Privacy policy

Last updated: 19 October 2026

1. Who we are

CounterPal Limited makes CounterPal, order and counter software for photo shops.
Company number 17495692, registered in England and Wales.
Registered office: 5 Earldom Road, London, England, SW15 1AF.
ICO registration: ZC271062.

2. Who is responsible for your data

If you are a customer of a shop that uses CounterPal, the shop is responsible for your data. In law, the shop is the "controller". CounterPal Limited is its "processor". That means we only use your data to run the app for the shop, on the shop's written instructions. We never use it for our own purposes.

The shops using CounterPal today are:

Shop	Run by (controller)	Company no.	ICO registration
Snappy Snaps Putney, 40 Putney High Street, London SW15 1SQ	H & H Putney Ltd	07205987	ZC271054
Snappy Snaps Fulham, 354 North End Road, London SW6 1LY	H & H Fulham Ltd	07206009	ZC271058
Snappy Snaps Wimbledon, 5 The Broadway, London SW19 1PS	H & H Wimbledon Ltd	07205796	ZC271060

All three companies have their registered office at 40 Putney High Street, Putney, SW15 1SQ.

Each shop has a signed data processing agreement with us.

Each shop has its own privacy notice, at the counter. It has the full details of how the shop uses your data.

The three shops work together in one small way. If you tell any of them you don't want marketing, none of the three will send you any. They also make sure someone who uses two shops doesn't get duplicate messages. For this the three companies are jointly responsible. Nothing else is shared between the shops since 9 October 2026.

Snappy Snaps head office (Snappy Snaps Franchises Limited, company 02632020) is the shops' franchisor. It is a separate controller. Under the franchise agreements it can ask a shop for its customer list and can access the shop's records. We give it data only when the shop tells us to in writing. Head office has its own privacy policy, for its website and email marketing: snappysnaps.co.uk/privacy. For anything else about head office, ask your shop.

CounterPal Limited is the controller only for its own business data: the names and contact details of the shop owners and staff we deal with for accounts, billing and support, and data about businesses that connect a WhatsApp Business account (section 3).

3. What is held

Shop customers

Name, mobile number, and email or landline if you give them.
Your orders: items, sizes, prices, discounts, due date, bag number, and notes staff add.
Payments and deposits recorded against the order. Card details are never held. Payments are taken on the shop's till.
Loyalty points.
Your yes or no to marketing, when you said it, and who recorded it.
Messages the shop sends you, and whether they were delivered.
Photos and files for your order, and the download links sent to you.
Passport reminders, only if you sign up: your email, the photo date and the renewal date.

Replies you send to the shop's WhatsApp are not stored, except a STOP, which is recorded so the shop stops messaging you.

Shop staff

The shop's sign-in email, the staff name typed against each job, and manager PINs (stored only in scrambled form).
Questions asked in the in-app help chat.
Security logs of sign-ins and changes.

Businesses that connect a WhatsApp Business account

The account and phone number IDs Meta gives us.
An access token Meta issues so we can send the business's messages. It is stored encrypted.
When a business connects its WhatsApp Business app, Meta may share its contacts and recent chats with us. We do not keep them.

Visitors to this website

This website sets no cookies and has no analytics or tracking.
Our host, Cloudflare, processes your IP address to deliver the pages and protect them from attack.

4. Why it is used

To take your order, make it and hand it over.
To tell you it's ready, remind you to collect, send quotes, and send your photo download link.
To run loyalty points.
To send points updates, offers and review requests, only if you said yes. You can stop them at any time.
To keep a do-not-contact list, so nobody is messaged after saying no.
To send each order to the shop's till.
To keep the system secure and fix problems.

Your data is never sold. It is not used for advertising, and no automated decisions are made about you.

5. Who we share it with

Only the services needed to run CounterPal, under contract:

Supabase: database, sign-ins, file storage and server code. Data is stored in London.
Cloudflare: delivers the app and this website.
Meta (WhatsApp): sends WhatsApp messages.
Dualhook: relays WhatsApp messages, for shops not yet moved to Meta directly.
Twilio: sends a text message if WhatsApp fails.
Resend: sends emails.
Epos Now: the shop's till. It receives your name, bag number and order.
Anthropic: the staff help chat. It gets the staff member's question, not customer records. Phone numbers and emails are removed first.
Google Fonts, jsDelivr and cdnjs: load fonts and code for some app pages. They see your device's IP address.

