Privacy Policy

1. Who this policy applies to

Adiyo serves two types of users, and we collect different data from each:

• Instructors — Approved Driving Instructors (ADIs) or Potential Driving Instructors (PDIs) who sign up to use Adiyo to run their booking page.
• Pupils — people who visit an instructor's Adiyo booking page to book and pay for lessons.

2. What data we collect

From instructors, during signup and use of the Service:

• Full name
• Email address
• Phone number (if provided)
• Town or city
• Areas of operation (the towns, postcodes, or regions an instructor teaches in)
• Hourly rate
• Business or page slug and bio
• Profile photo and any other images the instructor chooses to upload, such as photos of their vehicle
• Promotional content the instructor chooses to add to their booking page, such as descriptions of services offered, qualifications, pass rates, testimonials, or special offers
• Stripe Connect account details (handled directly by Stripe, see Section 5)
• Availability and booking data generated through use of the Service
• A photo of an ADI/PDI badge or licence, if the instructor chooses to upload one for verification (see Section 3)

Some of this information, such as a profile photo, bio, areas of operation, and promotional content, is provided by the instructor for the purpose of being shown publicly on their booking page. By adding this information, an instructor consents to it being displayed to any visitor of their page. Instructors can update or remove this information at any time from their dashboard. A badge or licence photo uploaded for verification is not displayed publicly — only whether verification was approved is shown, as a badge on the booking page.

From pupils, verifying their email and booking a lesson:

• Email address, which must be verified with a one-time 6-digit code sent by email before a pupil can view an instructor's live availability or book a lesson
• The verification code itself is stored only as a one-way hash, expires after 10 minutes, and is deleted once used or expired
• Full name
• Phone number (if provided)
• Booking details (date, time, instructor selected)
• Payment is processed directly by Stripe. Adiyo does not collect or store card numbers, expiry dates, or CVC codes at any point.

Once a pupil verifies an email address, we create a lightweight record (a "Pupil Account") linked to that address, so we can recognise the pupil on a return visit, show their booking history with a given instructor, and unlock any lesson slots reserved specifically for them. A Pupil Account holds only the verified email address, an optional name, and a timestamp of when it was last verified — it does not hold a password or payment details.

Automatically collected data:

• IP address (stored only as a one-way hash and never in raw form) for security, fraud prevention, and rate-limiting purposes.
• Browser-generated session identifiers stored in sessionStorage. These are temporary, reset when you close your browser tab, and are not linked to your identity.
• Page paths visited on adiyo.co.uk and *.adiyo.co.uk subdomains, used to understand how the Service is used and improve it.
• UTM parameters (utm_source, utm_medium, utm_campaign, etc.) where present in the URL, to help us understand which marketing channels bring people to the Service.
• The referring URL, where your browser shares it, to understand how visitors arrive at the Service.
• We do not use third-party advertising trackers, third-party analytics scripts, or fingerprinting techniques. No cookies are set for analytics purposes.

3. How we use this data

We use personal data only for the following purposes:

• To create and manage instructor accounts and booking pages
• To verify a pupil's email address by one-time code, before showing live availability or allowing a booking
• To maintain a Pupil Account so a returning pupil can see their booking history and any slots reserved for them, without needing a password
• To display live availability to pupils and process bookings
• To publicly display instructor profile information on their booking page so pupils can make an informed choice
• To review an instructor's uploaded ADI/PDI badge or licence photo, where provided, to decide whether to show a "Verified Instructor" badge on their booking page
• To facilitate payment from pupils to instructors via Stripe Connect
• To send booking confirmation emails to instructors and pupils
• To provide customer support
• To maintain the security and proper functioning of the Service
• To understand how the Service is used in aggregate, so we can improve it (using anonymised session and page-view data described above)
• To measure the effectiveness of marketing activity using UTM attribution data
• To communicate important updates about the Service, including changes to these terms

We do not sell personal data to third parties. We do not use pupil or instructor data for advertising purposes, beyond the instructor's own promotional content displayed on their own booking page.

4. Legal basis for processing (UK GDPR)

We process personal data under the following legal bases:

• Contract. Processing instructor and pupil data is necessary to provide the booking and payment service both parties have signed up to use.
• Legitimate interests. For security logging, fraud prevention, service diagnostics, and first-party analytics. Our analytics collect no personal data: IP addresses are immediately hashed and session identifiers are ephemeral. The data is used solely to understand aggregate usage patterns and improve the Service.
• Consent. For the public display of instructor profile content such as photos, bios, service areas, and promotional material, which instructors choose to provide and can withdraw or edit at any time.

5. Third-party processors

Adiyo relies on the following third-party services to operate. Each processes data under its own privacy policy and terms:

• Stripe (payment processing and Stripe Connect) handles all card payment data, instructor payout details, and identity verification required for Connect onboarding. Adiyo never sees or stores full card details. See Stripe's privacy policy at stripe.com/gb/privacy.
• Supabase (database hosting) stores instructor profiles, availability, and booking records.
• Resend (transactional email) is used to send booking confirmation emails to instructors and pupils.
• Coolify / Hetzner (application hosting) hosts the Adiyo web application.

We choose processors that provide appropriate safeguards for personal data and, where data is transferred outside the UK, that offer adequate protections under UK GDPR, such as Standard Contractual Clauses.

6. Data retention

• Instructor account data is retained for as long as the account remains active, and for a reasonable period afterward to comply with legal, accounting, and tax obligations.
• A verification code is retained only until it expires (10 minutes) or is used, whichever is first, and is never retained beyond that.
• A Pupil Account (verified email, optional name, last-verified timestamp) is retained for as long as it is useful for recognising a returning pupil, and can be deleted on request (see Section 7).
• Booking records are retained for as long as necessary for accounting, dispute resolution, and legal compliance purposes, typically up to six years, in line with UK tax record-keeping requirements.
• An instructor's uploaded badge or licence photo is retained while their account remains active, and is removed if they remove it from their dashboard or their account is deleted.
• Pupils may request deletion of their personal data at any time (see Section 7), subject to our need to retain transaction records for legal purposes.

7. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data, sometimes called the right to be forgotten, subject to legal retention requirements
• Object to or restrict certain processing
• Request a copy of your data in a portable format
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, contact data@arcscribe.co.uk. We will respond within one month, as required by law.

Instructors can remove or edit publicly displayed content, such as their photo, bio, or promotional material, directly from their dashboard at any time.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been mishandled.

8. Data security

We take reasonable technical and organisational measures to protect personal data, including:

• Encrypted data transmission (HTTPS) across the Service
• Access to instructor and pupil data restricted to what is necessary to operate the Service
• Reliance on reputable, security-audited third-party processors, including Stripe and Supabase, for sensitive data handling

No system is completely secure, and we cannot guarantee absolute security of data transmitted to or from the Service.

9. Children's data

Adiyo is intended for use by adults and by pupils booking driving lessons, who are typically 17 or older in line with the minimum age to hold a UK provisional driving licence. Adiyo does not knowingly collect data from children under 13. If you believe a child under 13 has provided personal data through the Service, contact us and we will remove it.

10. Changes to this policy

We may update this policy from time to time, for example as the Service grows or as legal requirements change. Material changes will be communicated to instructors via email. The “Last updated” date at the top of this policy will reflect the most recent revision.

11. Contact

For any questions about this policy or your personal data, contact: