Privacy Policy

Steadlo is the data controller for the personal data described in this Privacy Policy, unless we tell you otherwise.

• Company name: Steadlo Ltd
• Email: [email protected]
• Phone: 07502 359849
• ICO Registration reference: ZC089449

If you have questions about this policy or your data, contact us using the details above.

We process personal data in line with the UK GDPR and the Data Protection Act 2018.

This policy applies when you:

• visit our website;
• create an account;
• use the Platform to find, book, deliver, manage or pay for care;
• message or communicate with other users through the Platform, including community features;
• contact our support team; or
• interact with our marketing, ads or events.

It does not cover third-party websites or apps you reach through links from our Platform.

We collect different data depending on whether you are a care recipient, family, care provider or organisation, or care professional.

Data you give us directly

This may include:

• Identity and contact details: name, date of birth where required, email, phone, address and profile photo.
• Account details: login credentials, preferences, settings and verification status.
• Care needs information for care seekers and recipients: schedule needs, care requirements, risk notes, routines, preferences, accessibility needs and location for visits.
• Professional profile data for care professionals: qualifications, training, experience, availability, references, DBS-related information, work history, right-to-work details where required, profile biography and documents you upload.
• Organisation data for providers: business name, role or title, staff who administer the account, site addresses, booking requirements and invoicing contacts.
• Communications and content: messages, emails, support tickets, complaints, safeguarding reports, community posts and reviews.
• Payments and billing: billing address, invoices and payout details. We do not store full card details; see Section 8.

Data we collect automatically

When you use the Platform, we may collect:

• Device and technical data: IP address, device identifiers, operating system, app version, browser type and crash logs.
• Usage data: pages viewed, features used, searches, booking actions, timestamps and referral URLs.
• Location data: approximate location from your IP address and precise location only if you enable it in your device or app settings.

Data we receive from others

We may receive data from:

• a family member, attorney or organisation arranging care for someone else;
• referees, training providers or verification services;
• payment and payout providers;
• fraud prevention and security services; and/or
• public sources where lawful and relevant.

Special category data

This can include health-related information about a care recipient, and sometimes a care professional, such as mobility needs, medication support requirements, disabilities or safeguarding notes.

We only process special category data where a valid legal basis applies, such as:

• it is necessary for care arrangements you request;
• it is needed for safeguarding and safety; and/or
• you, or an authorised person, have provided it and it is necessary to deliver the service.

Criminal offence data

Where required for trust and safety, we may process criminal offence data relating to checks such as DBS-related information and/or verification outcomes. We handle this with strict access controls and only where lawful.

We use personal data for the following purposes.

Core Platform operations

• create and administer accounts;
• match individuals, families and providers with suitable care professionals;
• facilitate bookings, schedules, changes, cancellations and continuity;
• enable messaging, community participation, reviews and service coordination; and
• provide customer support.

Trust, safety, compliance and safeguarding

• verify identity and eligibility, including right to work where applicable;
• support background checks and validation processes using standard verification providers;
• detect, prevent and investigate fraud, abuse, policy breaches and off-platform payment attempts;
• manage complaints, incidents, disputes and safeguarding concerns; and
• comply with legal obligations and respond to lawful requests.

Payments and business administration

• process payments and payouts through payment technology providers, such as Stripe;
• manage invoices, fees, refunds where applicable and chargebacks; and
• keep accounting and tax records.

Improving the Platform

• maintain, troubleshoot, test and improve performance and features; and
• analyse usage to make the Platform easier and safer to use.

Marketing (where permitted)

• send service updates and onboarding messages;
• send marketing communications where you have opted in or where we can rely on legitimate interests. You can opt out at any time; and
• measure the effectiveness of ads and campaigns; see cookies and analytics below.

Under UK GDPR, we must have a lawful basis. Depending on the context, we rely on:

• Contract: to provide the Platform and related services you request, such as accounts, matching, bookings and payments.
• Legal obligation: to meet legal, regulatory, tax and safeguarding requirements.
• Legitimate interests: to run and improve our business responsibly, such as preventing fraud, securing systems and improving user experience. We balance this against your rights.
• Consent: for certain activities, such as some marketing, optional location permissions and certain cookies. You can withdraw consent at any time.
• Vital interests or public interest where applicable: where necessary to protect someone’s life or for safeguarding-related needs in line with the law.

Payments and payouts are typically handled by third-party payment providers, such as Stripe or similar providers we may use. These providers process payment details in line with their own privacy notices.

We generally store only what we need for billing and reconciliation, such as the last four digits, payment status, transaction IDs and invoices. We never store full card details.