We also use AI assistants (including Anthropic's Claude) to test and fix the app. They see customer data only when a fault needs it, and then only the minimum.

We may also share data with the police, HMRC or regulators when the law requires it.

6. Data outside the UK

The main database, sign-ins, files and backups are in the UK (London). Some providers work in other countries. Each has a UK legal safeguard:

Provider	Where	Safeguard
Supabase	Data, sign-ins, files and backups are stored in London. Server code runs at the Supabase location nearest to whoever calls it: normally London for the shops, but calls from Meta or Dualhook may be handled in the US or the EU. Support staff and the website cache may be outside the UK.	Standard contractual clauses with the UK Addendum (Supabase's data processing agreement)
Cloudflare	Worldwide, including the US	UK-US data bridge
Dualhook (WADA BV)	Belgium (EU). Messages pass through its relay on Cloudflare's network and are not stored.	UK adequacy for the EU. Beyond that, we rely on Dualhook's data processing agreement.
Meta / WhatsApp (WhatsApp LLC)	US and other countries	WhatsApp's UK Data Transfer Addendum (standard contractual clauses with the UK Addendum)
Twilio	US	UK-US data bridge
Resend	US (all stored data)	Standard contractual clauses with the UK Addendum, and the UK-US data bridge
Epos Now	Ireland (EU), on Amazon Web Services	UK adequacy for the EU
Anthropic	Stored in the US. Requests may be handled in the US, Europe, Asia or Australia.	Standard contractual clauses with the UK Addendum (Anthropic's data processing agreement)

Ask us for a copy of a safeguard.

7. How long it is kept

Data	How long
Download photos	Deleted after 37 days (the link works for 30 days)
Message text	12 months
Orders	2 years after collection. After that your name and contact details are removed, and only anonymous totals are kept.
Customer records and points	Deleted 2 years after your last order
A "no" to marketing (do-not-contact list)	As long as needed to honour it
Passport reminder sign-ups	Until 3 months after the renewal date, or straight away if you unsubscribe
Download link records	12 months (when the link was made, and the file names)
Staff help chat	90 days
Security logs	12 months
Database backups	Daily backups are kept for 7 days, then overwritten. They are only used to recover from a failure.
WhatsApp Business connection IDs and token	While connected. When the business disconnects, we stop using them straight away and delete them within 30 days. If the business asks, we delete them within 30 days of the request.
CounterPal's own account, billing and support contacts	6 years after the contract ends (tax law). Support chats: 2 years.
Till, payment and tax records	Kept by the shop for 7 years on its till and paper records, not in CounterPal. The law requires 6; the franchise agreement asks for 7.

If a shop stops using CounterPal, its data is returned or deleted within 30 days of an export, or 60 days after the contract ends at the latest.

Automatic deletion is being set up. Until it is running, photos are deleted automatically at 37 days, and everything else is deleted on request.

8. How to have your data deleted

See Delete your data. In short:

Ask at the shop, or email privacy@counterpal.co.uk.
Give your name, mobile number and the shop you used.
You will get an answer within one month.

9. Your rights

You can ask to:

see a copy of your data;
correct it;
delete it;
restrict or object to how it is used;
take it with you;
withdraw your consent at any time.

Ask at the shop, or email privacy@counterpal.co.uk. Your request goes to the shop, because the shop decides. If it reaches us first, we pass it to the shop within 2 working days and help it reply. You'll get an answer within one month. It is usually free. We may need to check who you are first.

If you're unhappy, tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.

10. Contact

Ivan Valor Soler, director, CounterPal Limited, and director of the three shop companies.
Email: privacy@counterpal.co.uk
Post: 5 Earldom Road, London, SW15 1AF.

11. Changes

When this policy changes, the new version will be posted here, with the date at the top.