Privacy Policy

This policy explains how Foldout handles personal data: what we collect, why, who we share it with, how long we keep it and the rights you have. It covers the Foldout website (foldout.link), the Foldout dashboard (app.foldout.link) and the widgets venues embed on their own websites.

1. Who we are

Foldout is run by Roughton Media Ltd, a company registered in Scotland (company number SC896469), registered office 38 Buccleuch Street, Edinburgh EH8 9LP. In this policy “Foldout”, “we” and “us” mean Roughton Media Ltd.

For anything about this policy or your data, email privacy@foldout.link or write to us at the address above.

2. Our two roles

We are the controller for data about the people who use Foldout itself: account holders and their team members, people who contact us or ask for access, and visitors to foldout.link.

We are a processor for data venues collect through Foldout: enquiries sent through their forms, members of their loyalty schemes, and reviews they display. The venue is the controller of that data and decides how it is used; we handle it only on their instructions, under our Data Processing Agreement. If you sent an enquiry to a venue or joined its loyalty scheme, the venue’s own privacy notice applies, and the venue is the right place to start if you want to access or delete that data. We will help them respond.

3. What we collect and why

UK data protection law requires a lawful basis for each use of personal data. These are the data we collect as controller, what we use them for and the basis we rely on.

We don’t sell personal data, we don’t use it for advertising, and Foldout widgets don’t load advertising or cross-site tracking code on venue websites.

4. Data we hold for venues

As a processor, we store and handle the following for the venues that use Foldout:

• Enquiries sent through a venue’s forms: usually name, email, phone number, preferred date, party size and message, plus whatever else the venue asks for. We deliver them to the venue by email and keep them in its dashboard. Bot checks run through Cloudflare Turnstile.
• Loyalty scheme members: name, email or phone number, membership number, points, visits, rewards, and a record of when and how they agreed to the venue’s privacy notice. If a member adds their card to Apple Wallet, we also hold the identifiers Apple gives us to update the card on their device.
• Reviews a venue shows on its website, either typed in by the venue or imported from Google or Tripadvisor, including the reviewer’s display name, rating and review text as published there.

5. AI assistants you connect

If you connect an AI assistant such as Claude or ChatGPT to your Foldout account (see Connect Foldout to Claude or ChatGPT), Foldout sends that assistant the widget content it asks for, limited to the venues your login can manage and the permissions you approved. That can include the email addresses enquiry forms deliver to. It never includes form submissions, loyalty members, billing or passwords. We store the connection itself (which app, which permissions, when it was last used) and record every change it makes in your activity log. You can disconnect it at any time in Settings, which stops access straight away. The assistant’s own handling of that content is governed by its provider’s privacy policy, not this one.

6. Who we share data with

We use the service providers below to run Foldout. Each one only gets the data it needs for its job, under a contract that requires it to protect that data.

Stripe processes subscription payments for Foldout plans as an independent controller under its own privacy policy. We may also share data with professional advisers, with a buyer if Foldout’s business is sold (who would have to honour this policy), or where the law requires it.

7. International transfers

Our database is in the EU (Ireland). Some providers above are based in, or can access data from, countries outside the UK and EU, including the United States. Where that happens we rely on a UK adequacy decision (for example the UK Extension to the EU–US Data Privacy Framework, where the provider is certified) or on the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. Ask us for details of the safeguard for a particular provider.

8. Cookies and similar technologies

To change your analytics choice, clear this site’s data in your browser and the banner will ask again. You can also block cookies in your browser settings.

9. How long we keep data

• Account data: while your account is open. When it closes we delete it, apart from records we must keep by law, such as invoices and transaction records, which we keep for six years.
• Enquiries: for the period the venue sets (24 months unless they change it), then deleted automatically.
• Loyalty members: until the venue removes them. Paused members inactive for longer than the venue’s retention period (24 months unless changed) are anonymised automatically.
• Sales and access requests: as long as we need to reply and follow up, and no longer than 24 months after our last contact.
• Widget error reports: 30 days. Delivered email jobs: 30 days. Abuse-prevention counters: until they expire, usually within a day.
• AI assistant connections: until you disconnect. Access lapses after 30 days without use and must be approved again after 90 days.

10. Security

Data is encrypted in transit and at rest, access is limited by role and venue, and changes are logged. More detail is on our Trust & security page. If a breach puts your data at risk we will tell you, and the regulator where required, without undue delay.

11. Your rights

Under UK data protection law you have the right to:

• get a copy of your personal data;
• have it corrected if it’s wrong;
• have it deleted;
• restrict how we use it, or object to our using it on the basis of legitimate interests;
• receive it in a portable format, or have it sent to another provider;
• withdraw consent at any time, where we rely on consent.

Email privacy@foldout.link. We reply within one month. For enquiry, loyalty or review data, contact the venue first (see section 2).

If you’re unhappy with how we handle your data, please tell us so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

12. Children, automated decisions and changes

Foldout is a service for businesses and isn’t aimed at children. We don’t make decisions about people by automated means that have legal or similarly significant effects. If we change this policy we’ll update the date at the top, and tell account holders by email before any significant change takes effect.

Related: Terms of Service · Data Processing Agreement · Security