AtelierSuite
Legal & data protection
The paperwork behind AtelierSuite: how personal data is handled, what each house agrees to, and how to ask us to act on your rights.
For everyone · version 2026-09-02
Privacy notice
What personal data AtelierSuite holds, why, for how long, and what rights you have.
For tailoring houses · version 2026-09-02
Terms of service
The agreement between AtelierSuite and a tailoring house using it.
For everyone · version 2026-09-02
Cookies and similar technology
What is stored on your device, and how to change your mind.
For tailoring houses · version 2026-09-02
Data processing agreement
The processing terms between a tailoring house (controller) and AtelierSuite (processor), and the list of sub-processors.
For tailoring houses · version 2026-09-02
Incident response plan
What happens in the first hour, the first day and the first three days of a suspected data breach.
For everyone · version 2026-09-02
Accessibility statement
How AtelierSuite is built to be usable, what is known to fall short, and how to tell us.
For clients
Exercise your rights, or complain
Ask for a copy of your record, a correction, an erasure — or lodge a data protection complaint. Acknowledged within 30 days.
What we process, and on what basis
The record of processing activities: one line per purpose, and the lawful basis under the UK GDPR that it rests on.
- Keeping client files, measurements and garment specifications
- Contract
- The record needed to cut, fit and deliver a commissioned garment.
- Appointments, fittings and reminders
- Contract
- Arranging the fittings the commission requires.
- Invoices, payments and settlement (Stripe, bank transfer)
- Contract, and legal obligation for the keeping of the record
- Taking payment, and keeping seven years of accounts for HMRC.
- The house assistant, dictation tidying and reading scanned paper
- Legitimate interests of the house
- Drafting work for a person to review. No decision is taken solely by automated means, and every draft is confirmed by a hand of the house.
- Access and change logging, per-house isolation, fraud prevention
- Legitimate interests
- Security and accountability; the house must be able to see who changed what.
- Activity counts inside a house (stage changes, photographs added)
- Legitimate interests of the house
- An operational record the house itself reads. Nothing is shared between houses, and nothing is used for advertising.
- The monthly portfolio inspiration email
- Consent
- Marketing, asked for on its own, never bundled with transactional notices, withdrawable in one click and recorded with a date.
- Non-essential storage on a visitor's device
- Consent (PECR)
- Nothing beyond the strictly necessary is stored unless the visitor agrees.
- Rights requests, complaints and the incident register
- Legal obligation
- UK GDPR articles 15 to 22, 33 and 34, and the Data Protection Act 2018.
Who processes data for us
Lovable Cloud (Supabase)
Database, authentication and file storage for every house
European Union
Cloudflare
Serving the application and its server functions
Global edge network
Stripe
Card payments and invoice settlement; Stripe is the card processor
EU / US (standard contractual clauses)
Resend
Sending house email — invoices, appointment notes, reminders
EU / US (standard contractual clauses)
Lovable AI Gateway (Google, OpenAI models)
The house assistant, dictation tidying and the reading of scanned paper (there is no separate OCR vendor — digitisation runs through this gateway only); prompts are not used to train models
EU / US (standard contractual clauses)
GoCardless, TrueLayer
Bank-transfer requests and statement matching, where a house switches bank settlement on. They see the payer's name, the amount and the reference — never a card number
United Kingdom / European Union
Revolut, Monzo (open banking)
Optional bank connections a house may authorise so incoming transfers can be reconciled against its invoices
United Kingdom / European Union
Spotify, Instagram
Optional connections a house may switch on for music and posting
EU / US (standard contractual clauses)
How long things are kept
- Client files, measurements and specifications
- 7 years after the last commission — So a garment can be remade or altered years later
- Invoices, payments and receipts
- 7 years — HMRC record-keeping
- Messages and appointment notes
- 7 years after the last commission — Part of the client's record
- Assistant conversations and usage
- 12 months — Support and cost review only
- Records put away (soft deleted)
- 30 days, then permanently removed — Recovery from mistakes
- Access and change logs
- 24 months — Security and accountability
- Cookie and consent records
- 24 months — Evidence of consent