Home · Privacy

The short version

• The only thing collected about you is your email address, and only if you buy something or ask for a sign-in link.
• Your practice scores are not collected at all. They are written to your own browser's storage and never sent anywhere.
• There is no analytics, no advertising, no tracking pixel and no third-party font or map request. Nothing on these pages reports your visit to anyone.
• Two cookies are set, both strictly necessary to keep you signed in. That is why there is no consent banner: there is nothing optional to consent to.
• Card details never reach this site. Stripe takes them.

What is collected, and when

• Your email address. When you pay — Stripe Checkout collects it — or when you type it on /account to be sent a sign-in link. It is what an account is.
• Your name and email, again. Only if you book a one-to-one session, and only to pass to the calendar so the booking form arrives filled in.
• Your card details: never. The payment happens on Stripe's own pages. This site is told that the payment succeeded and nothing whatever about the card.
• A postcode, only if you type one into the depot search on /jobs. Your browser sends it to postcodes.io to turn it into a pair of coordinates. It is not stored, not logged here, and the distances are worked out in your browser afterwards.
• Server logs. The host records requests — IP address, time, path, user agent — as any web server does. They are kept briefly, for security and for finding faults, and are not used to build a picture of a visitor.

The two cookies

Both are set only once you are signed in, both last thirty days, and both are strictly necessary within the meaning of the cookie rules — without them a paid guide cannot tell that you paid for it.

• bookedon_session — your email address and tier, cryptographically signed so it cannot be edited, and marked HttpOnly so no script can read it. This is what the server believes about you.
• bookedon_tier — the same tier in the clear, so the page can draw the right buttons without asking the server first. It holds no email address.

Nothing else is set. No analytics cookie, no advertising cookie, no cookie belonging to anyone else. Signing out on a device deletes both.

What stays on your device

The simulators run entirely in your browser, so the things that would be the most revealing — how slowly you worked, how often you practised, what you wrote in an interview answer — are the things that are never sent anywhere:

• Scores, attempt history, the stage you are on and your written interview answers are in your browser's own storage, under names beginning bookedon.
• The photographs for the ATAVT drill are fetched once and kept in your browser's database (bookedon.scenes) so the drill works offline.

None of it is uploaded, none of it follows you to another device, and clearing your site data removes all of it. That also means it cannot be recovered — there is no copy here to restore from.

Who else handles any of it

Four companies, each doing one job, and one lookup made by your own browser:

• Stripe takes the payment and is the record of what an email address bought. What you hold is asked of Stripe rather than kept here.
• Resend sends the sign-in email, and only that.
• Vercel hosts the site and keeps the server logs described above.
• Calendly, only if you buy a one-to-one session, holds the booking and the times.
• postcodes.io, only when you use the depot search — and that request is made by your browser rather than by this site.

Some of these operate servers outside the United Kingdom. Where they do, the transfer rests on the standard contractual clauses and the UK addendum to them, which is the mechanism their own data processing terms provide.

Nothing is sold, rented, shared for advertising, or handed to anyone else except where the law requires it.

Why holding it is lawful

• To give you what you bought — performance of the contract between us. Your email address is the only way to know that the person opening a Gold guide is the person who paid for one.
• To keep the site working and unabused — legitimate interests, which covers the server logs.
• To meet tax and accounting duties — a legal obligation, which is why a record of a sale outlives a refund.

No consent is relied on, because nothing here is done that would need it.

How long it is kept

• The purchase and the email with it: by Stripe, for as long as its own retention and the UK's tax record-keeping rules require.
• The session cookies: thirty days, or until you sign out.
• The sign-in link: thirty minutes, after which it is refused.
• Server logs: a short period set by the host, not by this site.
• Everything on your device: until you clear it.

Your rights

You can ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, ask that it be sent to you in a portable form, or object to it being held at all. There is not much to ask about — an email address and a purchase — but the right is the right.

Ask at the address below and you will get an answer within a month. A deletion request on an email address that has bought something will remove the sign-in route to it, and with it access to what was paid for; the record of the sale itself has to stay for as long as the tax rules say.

If you think it has been handled badly you can complain to the Information Commissioner's Office at ico.org.uk, though an email here first will usually be faster.

Children

This is material for adults applying for a job with a minimum age of twenty in most of the industry. It is not aimed at children and nothing on it is designed to appeal to them.

Changes

If this page changes in a way that matters, the date at the top moves and the change is described rather than quietly folded in.

Who holds it, and who to contact

The data controller — the person responsible for everything described on this page, and the one to complain to or ask — is Yemi Bello, a sole trader, trading as Booked On. There is nobody else: no team, no parent company, and no data protection officer, because a business this size is not required to appoint one and pretending otherwise would just be a longer way of saying the same name.

Email hello@booked-on.co.uk for anything here, including a request to see or delete what is held. The postal address, and the rest of the trading details, are on the terms page.