Privacy policy
Last updated 19 October 2026
This policy covers marchlight.pro, the booking pages at book.marchlight.pro, and the booking widget when it is embedded on a client's own website.
The short version
- If you are booking an appointment, the business you are booking with decides what happens to your details. Marchlight only stores and sends them on that business's instructions.
- Data is currently stored on a server in India. If you are in the UK or EU, that is an international transfer, and it is described in full below rather than buried.
- There are no cookies, no advertising and no cross-site trackers on marchlight.pro or in the booking widget. marchlight.pro uses Cloudflare Web Analytics, which counts visits without cookies (see below); the booking widget uses no analytics at all.
- Marchlight never sells data, and never uses one client's customer list to market to another.
Who is responsible for what
Two different relationships, which matter legally:
| Situation | Controller | Processor |
|---|---|---|
| You book an appointment with a clinic, salon or practice using Marchlight | That business | Marchlight |
| You email Marchlight, or a business buys Marchlight | Marchlight | — |
For the first row, ask the business for their own privacy notice: they chose what to collect and how long to keep it. Marchlight acts on their instructions and will pass any request straight to them. The terms of that relationship are in the data processing agreement.
What is collected when someone books
| Data | Why | Required? |
|---|---|---|
| Name | So the business knows who is coming | Yes |
| Email address | Confirmation, reminders, cancellation link | Depends on the business's setting; without it no confirmation or reminder can be sent |
| Phone number | So the business can reach you about the appointment | Depends on the business's setting |
| "Anything we should know?" note | Free text passed to the business | No — leave it blank if you prefer |
| Marketing opt-in | Only if you tick the box; unticked by default | No |
| Appointment details | Service, staff member, date, time, status, and whether reminders were sent | Created by the booking itself |
Health information. The note box is free text, so somebody can type anything into it, including details of a health condition. Marchlight does not ask for health information, does not require it to make a booking, and the widget says so under the box. If you would rather tell the clinic in person, leave it blank. Marchlight is a diary — it holds no clinical records, no treatment notes and no medical history.
What is deliberately not collected: no IP addresses, no browser fingerprints, no device identifiers and no location data are stored against a booking. There is no advertising tracking anywhere on the site or in the widget. The only browser storage used by marchlight.pro is a single entry remembering whether you chose light or dark mode.
Visitor statistics on marchlight.pro: we use Cloudflare Web Analytics to see how many people visit and which pages they read. It sets no cookies, stores nothing in your browser, does not fingerprint you and does not follow you to other sites. It records the page, the referring site, and approximate country, browser and device type, and we only ever see those as totals. It runs on marchlight.pro only, not on the booking pages or the booking widget. Cloudflare's own policy is at cloudflare.com/privacypolicy.
Email tracking, stated plainly
Confirmations, reminders and cancellation notices are sent through Brevo (see sub-processors). At present those emails carry Brevo's open-tracking image, and their links are rewritten so clicks are counted. That means Brevo can see whether and when a message was opened, which is more than a clinic needs to know.
We have asked Brevo to switch this off for all transactional email and we are testing the result. This page will be updated the day it is confirmed off. Until then, do not assume it is. If it matters for your clients, ask us before signing up.
The AI assistant
Questions typed into an AI assistant we run (including the one on marchlight.pro/ai) are answered by an open-source model on our own server. They are not sent to OpenAI, Google or any other AI company. The assistant does not store the text of questions; our web server keeps an ordinary access log (time, IP address, page requested) as it does for every request. Documents a client gives us to build their assistant or train a model are kept only for that purpose and returned or deleted when they ask.
Where data is stored, and the transfer to India
The booking database runs on a single server operated by Sahil Sidhu in Barnala, Punjab, India, behind Cloudflare. Backups are stored on that same machine. The full technical position, including its weaknesses, is on the security and uptime page.
India has no UK or EU adequacy decision. A transfer of UK or EU personal data to Marchlight therefore relies on the Standard Contractual Clauses (with the UK International Data Transfer Addendum where the UK GDPR applies), which are incorporated into the data processing agreement and signed before any client data is loaded.
No move is planned. Data stays on our own server in India. If that ever changes, every client will be told in writing at least 30 days before their data moves, and this page and the sub-processor list will be updated on the day it happens.
How long data is kept
| Data | Kept for |
|---|---|
| Appointments and customer records | As long as the business remains a client, plus 30 days after the account closes, then deleted |
| Backups | 14 daily copies and 8 weekly copies, then overwritten — so deleted data can persist in backups for up to 8 weeks |
| Email delivery logs at Brevo | Per Brevo's retention, typically a small number of months |
| Emails you send to hello@marchlight.pro | Up to 24 months, so a conversation can be picked up again |
| Cold outreach records (who was emailed, and any opt-out) | Opt-outs are kept indefinitely — that is the only way to guarantee nobody is contacted twice after asking not to be |
A client can ask for a specific customer record to be deleted at any time and it is removed from the live database immediately.
Your rights
Under UK and EU GDPR you can ask for a copy of your data, correction, deletion, restriction, portability, and you can object to processing. Where the data concerns an appointment, ask the business you booked with — they are the controller, and Marchlight will assist them within 5 working days.
For anything Marchlight controls directly, email hello@marchlight.pro. Requests are answered within 30 days, and there is no charge.
If you are unhappy with the response you can complain to your data protection authority — in the UK, the Information Commissioner's Office at ico.org.uk.
If you message us on WhatsApp
WhatsApp is offered only as a way to contact us. Messages you send there are carried and stored by WhatsApp (Meta) under its own terms and privacy policy. We use them only to reply to you, and we never put client or patient data into WhatsApp. If you would rather your enquiry stayed off it, use email or the forms on this site.
Marketing and cold email
Marchlight sends cold business-to-business email to published business addresses. Every message carries a postal address and a one-line opt-out. Reply with "unsubscribe", or any words to that effect, and the address is marked and never contacted again on any channel, including WhatsApp. That record is kept precisely so the promise can be kept.
Changes to this policy
The date at the top changes when the policy does. Anything that materially affects a client's own compliance position — a new sub-processor, a change of hosting country — is emailed to clients at least 30 days beforehand, not published quietly.
Contact for all privacy matters: Sahil Sidhu, 168 Maharaja Aggersain Enclave, Barnala, Punjab 148101, India, hello@marchlight.pro.