Privacy Policy
Effective 24 September 2026
BuiltBy2 Ltd operates Elysium Bookings. We are registered in England and Wales under company number 17153424. Our registered office is 44 Stokesay Drive, Cheadle, Staffordshire, ST10 1YU, United Kingdom.
For privacy enquiries or rights requests, email support@builtby2.co.uk.
BuiltBy2 Ltd is the controller for Elysium account administration, platform security, subscriptions, service support, product operations, legal compliance and our own communications.
An appointment business is normally the controller for the client records, booking information, forms, treatment information, communications and business policies it creates or collects through Elysium. BuiltBy2 processes that information to provide Elysium on the business's instructions. The business remains responsible for its own privacy notice, lawful basis, staff access and retention decisions.
In some activities both organisations may have separate responsibilities. We will help identify the correct contact if a request concerns information controlled by an Elysium business.
Depending on how you use Elysium, we may handle:
Information may come from you, an Elysium business or authorised staff member, a client making a booking, another account user, your device, or a provider you choose to connect. Providers can include Apple, Google, Stripe, Mailchimp and other services shown at the point of connection.
We use information to create and operate accounts; provide bookings, client management and business tools; authenticate users; process payments and subscriptions; deliver messages and notifications; provide support; prevent fraud and misuse; maintain, diagnose and improve the service; keep records; and comply with law.
Depending on the activity, we rely on performance of a contract, compliance with legal obligations, our legitimate interests in operating a secure and reliable service, or consent where the law requires it. Where we rely on legitimate interests, we consider the effect on the people concerned. Consent can be withdrawn without affecting earlier lawful processing.
Client notes, intake answers, allergies, patch-test records, treatment plans or other appointment information may reveal health information or other special-category data. An Elysium business must only collect information genuinely needed for its services and must identify both an Article 6 lawful basis and an Article 9 condition under UK data-protection law.
BuiltBy2 processes this information to provide the business's chosen Elysium features. Do not send unnecessary health information to general support channels.
Stripe processes appointment payments and subscriptions purchased on the web. Apple processes subscriptions purchased in the iOS app and Google processes subscriptions purchased in the Android app. Elysium receives identifiers, payment status, entitlement, refund and lifecycle information needed to provide and reconcile the service. Apple Pay and Google Pay may be offered through the relevant payment provider.
A business may choose to connect services such as Google Calendar, Google Sheets, Google Drive, Mailchimp, Stripe or Agent Connect. Elysium shares only the information needed for the enabled connection and authorised scope. The business controls whether the connection is enabled and should review the connected provider's terms and privacy information.
Agent Connect allows a business to authorise a compatible external agent to access selected Elysium tools. Access is limited by the scopes the business approves and can be revoked by the business.
Eligible business administrators can choose to connect the Elysium Business Insights plugin to ChatGPT. After an administrator signs in to Elysium and approves its two permissions, Elysium sends the requested tool result to OpenAI for display in the ChatGPT conversation. The plugin can return a completed calendar month and its aggregate money received before refunds in pounds, or indicate that the month has insufficient data; the business's Pro plan, time zone and whether its profile is complete; and fixed Elysium Admin guidance for the selected setup topic. Monthly amounts are withheld unless at least ten distinct clients paid in that month. The plugin does not send client identities, appointment or transaction details, availability, medical or treatment information, or your Elysium password to OpenAI.
To authorise and protect this connection, Elysium keeps connection and hashed token records. Tool access attempts create limited audit records containing the business and connection identifiers, token identifier, tool name, outcome, a brief fixed status summary and time. Rate-limit counters contain business and token identifiers and the tool name. We use these records to enforce permissions, prevent misuse, investigate failures and maintain service security; we do not use plugin calls to reconstruct your ChatGPT conversation. Rate-limit counters are eligible for deletion after two hours and are purged during subsequent rate-limit checks.
Agent Connect operational audit records are removed by a daily cleanup job once they are more than 90 days old. Connection and hashed token records remain while the business account is open and are deleted when business closure processing is completed. Revoking a connection disables its tokens immediately, although its connection and token records can remain until closure.
An administrator can revoke the connection in Elysium Admin under Settings, Payments and connections. Revocation stops further access through that connection; it does not remove results already sent to ChatGPT. OpenAI handles information in ChatGPT under its own privacy terms and controls. For Elysium access, export or deletion requests, contact us using the details in section 14.
Where a business enables Meta Conversions API for its web booking activity, Elysium may send web booking or checkout events to Meta with contact identifiers transformed using hashing for matching. Hashing is not anonymisation. Native iOS and Android booking activity is currently excluded from this advertising connection. The participating business is responsible for having an appropriate lawful basis and providing any additional notice or choice required for its advertising activity.
Information may be shared with the Elysium business and authorised staff involved in a booking; the client concerned; payment and app-store providers; hosting, database, authentication, email, push-notification and support providers; optional providers selected by a business; professional advisers; or public authorities where disclosure is legally required.
Key infrastructure and service providers currently include Supabase, Vercel, Expo, Apple, Google, Stripe and Resend. Optional business connections can add other recipients such as Mailchimp and Meta. We do not sell personal information.
Business enquiries use Elysium's backend and Resend, our email provider. To protect the form, we keep limited rate-limit counters using keyed digests of email addresses and technical network information. These digests are not anonymous data. The counters do not include the enquiry text. Retry protection also uses a keyed digest; enquiries we receive are kept as correspondence.
Some providers process information outside the United Kingdom. Where UK law requires a transfer safeguard, we use an applicable UK adequacy regulation, the UK International Data Transfer Agreement or Addendum, or another permitted safeguard. You may ask us for more information about the safeguard relevant to your information.
We retain information only for as long as needed for the purpose for which it was collected, account operation, security, disputes and legal obligations. Retention can differ because an Elysium business controls its own client and treatment records.
Client and business closure requests have a 30-day recovery period before protected deletion processing begins. Completed closure removes account access and information that no longer needs to be retained. Appointments, payment evidence, reviews, clinical records and audit evidence may be retained or anonymised where the relevant business or BuiltBy2 has a lawful operational, financial, fraud-prevention, complaints or legal reason. Backups expire through the applicable protected backup cycle rather than being altered immediately.
Account holders can request a machine-readable export before deletion. Client deletion removes the client login and direct account links while preserving business records that must remain. Genuine reviews may remain, but the reviewer identity and direct account association are removed. Business closure removes public availability, services, integrations, assets and team access after the recovery period while preserving records that must lawfully remain.
See the Account deletion guide for the current steps and retained-data summary.
We use access controls, tenant separation, encryption in transit, protected credentials, audit records, authentication controls and operational monitoring appropriate to the service. No system can be guaranteed completely secure. Keep account credentials private and contact us promptly if you suspect unauthorised access.
Depending on the circumstances, UK data-protection law may give you rights to be informed, access information, correct it, erase it, restrict or object to processing, receive portable information, and withdraw consent. You may also object to direct marketing at any time.
Send a request to support@builtby2.co.uk. We may need to verify your identity. If an Elysium business controls the information, we may refer the request to that business or assist it in responding.
You can complain to the UK Information Commissioner's Office at ico.org.uk. We would appreciate the opportunity to address the concern first.
Elysium is not intended for children to create business accounts. A business that provides services to a person under 18 remains responsible for obtaining any required parent or guardian authority and for handling that person's information lawfully.
We may update this policy when the service, providers or law changes. Material changes will be brought to account holders' attention where appropriate. The current version and effective date will remain published here.
Privacy contact: support@builtby2.co.uk.