Unsuitable Booking

Legal

Privacy Policy

Last updated: 31 August 2026

1. Who we are

This website, unsuitable-booking.com (the "Site"), is operated by Unsuitable Booking, a sole trader based in the United Kingdom ("we", "us", "our"). We are the data controller for personal information collected through this Site within the meaning of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact: hello@unsuitable-booking.com. A postal address is available on request — please email us and we will provide it within 5 working days.

    2. What personal data we collect

    We collect and process the following categories of personal data:

    • Email address — when you subscribe to our newsletter or mailing list.
    • Purchase confirmation data — when you buy through our Site, Stripe processes your payment. We receive a purchase confirmation (email address, product purchased, transaction reference). We do not store your card details — these are held solely by Stripe.
    • Contact form data — your name and email address if you submit a message via our contact form.
    • Analytics data — if you accept cookies, we use Google Analytics 4 to collect anonymised information about how visitors use the Site (pages visited, session duration, device type, approximate location at country/region level). This data is pseudonymised and does not directly identify you. IP addresses are anonymised before storage.
    • Sex Tips paywall — if you purchase access to the Sex Tips content, we store a payment confirmation token locally in your browser (localStorage). We do not store your identity against this purchase on our servers beyond the Stripe transaction record.
    • Mystery Box spin credits — spin credits and promo code redemptions are stored locally in your browser (localStorage). Server-side, we log redeemed promo codes to prevent duplicate use; no personal data is stored against these logs.
    • Age gate — your confirmation that you are 18 or over is stored locally in your browser (localStorage). We do not transmit or store this on our servers.

    3. How we use your data

    We use your personal data for the following purposes:

    • To send you launch notifications, reminders, and updates you have opted into via our newsletter.
    • To process and fulfil your purchase, including delivering the digital product and handling any post-purchase queries.
    • To respond to enquiries submitted via the contact form.
    • To understand how visitors use the Site so we can improve it (analytics — only with your consent).
    • To comply with our legal obligations, including UK tax record-keeping requirements.

    We will never sell your personal data to third parties, and we will never use it for purposes incompatible with those listed above.

    4. Legal basis for processing (UK GDPR)

    We rely on the following lawful bases under Article 6 UK GDPR:

    • Consent (Article 6(1)(a)) — for newsletter sign-ups, marketing emails, and analytics cookies. You may withdraw consent at any time: unsubscribe via the link in any email, or withdraw cookie consent via our cookie banner. Withdrawal does not affect the lawfulness of processing before withdrawal.
    • Contract (Article 6(1)(b)) — to process your purchase, deliver your digital product, and handle post-purchase support.
    • Legal obligation (Article 6(1)(c)) — to retain purchase and financial records as required by UK tax law (HMRC).
    • Legitimate interests (Article 6(1)(f)) — to respond to contact form enquiries and to protect the security and integrity of the Site. We have assessed that these interests are not overridden by your rights and freedoms.

    5. Cookies and tracking technologies

    We use cookies and similar technologies on this Site. Under the Privacy and Electronic Communications Regulations 2003 (PECR), we require your prior, informed consent before placing any non-essential cookies.

    Strictly necessary cookies: These are essential for the Site to function (e.g. session management, security). They do not require your consent.

    Analytics cookies (Google Analytics 4): These are only placed if you click "Accept" on our cookie banner. They collect anonymised data about your visit. You can withdraw consent at any time by clicking "Manage cookies" in the footer, or by clearing cookies in your browser settings.

    We do not use advertising, profiling, or third-party tracking cookies beyond those listed above.

      6. Third-party data processors

      We use the following third-party services which process personal data on our behalf or in connection with your use of the Site. Each operates under its own privacy policy:

      • Stripe, Inc. — payment processing. Stripe is the data controller for your card and payment data. Privacy policy: stripe.com/gb/privacy.
      • Google LLC (Google Analytics 4) — website analytics (consent-gated). Data is processed in the USA under Standard Contractual Clauses. Privacy policy: policies.google.com/privacy.
      • GoDaddy Inc. — website hosting and infrastructure. Your data may be stored on servers operated by or on behalf of GoDaddy. Privacy policy: godaddy.com/legal/agreements/privacy-policy.

      Where processors are based outside the UK/EEA, we ensure appropriate safeguards are in place (Standard Contractual Clauses or UK adequacy decisions).

      7. International transfers

      Some of our third-party processors (including Google and GoDaddy) are based in or transfer data to the United States. Where this occurs, we rely on Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO) as the transfer mechanism, or on an applicable UK adequacy decision.

        8. Data retention

        Newsletter subscriber data: retained for as long as you remain subscribed. On unsubscribe, your email is removed from active mailing lists within 30 days.

        Purchase records: retained for 7 years from the date of purchase, as required by HMRC under UK tax law.

        Contact form submissions: retained for up to 12 months, then deleted.

        Analytics data: retained in Google Analytics for 14 months (the minimum configurable period), after which it is automatically deleted.

        Promo code redemption logs: retained for 12 months for fraud prevention, then deleted.

          9. Your rights under UK GDPR

          You have the following rights in relation to your personal data:

          • Right of access — to request a copy of the personal data we hold about you (Subject Access Request).
          • Right to rectification — to request correction of inaccurate or incomplete data.
          • Right to erasure — to request deletion of your data where there is no compelling reason for us to continue processing it.
          • Right to restriction — to request that we restrict processing of your data in certain circumstances.
          • Right to data portability — to receive your data in a structured, commonly used, machine-readable format where processing is based on consent or contract.
          • Right to object — to object to processing based on legitimate interests or for direct marketing purposes.
          • Right to withdraw consent — at any time, for any processing based on consent, without affecting the lawfulness of prior processing.
          • Right to lodge a complaint — with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

          To exercise any of these rights, please email hello@unsuitable-booking.com. We will respond within one calendar month as required by UK GDPR. We may need to verify your identity before processing your request.

          10. Age restriction and children's data

          This Site contains adult content and is strictly for persons aged 18 and over. We do not knowingly collect or process personal data from anyone under the age of 18. If you believe a minor has submitted personal data to us, please contact us immediately at hello@unsuitable-booking.com and we will delete it without delay.

            11. Security

            We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. Payment data is processed exclusively by Stripe using industry-standard TLS encryption. We do not store card details on our systems. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

              12. Changes to this policy

              We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The "Last updated" date at the top of this page will reflect any changes. Where changes are material, we will notify active newsletter subscribers by email. Continued use of the Site after the updated policy is posted constitutes your acknowledgement of the changes.