1. Who we are and when this policy applies
MyCakeShed provides online storefront, ordering and business-management tools for independent bakers. This policy explains how MyCakeShed uses personal information when you visit the platform, create an account, apply for a shed, place an order or contact us.
DOBBA LTD (a company registered in England and Wales, company number 17377286), of 46 Banksfield Avenue, Preston, PR2 3RN, United Kingdom, operates MyCakeShed and is the data controller for platform accounts, applications, security and service administration. A baker is normally a separate data controller for the customer information they receive to prepare, deliver and support an order. Questions about a specific order may therefore need to be handled by that baker.
2. Information we collect
We collect information you provide, information created when the service is used, and limited technical information needed to operate the platform.
- Account details such as name, email address, encrypted password credentials and profile image.
- Baker application and business details, including trading information, fulfilment details, insurance confirmations and uploaded branding.
- Customer order details, including contact details, delivery or pickup information, order notes, selected products and allergen acknowledgements.
- Transaction records, payment status, refunds and payout references. Full card details are handled by Stripe and are not stored by MyCakeShed.
- Support messages, notification preferences and communications about an account or order.
- Security and diagnostic data such as sign-in events, session identifiers, error information and operational logs. We do not intentionally record full payment-card details.
- Limited first-party audience information: an in-memory random page-session identifier, the MyCakeShed page viewed, a broad source category, referral hostname and any campaign tags in the link. We do not store the full referral URL, IP address or user agent in the product-analytics record.
3. How and why we use information
We use personal information only where we have a lawful basis under UK data-protection law.
- To provide accounts, storefronts, baskets, checkout, order management, payments and customer communications where this is necessary to perform a contract or take steps requested before a contract.
- To verify accounts, prevent fraud, secure the service, improve reliability and support users where this is necessary for our legitimate interests and those interests are not overridden by your rights.
- To understand how people discover MyCakeShed and where bakers encounter onboarding difficulties, using aggregated first-party funnel reporting and data-minimisation controls.
- To keep transaction, tax and compliance records where required by law.
- To send optional marketing only with consent where consent is required. You may withdraw consent at any time.
- To establish, exercise or defend legal claims and enforce the platform terms.
4. Sharing information
We share information only as needed to provide and protect the service. Customer order details are shared with the baker whose storefront received the order. Bakers must use that information only for legitimate order and customer-service purposes.
Cloudflare provides hosting, content delivery and network security services and may process IP addresses, request information and security events. Amazon Simple Email Service (Amazon SES) delivers service emails and may process recipient addresses, message content and delivery events. We may also use providers for database and file storage, monitoring, authentication and professional advice.
Stripe processes payments, subscription billing and connected-account payouts. Google or Microsoft receives information when you choose its sign-in service. Each provider handles information under its own terms and privacy notice.
We may disclose information where required by law, to protect users or the service, or as part of a business sale or reorganisation subject to appropriate safeguards.
5. International transfers
Some providers may process information outside the United Kingdom. Where UK personal information is transferred internationally, we use an adequacy decision or appropriate contractual and organisational safeguards as required by law. You may contact us for more information about the safeguard used for a particular provider.
6. How long we keep information
We keep personal information only for as long as needed for the purpose described above. Account information is normally kept while the account is open. Core order, payment, refund and fee records may be retained for up to six years after the relevant transaction for accounting, tax and legal purposes. Unsuccessful baker applications are normally deleted or anonymised within 12 months. Routine support records are normally kept for up to two years and short-lived security logs for up to 90 days, unless a longer period is needed to investigate an incident or legal claim.
When information is no longer needed, it is deleted or anonymised. Backups may retain residual copies for a limited period before automatic expiry.
Anonymous browser acquisition events are automatically deleted after 13 months. Application and shed activation milestones follow the retention period of the related business record.
7. Your rights
Depending on the circumstances, you may have the right to access, correct, erase or restrict personal information; object to certain processing; receive portable data; and withdraw consent. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk.
- Contact [email protected] to make a request. We may need to verify your identity.
- For information held by a baker about a specific order, contact that baker first. We will assist where MyCakeShed is responsible for the relevant processing.
- No solely automated decision with legal or similarly significant effects is currently used to decide whether a customer may order or a baker may join.
8. Security, children and changes
We use access controls, encrypted connections, hashed session tokens and other technical and organisational measures designed to protect information. No online service can guarantee absolute security, so please use a strong password and tell us promptly if you suspect misuse.
MyCakeShed is not directed to children and accounts may be created only by people able to enter a binding contract. We may update this policy when the service or law changes. Material changes will be highlighted on the platform or communicated where appropriate.