Privacy Notice
Last updated 4 October 2026
Who is responsible for your data
Bonnibel Pty Ltd (447 Honour Avenue, Graceville, Queensland 4075, Australia) is the controller of the personal data processed through Lucy at the Post. Contact: email support@lucyatthepost.co.uk or write to Bonnibel Pty Ltd, 447 Honour Avenue, Graceville, Queensland 4075, Australia.
What we collect
Account details: your email address, name and, if you set one, a securely hashed password. Your plan, passes and billing status. Sign-in times. Codes we email you for verification. If you buy, Stripe processes your card; we never see or store your card number.
Why we use it (and our lawful basis)
To run your account and provide the tips you pay for (contract). To keep the Service secure and prevent fraud (legitimate interests). To meet legal and tax obligations (legal obligation). To send marketing emails, only if you agree (consent; you can withdraw at any time).
Who we share it with
Service providers who process data for us: Stripe (payments), Resend (email delivery), Supabase (database hosting) and our hosting provider. They act on our instructions. We do not sell your data.
International transfers
Our providers may process data outside the UK. Where they do, the transfer is covered by safeguards such as UK adequacy regulations or the UK International Data Transfer Addendum.
How long we keep it
We keep account data while your account is open and for up to three months after it closes. Payment and tax records are kept for as long as the law requires. When you delete your account, we delete your account record and remove your email from purchase records we must keep.
Cookies
We use only strictly necessary cookies: your sign-in session, a short checkout session, and remembering that you confirmed you are 18 or over. We do not use advertising or tracking cookies.
Your rights
Under UK data protection law you can ask to access, correct or delete your data, to restrict or object to how we use it, and to receive it in a portable format. You can delete your account yourself at any time. You can complain to the Information Commissioner’s Office (ico.org.uk) if you are unhappy with how we handle your data.
Under 18s
The Service is for people aged 18 and over. We do not knowingly collect data from anyone younger and will delete it if we find we have.
Changes
We will update this notice when our practices change. Last updated: 4 October 2026.