Privacy Policy

1. Who we are

Driifloat provides booking and facility-management software for facilities offering dry-floatation sessions. Facilities use Driifloat Manager to manage their operations. Consumers use Driifloat features to discover facilities and make bookings.

2. What this policy covers

This policy covers Driifloat Manager, the Driifloat mobile app, and web booking features, including public and embedded booking flows. A facility may provide its own privacy notice or make separate decisions about information it collects from you. Read the facility’s notices and policies where they are provided.

3. Our privacy roles

Driifloat is the controller for processing needed to operate its own platform, including account administration, authentication, security, support, product administration, and product analytics where applicable.

For customer and booking information that a facility provides or controls, the facility is generally the controller and Driifloat acts as a processor to provide the Services. That processing is also covered by the facility’s agreement with Driifloat, including processor terms where applicable. Facilities remain responsible for their own customer-data obligations and physical services.

4. Information we collect

Depending on how you use Driifloat, we may collect your name, email address, phone number, account details, date of birth where provided, facility relationship, bookings, booking history, cancellations, rescheduling information, session details, time zone, and information needed to verify or manage a booking.

Public bookings may include guest name, email, phone number, special requests, facility-configured intake responses, verification information, and anti-abuse information. A guest booking may be matched with or create a customer record for the selected facility.

Facility and staff users may provide facility names, addresses, coordinates, opening hours, services, images, contact details, staff roles, permissions, customer records, notes, and operational information.

We may also process device, browser, app, IP address, log, error, security, notification, and analytics information. Mobile push notifications use device or push identifiers.

Driifloat is not intended to collect medical or other special-category information. Please do not enter that information in free-text notes or configurable intake fields. If it is submitted anyway, we do not use it for Driifloat profiling or marketing and will delete it on request or when we reasonably discover it. Facilities remain responsible for what they ask customers to provide.

5. How we use information

• To create and secure accounts and authenticate users.
• To display facilities, availability, and booking information.
• To create, confirm, manage, cancel, and reschedule bookings.
• To send service notifications and respond to support requests.
• To provide facility-management features and staff notifications.
• To prevent fraud, abuse, unauthorised access, and automated booking activity.
• To operate, troubleshoot, improve, and secure the Services.
• To comply with legal obligations and protect our rights.

We rely on the following legal bases, depending on the activity:

• Contract: accounts, bookings, service messages, and core Manager features needed to provide the Services.
• Legitimate interests: security, fraud and abuse prevention, troubleshooting, and product improvement. You may object by emailing support@driifloat.com.
• Consent: optional analytics and other non-essential cookies where our consent banner or preference controls apply.
• Legal obligation: compliance and retention where required by law.

We do not make solely automated decisions that produce legal or similarly significant effects about you.

6. How we share information

When you book a facility, we share information needed to arrange and manage that booking with the selected facility and its authorised personnel. This may include your name, contact details, booking time, selected session, relevant booking status, and information you provide for the booking.

We share information with service providers that help operate the Services, including:

• Hosting and infrastructure: Vercel, Supabase
• Authentication and database: Supabase
• Transactional email: Resend
• Product analytics: PostHog
• Error monitoring and session replay: Sentry
• Bot protection: Cloudflare Turnstile and BotID
• Maps (where shown): Google Maps
• Mobile push notifications: OneSignal

We may also share information when required by law, to protect people or property, or in connection with a business transfer. We do not sell personal information or use it for advertising.

7. Booking communications

We may send booking confirmations, verification messages, reminders, cancellation notices, rescheduling notices, account messages, and security messages by email, push notification, or in-app notification. Facilities may also configure operational notifications for their authorised staff and designated recipients.

We do not currently send SMS or text messages through Driifloat. Service notifications may be necessary to provide a booking or account service. Push notifications can appear on a device’s lock screen, depending on device settings.

8. Analytics, cookies, and security

We use technical logs, error monitoring, and analytics to operate and improve the Services, understand feature use, detect abuse, and troubleshoot problems. We do not use advertising trackers.

Error monitoring through Sentry may include limited session replay for troubleshooting. Replay is sampled and more likely when an error occurs. It is used for reliability and support, not advertising.

Optional PostHog analytics and session recording run only where analytics consent is given through the Manager cookie consent banner or cookie preference controls (for example in Settings). You can change or withdraw those preferences there.

Our service providers may receive technical identifiers, account or booking identifiers, and event information needed for their service. We apply access controls and other measures designed to protect personal information, but no online service can guarantee complete security.

9. International transfers

Driifloat and its service providers may process information in countries outside the country where you live, including the United States and other locations outside the UK and EEA. Where required, we use appropriate safeguards such as the UK International Data Transfer Agreement, Standard Contractual Clauses, or an applicable adequacy decision.

10. Retention

We keep personal information only as long as needed for the purposes described in this policy, then delete or anonymise it, subject to backups, legal requirements, and legitimate security records. Typical periods are:

• Account and profile information: while the account is active, then up to about 24 months after closure, unless we need it longer for disputes, security, or law.
• Booking and facility customer records: typically up to about 24 months after the last relevant booking or activity. A facility may need longer retention for its own legal or operational reasons.
• Security and abuse logs: typically up to about 12 months.
• Analytics and session replay: according to provider settings and consent withdrawal, subject to short operational buffers and backups.

11. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal information. You may also withdraw consent where processing relies on consent. In the UK, you may complain to the Information Commissioner’s Office (ico.org.uk).

Contact support@driifloat.com to make a request. We may verify your identity and aim to respond within one month. If a facility controls the relevant booking or customer information, we may need to involve the facility or direct the request to it.

12. Children

Driifloat accounts are for adults aged 18 or older. An adult may book a dry-floatation session for a person under 18 where the selected facility permits it. Facilities are responsible for their own age, consent, and safeguarding requirements for the physical service.

13. Changes

We may update this Privacy Policy when our Services, processing, or legal obligations change. We will publish the updated version and change the “Last updated” date.

14. Contact

Contact Driifloat Ltd (company number 12268394, registered in England and Wales) at support@driifloat.com. Our registered office is listed on Companies House.