← Back to home

Privacy Policy

Last updated: 27 October 2026

This Privacy Policy explains how Digital Team Group Limited ("we", "us", "our") collects, uses and protects your personal information when you use the At9 booking management app and the at9.app website (together, the "Service"). We are committed to protecting your privacy and handling your data with care.

By using At9, you agree to the collection and use of information in accordance with this policy.

1. Who we are

Data Controller: Digital Team Group Limited
Registered address: Elmpark House, 3 Elmpark View, York, YO31 1DY
Company number: 17078703
ICO Reference: ZC142947
Privacy contact: contact@at9.app

2. The data we collect

Information you provide

• Account information: name, email address, password (stored hashed), business name, business type and country.
• Booking data: customer names, contact details, booking dates and times, room or resource assigned, notes you add to bookings.
• Subscription information: billing name, address, and payment details (handled by our PCI-compliant payment processor - we never see or store your card numbers).
• Communications: any messages you send to our support team.

Information collected automatically

• Server logs: when the app contacts our servers we record the request - your account identifier, the address requested, whether it succeeded, how long it took, your IP address, and the browser or app version string your device sends. These logs are kept for 30 days and then deleted.

That is all we collect for ourselves. We do not use analytics inside the app and we do not collect crash reports.

Ad measurement with Meta (business owners, only if you agree)

We advertise At9 to businesses on Facebook and Instagram. To learn which of those ads lead to someone setting up a business, the app includes Meta's software development kit (SDK). It is switched off until you agree, and we only ask once: straight after you set up your business. People who book with a business are never asked, and nothing about them is ever sent.

If you agree, the app sends Meta:

• your device's advertising identifier (the iOS Identifier for Advertisers or the Google Advertising ID);
• that the app was installed and opened, with basic device details Meta's SDK adds, such as the device model, operating system and app version;
• that you started your free trial;
• that you subscribed, with the plan, its price and the currency.

It never sends your name, email address, phone number, your business details, or anything about your bookings or customers. If you say no, nothing at all is sent to Meta.

Changing your mind: on iPhone, turn off tracking for At9 in Settings › Privacy & Security › Tracking. On Android, delete your advertising ID in Settings › Privacy › Ads. On either, uninstalling and reinstalling At9 clears your answer, and nothing is sent unless you agree again.

What we do not collect

We do not track which features you use, how you move around the app, or how long a session lasts. We do not collect a device identifier, apart from the advertising identifier passed to Meta if you agree (see above). We do not access your contacts, photos, location, microphone or camera unless you explicitly grant permission for a specific feature in the app.

3. How we use your data

We use the information we collect to:

• Provide, operate and maintain the At9 Service.
• Process and manage bookings on your behalf.
• Process subscription payments and renewals.
• Send transactional emails and in-app notifications (booking confirmations, password resets, billing receipts, account updates).
• Improve and develop the Service. On our website this includes analytics, with your consent (see section 9). The app itself sends no analytics and no crash reports.
• Measure whether our Facebook and Instagram adverts lead to new businesses using At9, if you agree (see section 2).
• Provide customer support and respond to enquiries.
• Detect, prevent and address fraud, security incidents and abuse.
• Comply with legal obligations.

4. Legal basis for processing (UK and EU users)

Under the UK GDPR and EU GDPR, we process your personal data on the following legal bases:

• Performance of a contract: to deliver the Service you've subscribed to.
• Legitimate interests: to improve the Service, prevent fraud and analyse usage in an aggregated, anonymised form.
• Consent: where we ask for specific consent (for example, ad measurement with Meta, or optional marketing communications). You can withdraw consent at any time.
• Legal obligation: where required by law (for example, tax records).

5. Sharing your data

We do not sell your personal information. We share data only with:

• Service providers we use to operate the Service - cloud hosting, payment processing, email delivery, authentication and file storage. They are named in section 10. These providers act as data processors and are bound by data processing agreements.
• Legal authorities where required by law, court order or to protect our rights.
• With your consent, where you specifically authorise sharing with a third party.
• Meta Platforms, only if you agree to ad measurement (see section 2). Meta uses this data under its own privacy policy.

6. Storage and security

Your data is stored on secure servers located in the United Kingdom and the European Union. We implement appropriate technical and organisational measures to protect it, including:

• Encryption in transit using TLS.
• Encryption at rest for sensitive data.
• Strict access controls and multi-factor authentication for staff.
• Regular security reviews and dependency monitoring.
• Daily encrypted backups.

