Privacy policy

blue lemons (“we”, “us”) is the marketplace at bluelemons.co.uk, operated by Lemons Ltd. This policy explains what personal data we collect, why, who we share it with, and the rights you have over it under the UK GDPR and the Data Protection Act 2018.

Who’s the controller?

Lemons Ltd, a company registered in England and Wales under company number 17355768, is the data controller for personal data collected through the platform. We are registered with the Information Commissioner’s Office (ICO). Contact us about anything in this policy at hello@bluelemons.co.uk.

What we collect

• Account data: name, email, and password hash when you create an account.
• Expert application data: if you apply to join as an expert: your role, years of experience, location, LinkedIn URL, profile photo, bio, expertise tags, rate, and how you’d like to work. We may also contact the referees you give us as part of reference checks. If you give us a referee’s details, we use them only for that check, tell them why we’re in touch, and delete their details once the check is complete.
• Booking request data: the conversations you request, the time you pick, and the short brief you write before each call.
• Enquiry data: if you send us an enquiry: your name, email, company, what you need, timeline, and budget band.
• Payment data: payments are processed by Stripe, whether you pay through a secure payment link, an invoice, or checkout on the site. Your card details are handled by Stripe and never touch our servers. If you’re an expert, the identity and bank details needed to pay you are collected and held by Stripe when you set up payouts. We keep a record of what was paid so we can show your history and account for our commission.
• Feedback data: if you leave feedback after a call: your rating and any note you write. It is private to the founders and never published.
• Technical data: IP address, browser type, and basic request logs, kept for 30 days for security and abuse prevention.

Why we collect it, and our lawful bases

UK GDPR requires a lawful basis for each purpose. Ours are:

• Performance of a contract: running your account, matching clients to experts, arranging and confirming bookings and engagements, taking payments, and sending the emails that make all of that work.
• Legitimate interests: vetting experts before they’re listed (including reference checks), preventing fraud and abuse, keeping the service secure, and understanding how the platform is used so we can improve it. You can object to any of this. See “Your rights”.
• Legal obligation: keeping tax and accounting records, and responding to lawful requests from authorities.
• Consent: we don’t currently do anything that relies on consent (we send no marketing email). If that ever changes we’ll ask first, and you’ll be able to withdraw consent at any time.

We do not sell your data, ever, and we don’t use it for advertising. We don’t make automated decisions about you that have legal or similarly significant effects. Expert applications, for example, are reviewed by a human.

Who we share it with

• Supabase: runs our database, sign-in system, and file storage. Hosted in the European Union.
• Netlify: hosts the website and processes request logs.
• Resend: sends transactional email (booking requests, confirmations, enquiry receipts).
• Zoho Mail: hosts our mailboxes in an EU data centre, so any email you exchange with us is stored there.
• Stripe: processes payments, and (for experts) payout identity and bank details. We never see your card number. For payouts Stripe also acts as a controller in its own right. See Stripe’s privacy policy.
• Cal.com: scheduling. When you book a call time (including screening calls with our team), your name, email and chosen time are processed by Cal.com, and the event syncs to the participants’ calendars (Google Calendar).
• Google Meet: hosts the video call itself. We never see the recording or transcript.
• Sentry: receives error reports if something breaks, so we can fix it.
• Cloudflare Turnstile: checks that signups come from a person rather than a bot, using only the technical signals needed for that check. See the cookie policy for details.

Each of these companies acts as our processor (except where noted). We have no other partners. The expert you book sees your name and your brief (that’s the point of the brief) but never your payment details.

Where your data is stored

The platform’s data (accounts, expert profiles, applications, bookings, and payment records) lives in a Postgres database run by Supabase, hosted in the European Union. Profile photos sit in Supabase’s file storage in the same region. Data is encrypted in transit and at rest.

We keep data in the UK/EU where we can: transactional email is also sent from an EU region. Some of our providers (Netlify, Stripe, Sentry, Cal.com, Google) are US companies, so limited processing can happen outside the UK. Where that happens, the transfer is protected by a recognised safeguard: a UK adequacy decision, or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses built into each provider’s data-processing terms.

How long we keep it

Account data while your account is open, then 12 months after closure. Booking and payment records for 7 years to satisfy HMRC. Enquiries that don’t lead to an engagement are deleted after 12 months. Technical logs for 30 days.

Your rights

Under UK GDPR you have the right to access, correct, delete, port, and restrict our use of your data, and to object to processing. Where we ever rely on consent, you can withdraw it at any time. You can delete your account yourself from your account settings, or email hello@bluelemons.co.uk for anything else and we’ll respond within one month. If you’re unhappy with our response you can complain to the ICO at ico.org.uk.

Changes to this policy

We’ll update this page if anything material changes and email everyone with an account when we do.