Skip to main content
Pencilled

Privacy policy

Last updated 6 October 2026

Who we are

Pencilled is booking software for session-based pop-up experiences. It is run by [registered company name], registered at [registered address], company number [company number]. We are registered with the Information Commissioner’s Office under number [ICO registration number]. In this policy, “we” and “us” mean that company. For anything in this policy, contact hello@pencilled.app.

Who controls your data

When you book a session, you book with an independent operator, the business running the event. That operator is the data controller for your booking details and questionnaire answers: they decide why the data is collected and how long they need it. Pencilled is their data processor. We store and handle that data on their behalf and on their instructions.

Pencilled is the data controller for a small amount of data of its own: operator staff accounts, customer sign-in records (the email codes and sessions used for the account area), the operational records needed to run and secure the service, and, only where you agree to it, website measurement.

What we collect

  • Booking details. Your name, email address, optional phone number, the session and number of places you booked, the amount paid, any promo code or gift voucher used, and whether you were checked in. For a booking taken at the venue by the operator, we hold the name, number of people, optional email address and how it was paid (cash, card on the operator’s own reader, or no charge).
  • Waitlist entries. Your name and email address, and the session you asked to be told about.
  • Payments. Card payments are handled by Stripe. Your card details do not reach Pencilled’s servers. We keep the payment status, the amount, the platform fee and Stripe’s reference for the payment.
  • Questionnaire responses. Where an operator asks attendees to complete a form, such as a health and safety declaration, your answers may include health information. The operator decides what the form asks. Answers are shared only with that operator to run your session.
  • Customer accounts. If you sign in to the account area, we hold your email address, your name, the sign-in codes we sent you (stored in a form we cannot read back, and valid for ten minutes), your session, and any answers you saved to be filled in next time.
  • Gift vouchers. The purchaser’s name and email address and, if the voucher is a gift, the recipient’s name, email address and message.
  • Operator accounts. The name, email address and password (stored in a hashed form) of people who sign in to run an operator account.
  • Marketing consent. If an operator has connected a Mailchimp mailing list and you tick the box asking to hear from them when you book, we keep a record of that: the exact wording you agreed to, when you agreed, and whether your details reached their list. The box is never ticked for you. Because anyone can type another person’s address into a booking, this record shows what was ticked and not who ticked it: it does not on its own prove that the owner of the address agreed. That is why operators are asked to use Mailchimp’s confirmation email, which only the owner of the address can answer.
  • Emails. We send booking confirmations, tickets, form links, a reminder about a day before your session, notices when an operator cancels or refunds a booking, waitlist notices, sign-in codes and similar messages that are part of the service. They are not marketing.
  • Security records. IP addresses are used to limit repeated attempts, such as guessing a gift voucher code or requesting operator sign-up codes, and error logs are kept so we can fix faults.

Cookies and measurement

These are the cookies and storage we use:

  • pencilled_session: keeps an operator signed in to the dashboard. It lasts up to one week. Essential.
  • pencilled_customer: keeps a customer signed in to their account. It lasts up to 30 days. Essential, and only set if you sign in.
  • pencilled-consent: your cookie choice, kept in your browser’s local storage. It is never sent to us and is not used to identify you.
  • Google Analytics cookies (names starting _ga): set only if you agree. They let us see how many people use the site and which pages they reach. There is no advertising and no cross-site tracking here, and the advertising signals Google Analytics can carry are switched off for every visitor whatever you choose.

Nothing beyond the essential sign-in cookies is set until you say yes. The first time you visit you are asked, and declining is a single click on the same footing as accepting. You can change your mind at any time with the Cookie settings link in the footer of any page. Declining stops the measurement cookie from being set again, and anything already set can be cleared through your browser.

