — the campsite is the controller of your booking data, and we process it on the campsite's behalf as its processor. The campsite decides what it asks for and how it uses it; we only use it to run the campsite's bookings, payments, messages and stay pages. Every campsite's website has its own privacy notice, linked at the foot of its pages and from its booking form, which says who the campsite is and how to reach it. For anything about your booking or your data, contact the campsite first. If you contact us instead, we'll pass your request on and help the campsite answer it.
Visitors to our own website — we are the controller of anything you send us, such as a message through our contact form.

What data we collect

We may collect and process the following personal data:

Account information — your name, email address, and password when you register for a PootlrHost account, and the same for any staff you invite.
Site and business details — campsite name, address, description, photos, and pricing information you provide when setting up your site.
Guest and booking data — for each booking: the guest's name, email address and phone number, the dates, pitch, party size, extras and any notes, payment status, messages between the guest and the campsite, and any review the guest leaves. Bookings synced from Pitchup bring the same details with them.
Payment information — we never see or store full card numbers. Cards are entered into Stripe's own payment form. We store Stripe's references for customers, payments, saved cards and connected accounts, and the card type and last four digits of an owner's card so the billing page can show which card is on file.
Technical data — your IP address and browser type, which are stored with your signed-in session and used to keep accounts secure and to limit abuse, such as repeated failed sign-ins. We don't track which pages you visit, and we don't use analytics or advertising tools.
Communications — any messages or emails you send to us.

How we use your data

We use your personal data for the following purposes:

To provide, maintain, and improve PootlrHost and its features.
To take bookings and payments for campsites, and to send guests the booking emails and text messages the campsite has set up.
To manage owners' accounts and plans, including charging the Pro subscription and booking fees through Stripe.
To send you important service-related communications (booking confirmations, account updates, etc.).
To respond to your enquiries and provide customer support.
To keep the platform secure and prevent fraud.
To comply with our legal obligations.

Legal basis for processing

Where we are the controller, we process your personal data on the following legal bases under the UK GDPR:

Contract — processing necessary to provide our services to you under our Terms of Use.
Legitimate interests — to improve our platform, prevent fraud, and ensure security.
Legal obligation — to comply with applicable laws and regulations, such as keeping accounting records.
Consent — where you have given us specific consent for a particular purpose (e.g., marketing communications).

For guest booking data, the campsite decides the legal basis, which is usually the contract for your stay.

Cookies

We only use cookies that the platform needs to work. We don't use analytics or advertising cookies. These are the cookies you may get:

Session cookie (pootlrhost-session) — keeps you signed in, and keeps a guest's booking or "Your stays" sign-in going. It expires after 2 hours without activity.
Security cookie (XSRF-TOKEN) — protects forms against cross-site request forgery. It lasts as long as your session.
Remember me (remember_web_…) — only if you tick "Remember me" when signing in, so you stay signed in on that device until you sign out.
Dashboard menu (sidebar_state) — remembers whether the dashboard menu is open or closed, for 7 days.
Stripe — on pages where you pay or add a card, Stripe's payment form sets its own cookies to prevent fraud. See Stripe's cookie policy.

The dashboard also saves a few display choices in your browser's local storage, such as hints you've dismissed. You can control cookies through your browser settings. Blocking these cookies will stop you signing in, booking or paying.

Data sharing

We do not sell your personal data. We share it only with the service providers below (our sub-processors), each for the reason given, and with law enforcement where the law requires it or to protect our rights.

Stripe (payments and Stripe Connect) — takes guests' card payments and passes them to the campsite's own Stripe account, saves a guest's card when a balance is due later, charges owners' Pro subscriptions and booking fees, and verifies the campsite when it connects its Stripe account. Stripe receives card details directly from you, plus the amount and booking details such as the campsite, pitch and dates. Stripe acts as an independent data controller for some payment data. See Stripe's Privacy Policy.
Brevo (email delivery) — sends our emails: booking confirmations, reminders and other guest emails, owner notifications and sign-in emails. It receives the recipient's name and email address and the content of the email.
The SMS Works (text messages) — sends the booking text messages a campsite turns on. It receives the guest's phone number and the message, which includes their name, the campsite and their dates.
Cloudflare (network, DNS and custom domains) — our sites run behind Cloudflare, which protects them and handles web traffic, so it processes visitors' IP addresses and requests. It also receives a campsite's own domain name when the campsite connects one.
Pitchup (channel sync) — only for campsites that connect their Pitchup account. We send Pitchup the campsite's availability (how many pitches are free on each date, no guest details) and receive the campsite's Pitchup bookings, including the guest's name, email address and phone number.
Anthropic (Insights) — when an owner asks a question in Insights, we send Anthropic the question and the campsite's summary figures: revenue, booking and occupancy totals, the weather forecast and upcoming local events. We don't send guests' names or contact details.
Mapbox (address lookup) — when an owner types their campsite's address while setting up, the browser sends what they type to Mapbox to suggest matching addresses.
Hosting providers — the companies that host our servers and database store all of the data above on our behalf.

We also use Open-Meteo to fetch weather forecasts. It receives only the campsite's map location, not personal data.

Services your browser loads

Some pages load fonts, scripts, images or maps from other companies, so your browser sends them your IP address when you visit: Google Fonts and Bunny Fonts (fonts), jsDelivr and unpkg (page scripts), and OpenStreetMap, Esri and Google (map tiles on site maps).

International transfers

Some of these providers, such as Stripe, Cloudflare, Anthropic and Mapbox, may process data outside the UK, including in the United States. Where they do, we rely on the safeguards UK data protection law requires, such as UK adequacy regulations or the International Data Transfer Addendum.

Data retention

We retain your personal data for as long as your account is active or as needed to provide our services. If you close your account, your login is closed straight away. Your campsite's records stay in place so that bookings, payments and invoices can still be accounted for. Email us and we will delete or anonymise the rest within 90 days, unless we are required to retain it for legal or regulatory purposes.

Guest booking data is kept for as long as the campsite uses PootlrHost, unless the campsite deletes it sooner. Booking and payment records may be retained for up to 7 years for tax and accounting purposes. Signed-in sessions expire after 2 hours without activity.

Your rights

Under the UK GDPR, you have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct any inaccurate or incomplete data.
Erasure — ask us to delete your personal data ("right to be forgotten").
Restriction — ask us to restrict the processing of your data in certain circumstances.
Portability — request your data in a structured, commonly used format.
Objection — object to processing based on legitimate interests.

To exercise any of these rights, please contact us at [email protected]. If you're a guest, please ask the campsite you booked with first, as it controls your booking data; we'll help it respond.

Data security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. All data is transmitted over encrypted connections (HTTPS), and we regularly review our security practices.

Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the platform. We encourage you to review this page periodically.

Contact us

If you have questions about this Privacy Policy or how we handle your data, please get in touch:

Email: [email protected]
Company: PootlrHost is run by Pootlr, a trading name of Thokki Digital Ltd, registered in England and Wales, company number 14359285, registered office 82 Oswald Road, Scunthorpe, DN15 7PA.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated.