1. Who we are (Data Controller)
Fable is the data controller responsible for your personal data. If you have any questions about this policy or wish to exercise your rights, contact us at fableplusuk@gmail.com. Where required, we will provide details of our representative and, where appointed, our Data Protection Officer.
2. Information we collect
Account data: name, email address, password (stored only as a secure hash), and profile details you add (avatar, bio, location, social links, portfolio media, CV/résumé, talent interests).
Transaction data: bookings, orders, rentals, applications, deposits, escrow, receipts and plan/subscription details. Card payments are processed by our payment provider (Stripe); we do not store full card numbers.
Content & communications: messages you exchange with providers or our team, reviews, support tickets, bug reports and (where you send them) voice notes.
Technical data: device type, operating system, app version, approximate/coarse location (only where you grant permission), and diagnostic/log data used to keep the Service secure and working.
Permission-based data: camera, photo library, microphone and location — accessed only after you grant permission and only for the feature you are using (e.g. scanning a provider code, uploading media, recording a voice note).
3. How and why we use your data (lawful bases)
We process your data to: (a) create and manage your account and provide the Service — lawful basis: performance of a contract; (b) process bookings, payments, deposits and payouts — contract and legal obligation; (c) enable messaging, our AI assistant and provider tools — contract and legitimate interests; (d) keep the Service safe, prevent fraud and abuse, and debug problems — legitimate interests and legal obligation; (e) send service and transactional notifications — contract (confirmations, verification codes, security alerts and money or legal notices come by email; everything else arrives as an in-app notification); (f) send optional marketing or announcements — consent, which you can withdraw at any time; and (g) comply with law and enforce our terms — legal obligation. Where we rely on legitimate interests, we balance them against your rights and freedoms.
4. AI features
Some features (the Fable assistant and automatic first replies in messaging) use third-party large language models to generate responses grounded in catalogue and conversation context. We do not use your private content to train third-party foundation models. Do not share sensitive personal information in AI chats.
5. Sharing your data
We share data only as needed to run the Service: with providers you book or message (they receive the details necessary to fulfil your booking); with service providers acting on our instructions (hosting, database, payment processing, AI, analytics) under contracts requiring appropriate safeguards; and where required by law, regulation or to protect rights, safety and property. We do not sell your personal information. Under CCPA/CPRA we do not "sell" or "share" personal information for cross-context behavioural advertising.
6. International transfers
Your data may be processed in countries outside your own, including outside the UK/EEA. Where we transfer personal data internationally we use appropriate safeguards such as the UK International Data Transfer Agreement / Addendum and the EU Standard Contractual Clauses, or transfer only to jurisdictions recognised as providing adequate protection.
7. Data retention
We keep personal data only for as long as necessary for the purposes above, then delete or anonymise it. Transaction and tax records are kept for 6 years (UK tax law) with your name removed. Safety and abuse reports are kept for as long as the law requires.
Providers: when a provider closes their account, a private copy of their business record — listings, products, events, posts, certificates, the declaration they accepted and the details they traded and were paid under — is kept for 6 years, the period in which legal claims can be brought. It is used only to investigate fraud, disputes, chargebacks, safety reports and legal requests; it is never public and only our founder can open it, with every access logged. Conversations are not part of it. Our legal bases are legitimate interests in preventing fraud (UK/EU GDPR Art. 6(1)(f)) and establishing or defending legal claims (Art. 17(3)(e)). Data is purged from routine backups in the ordinary course.
8. Your rights
Depending on where you live, you have rights to: access your data; correct inaccurate data; delete your data ("right to be forgotten"); restrict or object to processing; data portability; and withdraw consent at any time. California residents have the rights to know, delete, correct, and to opt out of sale/sharing, and not to be discriminated against for exercising these rights. You can exercise most rights in-app (edit your profile, manage notifications, or use Settings → Account → Delete account) or by contacting fableplusuk@gmail.com. You also have the right to complain to your data protection authority (in the UK, the Information Commissioner's Office).
9. Deleting your account
You can delete your account at any time from Settings → Privacy → Delete account. To protect you from mistakes there is a grace period — 14 days for members and 30 days for providers (whose listings and shop pause straight away). Sign in before it ends to keep your account. After that your profile, bookings, favourites, notifications and other personal data are erased; messages you sent stay with the person you sent them to, shown as "Deleted user", and reviews stay as "Anonymous". Records we must keep are explained in section 7. If you signed in with Apple, we also revoke the Sign in with Apple token where technically possible; if it cannot be revoked automatically, we will guide you to remove access in your device's Apple ID settings.
10. Security
We use technical and organisational measures to protect your data, including encryption in transit, hashed passwords, access controls and secure token storage on your device. You stay signed in on a device until you sign out; you can see every signed-in device and sign any of them out in Settings → Devices, and we email you when a new device signs in. No system is perfectly secure, so we cannot guarantee absolute security, but we work continuously to protect your information.
11. Children and age checks
Fable + is for people aged 13 and over. Teen accounts (13–17) get extra protections: no card payments, restricted messaging with adults and no 18+ events. We do not knowingly collect data from children under 13; if you believe a child has provided us data, contact fableplusuk@gmail.com and we will delete it.
Some 18+ features may ask for a one-time age check. You take one selfie (or scan a photo ID) on our age-check partner's own page; we never receive or keep the image or the document — only whether you passed and an age band. If you've already verified your identity for payouts with Stripe, that result counts and you won't be asked again.
To keep teens safe we also look at a few signals — for example a date of birth just over 18, school-year words in a bio, or reports that an account looks under 18. Signals alone never block or remove anyone: at most the account gets the teen experience until its owner confirms they're 18+. We keep signals for 12 months and delete everything with your account.
12. Changes to this policy
We may update this policy from time to time. We will update the "Last updated" date and, for material changes, provide additional notice in-app. Your continued use of the Service after an update means you accept the revised policy.
13. Contact us
Questions, requests or complaints about privacy? Email us at fableplusuk@gmail.com.