1. Who We Are

Schemester Ltd ("Schemester", "we", "us", "our") is a company registered in England and Wales (Company No. 14872651) with its registered office at 1 Shoreditch High Street, London, E1 6JE, United Kingdom.

We operate the Schemester platform — a group event and scheme planning service — available via our website at schemester.com and our mobile applications. We are the data controller in respect of the personal data we collect from you.

2. What Data We Collect

We collect data you provide directly, data generated through your use of our service, and data from third parties.

• Name, email address, and password (hashed)
• Phone number (optional, for SMS notifications)
• Profile photo and bio
• Social accounts you choose to connect

• Schemes you create, join, or are invited to
• Messages, polls, votes, and files shared within schemes
• Budget contributions and payment records
• Calendar events synced from schemes

• IP address, browser type, and operating system
• Pages visited, features used, and time spent
• Push notification tokens
• Crash reports and performance diagnostics

Payment card details are processed directly by our PCI-DSS certified payment provider (Stripe). We store only the last 4 digits of your card and expiry date for display purposes. We never store full card numbers.

3. How We Use Your Data

• Providing the service — creating and managing your account, processing payments, enabling scheme collaboration
• AI suggestions — using scheme details to surface relevant deals, venues, and savings (anonymised where possible)
• Communications — sending transactional emails, payment confirmations, and scheme notifications
• Safety & security — detecting fraud, abuse, and unauthorised access
• Product improvement — analysing usage patterns to improve features (using aggregated, anonymised data)
• Legal obligations — complying with financial regulations, tax law, and court orders

4. Legal Basis for Processing

Under UK GDPR and the Data Protection Act 2018, we process your personal data on the following legal bases:

• Contract performance — processing necessary to provide the Schemester service you signed up for
• Legitimate interests — fraud prevention, product analytics, and security monitoring
• Legal obligation — retaining financial records as required by HMRC and applicable law
• Consent — marketing emails and optional cookies (you can withdraw consent at any time)

5. Sharing Your Data

We share your data only in the following circumstances:

• With other scheme members — your name, profile photo, and activity within a shared scheme are visible to other members of that scheme
• With service providers — we use carefully vetted sub-processors (e.g. Stripe for payments, AWS for hosting, Intercom for support) who are contractually bound to protect your data
• Legal requirements — if required by law, court order, or to protect the rights and safety of Schemester and our users
• Business transfers — in the event of a merger or acquisition, your data may be transferred to the successor entity subject to the same privacy protections

6. Cookies and Tracking

We use cookies and similar technologies to keep you logged in, remember your preferences, and understand how the service is used. You can manage your cookie preferences at any time via Settings → Privacy → Cookie preferences.

• Essential cookies — required for authentication and security. Cannot be disabled.
• Functional cookies — remember your theme, language, and layout preferences
• Analytics cookies — anonymised usage data to improve the product (opt-out available)

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service. If you delete your account:

• Your profile and scheme data is deleted within 30 days
• Messages in shared schemes are anonymised immediately
• Financial records are retained for 7 years as required by UK tax law
• Backup copies are purged within 90 days

8. Your Rights

Under UK GDPR you have the following rights regarding your personal data:

• Access — request a copy of all data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — limit how we use your data in certain circumstances
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests or for direct marketing
• Automated decisions — request human review of any automated decision that significantly affects you

To exercise any of these rights, contact us at privacy@schemester.com or use the Data Export / Delete Account tools in Settings. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. International Transfers

Your data is primarily stored on servers in the European Economic Area (EEA). Some of our sub-processors may process data outside the EEA. Where this occurs, we ensure appropriate safeguards are in place — such as Standard Contractual Clauses approved by the European Commission — to ensure your data receives equivalent protection.

10. Children's Privacy

Schemester is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us immediately and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and display a banner within the app at least 14 days before the changes take effect. The "Last updated" date at the top of this page will always reflect the most recent revision. Continued use of Schemester after the effective date constitutes acceptance of the updated policy.

12. Contact Us

For any privacy-related queries, requests, or complaints:

• Email: privacy@schemester.com
• Post: Data Protection Officer, Schemester Ltd, 1 Shoreditch High Street, London, E1 6JE
• Response time: We aim to respond to all requests within 5 working days