Our lawful bases

  • Booking data is used to perform the contract you make when you book. The operator relies on this basis, and we process the data for them.
  • Sign-in and security records rest on our legitimate interest in running the service safely.
  • Health information in questionnaire responses is collected with your explicit consent, given through the declaration you tick when you complete a form. If you would rather not answer online, speak to the operator at the venue.
  • Passing your name and email address to an operator’s Mailchimp list rests on your consent, which you give by ticking the box when you book and, where the operator asks Mailchimp to send a confirmation email, by confirming from your inbox. You can withdraw at any time using the unsubscribe link in the operator’s emails or by contacting them.
  • Measurement cookies rest on your consent.

How long we keep things

A job that runs every hour applies these periods. Each one is counted from the end of the session the booking or waitlist entry was for, except gift vouchers, which are counted from the dates given below. Removing personal data means the name, email address and phone number are erased, and a record of the booking without them is kept, so the operator’s order history and accounts still add up.

  • Paid and confirmed bookings: personal details are removed 24 months after the session ends.
  • Bookings that were started but never paid: personal details are removed 30 days after the session ends.
  • Marketing consent records: kept with the booking they belong to. Removing a booking or the details on it does not remove you from an operator’s Mailchimp list, which is covered below.
  • Waitlist entries: deleted 30 days after the session ends.
  • Questionnaire responses: deleted when the booking they belong to has its personal details removed, which is 24 months after the session ends for a paid booking. Responses taken on a tablet for someone with no booking are deleted at the same point. An operator can delete responses sooner: each event has a delete all action, and operators are asked to use it once the event is over and they no longer need the answers.
  • Customer accounts: a customer account is deleted, with its sign-in codes, sessions and saved form answers, once none of its bookings still has personal details attached.
  • Gift vouchers: the purchaser’s and recipient’s details are removed 24 months after the voucher is used up, cancelled or expires, and 30 days after a voucher that was never paid for was started.
  • Sign-in codes: valid for ten minutes. Sessions expire automatically, after one week for operators and 30 days for customers.
  • Backups: we take a nightly backup of the service and keep each for 30 days. Backups are not edited, so personal data removed from the service stays in the backups taken before then until they are deleted, at most 30 days later.

Who else handles the data

We use a short list of other providers, each bound by their own terms with us:

  • Stripe: card payments, refunds and payouts to operators.
  • Resend: delivery of the emails listed above.
  • Intuit Mailchimp, based in the United States: only if you tick the box to hear from an operator who has connected it. We send it your name and email address, and the name of the event you booked, so the operator can email you news and offers. The operator controls that mailing list and decides how it is used, and Mailchimp’s own privacy statement applies to it. Pencilled does not send marketing emails itself.
  • Hosting: the servers that run Pencilled and store its data, provided by [hosting provider and region].
  • Google Analytics: website measurement, only if you agree.

We do not sell data, and we do not share it with anyone else except where the law requires. The operator you book with receives your booking details and any form answers, because they run your session.

Once your details are in an operator’s Mailchimp list they are in that operator’s hands. Deleting or anonymising a booking in Pencilled does not remove you from the list or unsubscribe you. To stop the emails, use the unsubscribe link in them, or ask the operator to remove you.

Transfers outside the UK

Some of these providers, including Stripe, Resend, Google and Mailchimp, may process data outside the UK, including in the United States. Where they do, the transfer relies on a safeguard the UK GDPR recognises, such as an adequacy arrangement or standard contractual clauses approved for use in the UK.

Children

Pencilled is for adults. If you book a place for a child, you are giving us the child’s details, including any form answers, and you should only do so if you are their parent or guardian. We do not knowingly collect personal data directly from children, and an operator decides whether children may attend their events.

Your rights

You can ask to see, correct or delete personal data held about you, to restrict or object to how it is used, to receive it in a portable form, and to withdraw consent you have given. For booking details and questionnaire answers, contact the operator you booked with, because they control that data and every event page shows who they are. We will pass on and help with any request we receive for data an operator controls. For platform accounts and anything else, email hello@pencilled.app.

We reply to requests within one month. If you are unhappy with how a request is handled, you can complain to the Information Commissioner’s Office (ico.org.uk).

Changes

If this policy changes in a way that matters, we will update this page and the date at the top. Significant changes affecting operators are sent to them directly.