Privacy policy

FindPopups is a discovery platform operated by FindPopups Ltd, United Kingdom. We help customers discover street food vendors, food trucks, artisan traders, farmers markets, pop-up events, and local markets. We also provide tools for vendors and event hosts to manage their business presence. Data Controller: FindPopups Ltd, United Kingdom Privacy enquiries: privacy@findpopups.com

When you use FindPopups, we collect: Account data: name, email address, and authentication details when you register. Profile data: business name, description, logos, cover images, location names, and trading schedules (vendors and hosts). Location data: precise latitude/longitude of trading locations and vendor schedules. This is used to power the map and nearby discovery features. Payment data: your payment is processed by Stripe Inc. We receive confirmation of payment and subscription status but do not store your full card details. We store your Stripe customer ID and subscription status to manage your plan. Bookings: when you book a vendor for a private event, the date, times, event address, number of guests, your phone number and any notes, which the vendor sees so they can plan and contact you. Stripe keeps your card for the deposit and balance; we keep the amounts and Stripe's payment references. Payout data (vendors who take bookings, and venues paid for chair bookings): Stripe Connect collects the identity and bank details it needs to check and pay you. We keep the Stripe account reference and whether payouts are ready. Usage data: pages visited, features used, time spent, browser type, and approximate IP address (via Google Analytics, Microsoft Clarity and DriftWatch, only with your consent). Clarity records how pages are used, with personal details on the page masked. Support chat: if you open support chat from a vendor or host account, your name, email address and the messages you send. Professional profile and insurance certificate (stylists and other professionals who use FindChairs or FindStudios with this account): your trades or disciplines, qualifications, portfolio and Instagram links, your mobile number if you add one, and your insurance certificate with its expiry date. We hold the certificate to check you're insured before a booking is confirmed. Only you and the FindPopups team members who check it see it, never the salon or studio. It's deleted 12 months after the cover it shows ends, when you upload a new one, or when you delete your account. The FindChairs and FindStudios privacy policies have the details. Reviews: if you leave a review, we store the review text, rating, and your display name. Communications: messages sent between vendors and hosts via the inbox feature. Saved items and follows: vendors and events you have saved or followed. Device data: your location, only when you use Nearby, Near me or Use my location, or, if you have already allowed this site to use your location, to centre the map and show what's near you when you open the home, vendors or events page. It is not stored on our servers. Your browser keeps a position you asked for until you close the tab, and does not keep one read when a page opens.

We use your data to: • Operate and provide the FindPopups platform • Process your subscription and manage billing via Stripe • Take payments for private event bookings and pay vendors, and venues for chair bookings, through Stripe • Display vendor profiles, schedules, and events publicly (approved vendors only) • Power the map, search, and nearby discovery features • Send you transactional emails (account approval, application updates, reminders) based on your notification preferences. Booking confirmations, payment notices and cancellations are always sent. • Send you news and tips by email, only if you opted in at sign-up or in your settings. Every one has an unsubscribe link. • Analyse how the platform is used to improve the service (analytics cookies, only with your consent) • Measure our Facebook and Instagram ads (the Meta Pixel, only with your marketing consent) • Research markets, events and vendors to list, from public web pages • Investigate abuse reports and enforce our terms of service • Comply with legal obligations We never sell your personal data to third parties. We do not use your data for automated decision-making or profiling that produces legal effects.

We process your personal data under the following lawful bases: Contract (Article 6(1)(b)): providing the service you signed up for, including displaying your vendor profile, processing your subscription, taking payments for bookings and paying vendors and venues, and sending essential notifications. Legitimate interests (Article 6(1)(f)): preventing fraud and abuse, improving the platform, security monitoring, and sending non-marketing service communications. Consent (Article 6(1)(a)): analytics and marketing cookies, including the Meta Pixel and Microsoft Clarity (you can withdraw at any time with Cookie settings); marketing emails (you can unsubscribe at any time). Legal obligation (Article 6(1)(c)): retaining financial records and responding to lawful requests from authorities.

