Privacy Policy

This Privacy Policy explains how Bleepy ("we," "us," or "our") collects, uses, and protects your personal information when you use our platform, website, or related services.

This policy complies with the General Data Protection Regulation (GDPR), UK GDPR, and other applicable privacy laws. By using our service, you consent to the data practices described in this policy.

Bleepy acts as the Data Controller for individual user data and as a Data Processor for data uploaded by organisations. Bleepy is currently a pre-incorporation trading name. There is no UK company number or registered office yet. Those details will be added here when the company is formed.

We use your information to:

• Provide and improve the Bleepy platform
• Facilitate events, resources, and learning activities
• Manage subscriptions and payments
• Communicate important updates via email and push notifications
• Send event reminders, booking updates, certificate notifications, and feedback requests via push notifications
• Maintain platform security and integrity
• Comply with legal obligations
• Analyse Foundation Year / placement blog engagement (only with analytics consent) to improve educational content
• Generate personalised feedback, reports, and certificates

We process your data under the following legal bases:

We may send communications about Bleepy and relevant professional opportunities or products.

You can opt out at any time via email footer links or by contacting support@bleepy.co.uk.

Bleepy offers push notifications to keep you informed about important events, bookings, certificates, and feedback requests. Push notifications are optional and require your explicit consent.

Data Collection: To deliver push notifications, we store your browser's push subscription endpoint, encryption keys (p256dh and auth), and your notification preferences. This data is stored securely and is only used to send notifications you've requested.

Service Workers: Push notifications use browser service workers to deliver messages even when the Bleepy website is not open. The service worker code is stored locally in your browser and does not track your browsing activity.

To manage your push notification preferences, visit your profile settings page or contact support@bleepy.co.uk.

You can download a complete copy of your account's data yourself at any time from Dashboard → Privacy & Data. It is an Excel file, which is a commonly used, machine-readable format, with one sheet for each kind of data.

You can also ask us for a copy by contacting support@bleepy.co.uk. We will verify your identity and respond within one month.

• Active accounts: Retained for as long as your account remains active.
• Inactive accounts: Retained for 7 years after last activity, so you can still evidence your training. They are not automatically deleted.
• Closed accounts: When you close your account, we remove your name, email address, contact details, profile, settings and personal content (such as portfolio files) within 7 days. Your organisation's training records about you (bookings, attendance, certificates and payments) are kept for 7 years without your name, because organisations need them to evidence education and for tax. Download your certificates before you close your account, as you will no longer be able to. To ask for those records to be erased as well, contact the organisation that ran the training: it decides what happens to its records.
• System and billing records: Billing and tax records are retained for up to 7 years to comply with UK tax and accounting laws (HMRC requirements). Operational application logs (system_logs, including blog-analytics rows stored there) are deleted automatically after 90 days. Sign-in records (when and how an account signed in, with no passwords or codes) are deleted automatically after 12 months.
• Analytics: Retained for 2 years and anonymised after 1 year.
• Foundation Year / blog analytics: Retained while useful for content improvement (up to 2 years), or until you withdraw analytics consent or request deletion. Platform administrators may also delete analytics records. You can withdraw consent via the cookie banner preferences or Dashboard → Privacy & Data.
• Event bookings: Retained for 7 years after the event date, so attendance can be evidenced later.
• Certificate data: Retained for 7 years for verification and education-record compliance.
• Organisation data: Retained up to 90 days after subscription cancellation for export or reactivation, unless deletion is requested earlier.

Data is primarily stored in the UK and EEA.

Some sub-processors may process data outside the UK. Where they do, the transfer is covered by UK adequacy regulations or by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

For a complete list of our sub-processors and their data processing locations, see our Sub-Processors page.

We use trusted third-party providers to operate our Services securely and reliably. These sub-processors process personal data on our behalf.

We only use sub-processors that meet security, privacy, and compliance standards consistent with UK GDPR and EU GDPR, operate under written data-processing terms, and provide appropriate technical and organisational safeguards.

Paid teaching tickets are processed by Stripe. The organisation is the merchant. Bleepy does not store card numbers. Event location lookup uses Google Maps / Places. Sign-up, contact, and site-feedback forms use Google reCAPTCHA. OpenAI is used for optional bulk-upload extraction and feedback-report drafting; prompts and outputs are not kept beyond that product need. See the full list on our Sub-Processors page.

We implement appropriate technical and organisational measures to protect your data.

If a data breach occurs that poses a risk to individuals, Bleepy will:

• Notify the ICO within 72 hours (where legally required)
• Notify affected users without undue delay
• Provide details of the breach and mitigation steps

Bleepy is intended for people aged 16 and over. If an organisation invites someone aged 13 to 15, that organisation is responsible for getting consent from a parent or guardian. Bleepy does not allow data about children under 13, and we delete it if we find it (see our terms of use).

Bleepy is run from the UK for UK organisations. We process personal data under UK GDPR and the Data Protection Act 2018, and the EU GDPR where it applies.

You have the right to:

• Access your data
• Request correction or deletion
• Withdraw marketing consent
• Withdraw analytics consent (cookie preferences or Dashboard → Privacy & Data), which stops Foundation Year / blog reading analytics
• Request data portability
• Object to processing
• Restrict processing (e.g., pending verification of accuracy)
• Lodge a complaint with the ICO or your supervisory authority

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

If Bleepy or its assets are acquired, data may be transferred under equivalent privacy obligations.

Users will be notified as required by law.

Our services may include links to external websites.

We are not responsible for their content or privacy practices.

Please review their privacy policies before sharing personal information.

We may update this policy periodically.

Material changes will be notified via the platform or email.