7. Data retention

We retain personal data only as long as necessary to provide the Service and to meet our legal obligations:

• Active accounts: data retained for as long as your subscription is active.
• After cancellation: a 30-day window during which you can re-activate or export your data, after which all personal data is deleted within 90 days.
• Backups: retained for up to 12 months and then automatically purged.
• Billing records: retained for up to 7 years to meet UK accounting and tax requirements.

8. Your rights

Under data protection law you have the right to:

• Access the personal data we hold about you.
• Rectify any inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict our processing of your data.
• Data portability - receive a copy of your data in a structured, machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time where we rely on consent.

To exercise any of these rights, email contact@at9.app. We will respond within 30 days.

You also have the right to lodge a complaint with the UK Information Commissioner's Office at ico.org.uk.

9. Cookies and similar technologies

Our website uses a small number of cookies. We do not use advertising cookies, and nothing here is shared with advertisers.

Analytics (your choice). We use Google Analytics to understand how this site is used - which pages people read, and whether they found what they came for. It is switched off until you accept it. Until then we receive an anonymous count of page views with no cookie stored on your device and nothing that identifies you. If you accept, Google Analytics stores _ga cookies to recognise a returning visit; they expire after two years.

Remembering your choice. Whichever you pick is kept in your browser's local storage so you are not asked again. This is the one thing stored whether you accept or reject, because the alternative is asking the same question on every page.

You can change your mind at any time: Change your cookie choice

The mobile app sets no cookies of its own. It reads your device's advertising identifier (the iOS IDFA or the Google Advertising ID) only if you agree to ad measurement with Meta, and only to pass it to Meta for that purpose (see section 2).

10. Third-party services

We use the following categories of third-party services. Each has its own privacy policy that you may wish to review:

• Hosting: IONOS, United Kingdom. Our servers and database are here.
• Payment processing: Stripe. Card details are handled by Stripe and never reach our servers.
• Email delivery: Brevo. Booking confirmations, reminders and account emails are sent through them.
• Authentication: Firebase (Google). Sign-in, password reset and email verification.
• File storage: Wasabi. Files you attach to a booking or a customer record.
• Analytics: Google Analytics 4 - website only, and only with your consent (see section 9). Not used in the mobile app.
• Ad measurement: Meta Platforms (Facebook and Instagram). In the mobile app only, only for business owners, and only if they agree (see section 2).

We do not use a third-party crash-reporting service.

11. Apple App Store privacy disclosures

In accordance with Apple's App Store requirements, the following data categories are collected by At9:

• Contact info (linked to identity): name, email address.
• User content (linked to identity): booking notes and customer records you create.
• Identifiers (linked to identity): your user account ID.
• Identifiers and usage data (used to track you): your device's advertising identifier and the install, trial and subscription events described in section 2. Collected only from business owners who allow tracking when the app asks, and shared with Meta to measure our adverts.

We do not collect the Diagnostics category: the app sends no crash or performance reports. Apart from the ad measurement above, which needs your permission, nothing is used for tracking as defined by Apple.

12. Google Play Data Safety disclosures

In accordance with Google Play's Data Safety section, At9 discloses the following:

• The data collected is the account and booking information described in section 2, plus server logs. No crash reports are collected. If a business owner agrees to ad measurement, the advertising ID and the install, trial and subscription events in section 2 are shared with Meta.
• All data collected is encrypted in transit using TLS.
• You can request that all your data be deleted at any time via the in-app account settings or by emailing us.
• Data is never sold to third parties.
• The only data used for advertising by a third party is the ad measurement shared with Meta, and only with the business owner's agreement.

13. Children's privacy

At9 is intended for business users aged 18 and over. We do not knowingly collect personal data from children under 18. If we become aware that we have collected such data, we will delete it without delay.

14. International data transfers

Your data is primarily stored within the United Kingdom and the European Economic Area. Where data is transferred outside these regions (for example, to a US-based service provider), we rely on appropriate safeguards including the European Commission's Standard Contractual Clauses and adequacy decisions where applicable.

15. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through an in-app notification at least 30 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

16. Contact us

For any privacy-related questions, requests or concerns, please contact us:

Email: contact@at9.app
Post: Digital Team Group Limited, Elmpark House, 3 Elmpark View, York, YO31 1DY