We share data with the following trusted third parties only as necessary: Firebase (Google LLC): database, authentication, and file storage. Your account data and uploads are stored in Firebase. Firebase is certified under the EU-U.S. Data Privacy Framework. See: https://firebase.google.com/support/privacy Google reCAPTCHA (Google LLC): checks that new accounts aren't created by bots. Google Analytics 4 (Google LLC): website analytics, loaded only with your consent. Data is processed in the US under Google's Standard Contractual Clauses. Microsoft Clarity (Microsoft Corporation): heatmaps and recordings of how pages are used, with personal details masked, loaded only with your consent. DriftWatch: website analytics, loaded only with your consent. Meta Platforms (the Meta Pixel): measures our Facebook and Instagram ads, loaded only with your marketing consent. See: https://www.facebook.com/privacy/policy Stripe Inc: payment processing for subscriptions and bookings. We pass your email address and billing details to Stripe. Stripe is PCI-DSS compliant. See: https://stripe.com/gb/privacy Stripe Connect (Stripe Inc): identity and bank checks and payouts for vendors who take bookings and venues paid for chair bookings. Google Maps Platform (Google LLC): map display and location autocomplete. Your search queries may be sent to Google. See: https://policies.google.com/privacy Resend (Resend Inc): transactional email delivery. We pass your email address and first name to send you notifications. Intercom: in-app support chat for vendor and host accounts, loaded only when you open it. OpenAI: reads public web pages when we research markets, events and vendors to list, to pull out business details such as names, public contact details, dates and places. We don't send it your account data. Render: hosting for the website. Cloudflare: delivers the website and protects it from attacks.

Some of our third-party processors (Google, Microsoft, Meta, Stripe, Resend, Intercom, OpenAI, Render and Cloudflare) are based in the United States or process data there. Where we transfer data outside the UK, we rely on Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner or equivalent adequacy mechanisms to ensure your data receives the same level of protection as required under UK GDPR.

We use cookies and similar technologies. Essential cookies are always active. Analytics and marketing cookies are only set with your explicit consent. See our cookie policy for full details: /cookies You can change your cookie choices at any time with "Cookie settings" in the footer or in the menu at the top of the page.

If you use the "Use my location", "Nearby" or "Near me" feature, we request your device's geolocation via the browser's Geolocation API. We only ask when you use one of these features. If you have already allowed this site to use your location, the home, vendors and events pages also read it when they open, without asking again, to centre the map and show what's near you. Your location is used to show what's near you and is not stored on our servers or in your profile. Your browser keeps a position you asked for until you close the tab, and reuses it for 5 minutes so the next search doesn't ask again (see the cookie policy); it does not keep one read when a page opens. A near-me search puts an approximate position (to about a kilometre) in the page address, so the results can be reloaded or shared. You can revoke location access at any time in your browser settings. Vendors set precise trading locations (lat/lng) when creating their schedules. These trading locations are publicly visible on the map and in vendor profiles, as this is the core purpose of the platform.

We retain your personal data for as long as your account is active or as required to provide the service. When you delete your account (Settings > Delete account), we: • Cancel any subscription, so you are not charged again, and remove your saved cards • Delete your profile, uploaded files, saved items, follows, notifications and email history • Keep your reviews, shown as "Deleted user" (text preserved for platform integrity, your name and photo removed) • Take your name and contact details off bookings, claims and messages • Take any vendor, host or venue profile you own offline, and archive your events You can't delete your account while a booking is still upcoming. Cancel it first. Booking contact details: • A booking request that never went ahead loses the name, phone number, notes and event address 30 days after it was made • A booked event loses the phone number, notes and event address 90 days after the event date We retain financial records (subscription history, booking amounts, dates and payment references) for up to 7 years to meet UK legal obligations. Notifications are deleted after 12 months, and our record of emails sent to you after 24 months. For an automatic email we only send you once, we keep a note that it was sent, without your email address, so it isn't sent again.

You have the following rights regarding your personal data: Right to access: request a copy of your data (use the "Export my data" feature in Settings). Right to rectification: correct inaccurate data via your account settings or by contacting us. Right to erasure: delete your account and personal data via Settings > Privacy & Data > Delete account. Right to restriction: request we restrict processing of your data while we resolve a dispute. Right to portability: download your data in machine-readable JSON format via Settings. Right to object: object to processing based on legitimate interests. Right to withdraw consent: update or withdraw cookie consent at any time, and stop marketing emails with the unsubscribe link in any of them or in your email settings. To exercise any right, contact privacy@findpopups.com. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): https://ico.org.uk/concerns

We implement appropriate technical and organisational security measures including: • Firebase Authentication for secure login • Firestore Security Rules to restrict data access to authorised users • HTTPS encryption in transit (enforced by Cloudflare and Render) • Stripe's PCI-DSS compliant infrastructure for payment data • Role-based access control (customer, vendor, host, admin) No method of internet transmission is 100% secure. If you discover a security issue, please report it responsibly to security@findpopups.com.

FindPopups is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@findpopups.com and we will delete it.

We may update this privacy policy from time to time. We will notify you of significant changes by email (if you have an account) or by displaying a prominent notice on the platform. The "Last updated" date at the top of this page indicates when it was last revised. Continued use of the platform after changes constitutes acceptance of the updated policy.

For any questions, requests, or concerns about this policy: Email: privacy@findpopups.com Post: FindPopups Ltd, United Kingdom For data subject rights requests, please use the email above with "Data Rights Request" in the subject line.