Privacy Policy

Last updated: 24 September 2026

This policy explains how Macsta handles personal data in connection with the software, applications and integrations it builds and operates (together, "Macsta Software and Services"). It applies to every Macsta application that links to this page, including applications registered with third party platforms such as Meta (Instagram and Facebook), TikTok and Google (YouTube).

Who we are

Macsta is a sole trader based in the United Kingdom, operating the website macsta.co.uk. For any question about this policy, or to exercise any of your rights, contact info@macsta.co.uk.

What our software does

Macsta Software and Services fall into two groups:

• Our own tools. Internal applications we use to run our own business, such as publishing content we have produced to social media accounts we own.
• Services we operate for client businesses. Applications we build and host for small businesses, such as appointment booking and customer messaging systems. For example, we operate the booking system for Sisu Tattoo, which lets the studio receive and reply to enquiries sent to its own Instagram account. In these services the client business decides what the data is used for, and we process it on its behalf and on its instructions.

None of our applications is offered for public sign up, and none of them acts on any social media account other than one owned by us or by the client business that authorised it.

What data we process

• Authorisation tokens and account identifiers. When a business connects one of its own accounts to our software, the platform issues access tokens and an account identifier. These permit our software to act on that account only, within the permissions granted.
• Messages sent to a business. Where a business uses our software to manage its messages, we receive the messages people send to that business, together with the sender's platform-scoped identifier, username or display name, and any attachments they choose to send (for example a reference image for a tattoo design). We also store the business's replies.
• Booking details. Information a customer gives a business in order to make or manage a booking, such as their name, contact details, preferred dates and design notes.
• Content we publish. Our own videos, images and the titles, descriptions and tags we write for them.

We do not read follower lists, collect analytics about individuals, or access any message, comment or content that was not sent to, or published by, the account that authorised our software.

How we use it

Data is used only to provide the service it was collected for: to display and answer enquiries, to arrange and manage bookings, and to publish content. We do not use it for advertising, we do not build profiles of individuals, and we do not sell it. Where a service uses automated assistance to draft replies or sort enquiries, that processing runs on infrastructure we control, and a person at the business remains responsible for what is sent.

Lawful basis

Messages and booking details are processed because they are necessary to respond to a request you have made to the business and to take steps towards a contract with it, and for the business's legitimate interest in managing its enquiries. Tokens and account identifiers are processed for our legitimate interest in operating the service the account owner asked us to provide.

How data is stored

Data is held on servers we control in the United Kingdom. Authorisation tokens are held in encrypted storage, restricted to the components that need them, and are used only to authenticate requests to the platform that issued them.

How long we keep it

Messages and booking details are kept for as long as the business needs them to manage the enquiry or booking and to meet its legal and record keeping obligations, after which they are deleted. Tokens are retained only while an integration is connected, and are deleted when it is disconnected. Authorisation can be withdrawn at any time from the settings of the relevant platform account, which immediately invalidates the token.

Sharing

We do not sell, rent or trade personal data. Data is shared only with the client business the message or booking was addressed to, and with the platform the service connects to, which necessarily receives replies and published content in order to deliver them. We will disclose data if we are required to by law.

Your rights

You may ask for a copy of the personal data we hold about you, ask us to correct it, ask us to erase it, or object to our processing it. Write to info@macsta.co.uk. Where we process data on behalf of a client business, we will pass your request to that business and help it respond. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Data deletion

To have data deleted that one of our applications received from Instagram, Facebook or any other platform, email info@macsta.co.uk with the subject "Data deletion request", stating the platform and the username or account the data relates to. We will delete the messages, identifiers and any related booking details within 30 days, unless the business is legally required to keep a record, and will confirm by email when it is done. Removing our application from your platform account's settings also revokes its access immediately.

Changes

If this policy changes, the revised version will be published on this page with an updated date.