We may share personal data where necessary to run the Platform, including with:

Other users as part of the service

• Care seekers and providers may see a care professional’s profile, availability and relevant verification status.
• Care professionals may see booking details needed to deliver care, such as location, schedule and care notes that are necessary and appropriate.

Service providers (processors)

This may include hosting, cloud infrastructure, analytics, communications tools, customer support systems, identity verification and background-check providers, fraud detection, insurance or claims administration where relevant, and payment providers.

Professional advisers

Lawyers, auditors, insurers and consultants where needed.

Authorities and regulators

Where required by law or necessary for safeguarding, fraud prevention or public safety. This may include cooperating with the Information Commissioner’s Office and, where relevant, care regulators.

Business transfers

If Steadlo is involved in a merger, acquisition, reorganisation or sale of assets, data may be shared as part of that process with appropriate protections.

We restrict access to personal data to people who need it to do their job, and we use contracts and due diligence to enforce confidentiality and security.

Steadlo may use data to operate, improve and grow the Platform and its services.

• Anonymised or aggregated data: Steadlo may create and share or supply anonymised and/or aggregated data, where individuals are not identifiable, for analytics, research, benchmarking, product development, commercial partnerships and business purposes.
• Identifiable personal data: Steadlo will only share, supply or otherwise commercialise identifiable personal data where lawful. This may include where you have provided valid consent where required and/or another lawful basis under UK GDPR applies, and the sharing is consistent with this Privacy Policy and applicable law.

Where required by law, Steadlo will provide appropriate transparency and controls.

We aim to store and process data in the UK. Some suppliers may process data outside the UK.

Where personal data is transferred internationally, we use appropriate safeguards, such as adequacy regulations and/or UK-approved contractual protections, including the UK International Data Transfer Agreement or UK Addendum.

We use organisational and technical measures designed to keep your data secure, including access controls, least-privilege permissions, secure hosting, monitoring and incident-response processes.

If we identify a personal data breach that creates a risk to your rights and freedoms, we will notify affected individuals and/or regulators where legally required.

We keep personal data only for as long as necessary for the purposes described in this policy, including legal, accounting, dispute-resolution and safeguarding needs.

Typical examples include:

• Account and Platform records: while your account is active and for a reasonable period after closure.
• Saved care-recipient profiles and booking care-needs snapshots: 60 days from booking completion. For profiles used across bookings, the period runs from the latest completed booking; a profile is retained while another booking still needs it.
• Messages, community content, reviews and booking records: retained to support continuity, safety, moderation and dispute handling.
• Financial records, including invoices and payments: commonly retained for up to six years, and sometimes longer where required by law.
• Verification records: retained while needed to support trust and compliance, then deleted or anonymised where appropriate.

You can request deletion, but we may need to keep certain data where we have a legal obligation or a legitimate reason.

You have rights under data protection law, including:

• access to your data;
• rectification;
• erasure in certain cases;
• restriction of processing;
• data portability in certain cases;
• objection, including to direct marketing;
• withdrawal of consent where processing is based on consent; and
• rights related to automated decision-making; see Section 15.

To exercise your rights, contact [email protected]. We may need to verify your identity before acting on a request.

Steadlo may use automated tools to support matching, ranking, fraud prevention and operational efficiency, such as suggesting suitable care professionals based on availability, location, skills and preferences.

Where a decision has a significant effect on you and is made solely by automated means, you can request:

• a human review;
• an explanation; and
• the ability to contest it.

You can opt out of marketing at any time by using the unsubscribe link in our emails and/or contacting us.

Service or transactional messages, such as booking confirmations and safety updates, are not marketing and may still be sent.

We use cookies and similar technologies to:

• make the website work properly;
• remember preferences;
• understand site usage; and
• measure marketing performance.

Where required, we will ask for your consent before placing non-essential cookies. You can manage cookies through our cookie banner or settings and your browser controls.

The Platform is intended for adults. If care is being arranged for a person under 18, an adult with appropriate authority must manage the account and provide the necessary consents.

If you believe a child has provided personal data to us without proper authority, contact us so we can investigate and take appropriate action.

Our Platform may link to external sites. We are not responsible for their privacy practices. Review their policies before providing personal data.

If you are unhappy with how we handle your data, contact us first and we will take it seriously.

You also have the right to complain to the UK data protection regulator, the Information Commissioner’s Office.

We may update this Privacy Policy to reflect changes to the Platform, legal requirements or how we process data. We will post the updated version on our website and app. Where changes are significant, we may provide additional notice.