Last reviewed 24 August 2026
Privacy notice
wagfield is booking software for UK dog walking fields. This page says what we hold about the people who own those fields, what we hold on their behalf about the people who book them, who else it reaches, and how to get it changed or deleted.
wagfield is run by a sole trader in the United Kingdom, who is the data controller for everything described here as ours. There is an email address at the bottom of this page, and a person reads it.
Two roles, and which one applies to you
If you own a field, wagfield is the data controller. We decided what to collect about you and what it is for, and this notice is our own.
If you booked a walk, the field owner is the controller and wagfield is their processor. You are buying from them, not from us — their Stripe account takes the payment and their cancellation policy governs the booking — so what happens to your details is their decision, carried out by our software under our contract with them. Ask them first; if you cannot reach them, write to us and we will help.
If you asked to be told when we open
While signups are shut, /sign-up offers a short form. It takes your email address, and optionally the postcode of your field and anything you wanted to tell us. That is all of it.
It is not an account: nothing on that list can sign in, own a field or be charged, and it is kept apart from the accounts table for exactly that reason. We use it to write to you once, when signups open. It is never used to advertise anything, never shared, and never merged into anything else.
The lawful basis is our legitimate interest in telling people who asked to be told. Reply to that one email, or write to us before it, and the entry goes.
If you own a field
- Your account
- Your name, email address and mobile number, and the password you set. We are told by Stripe whether your payment setup is complete — never what you typed into it.
- Your field
- Its name, town, county, postcode and map coordinates, your photos, your description and rules, your gate code and access instructions, and every price and hour you set.
- Your bill
- Your £29 subscription and its status, any SMS credit top-ups you buy, and the monthly invoices behind them. Card details go to Stripe, not to us.
- Getting you in
- Sign-up and invite links are stored as one-way hashes with an expiry — 24 hours for a sign-up, 14 days for an invite — so a stolen database row is not a stolen link.
- Keeping the door shut
- Failed sign-ins and repeated requests are counted against your email address and the IP address they came from, so a stranger cannot sit on the form all night.
We hold it to run the service you are paying for, which is the lawful basis for most of it: performance of a contract. Counting failed sign-ins and checking a sign-up form for robots is our legitimate interest in a service that is not trivially abusable. Keeping your invoices is a legal obligation.
If you booked a walk
- Who you are
- The name, email address and mobile number you type into the booking sheet, so the field owner can confirm the booking and reach you if the field has to shut.
- What you booked
- The field, the date and time, how many dogs, what it cost, whether it is paid, and anything you wrote in the notes box about your dog.
- Waiting lists
- If you ask to be told when a day frees up, your email address and mobile number are held against that date until the day passes.
- Your account, if you make one
- Signing in with a six-digit code lets you see your bookings across every wagfield field you have used. Nothing new is collected; the same bookings are simply gathered under one address.
None of it is used to advertise to you. wagfield sends you nothing but the emails the booking itself requires — a confirmation, a reminder the morning of, and a cancellation if the field shuts — and a text only if the field owner chose to send one about a change to your booking or a slot you asked to be told about.
Card details
We never see them. Payment happens on Stripe's own hosted page: your card number is typed into Stripe, and what comes back to us is whether it worked and a reference for the payment. The same is true of a field owner's subscription, and of the bank and identity details an owner gives Stripe when they set up to be paid.
Who else touches it
- Supabase
- The database, sign-in and photo storage. Everything above lives here.
- Stripe
- Payments, refunds, and the owner's own Stripe account. Card details are typed on Stripe's page and never reach us. Owners give Stripe their identity and bank details directly, under Stripe's own terms.
- Brevo
- Sends every email the product sends — confirmations, reminders, cancellations, sign-in links. Gets the recipient's address and the message.
- The SMS Works
- Sends the texts a field owner chooses to send: a field shutting, a slot freeing up. Gets the mobile number and the message.
- Vercel
- Runs and serves the site. Sees the requests that reach it, including IP addresses, in short-lived logs.
- Cloudflare
- Turnstile, the check that a sign-up came from a person. Gets the IP address and browser signals of anyone using that one form.
- postcodes.io
- Turns a field's postcode into map coordinates when the owner saves it. Gets the postcode. Nobody's personal details are sent.
- OpenStreetMap
- Draws the map on a field's page. Because the map loads in your browser, OpenStreetMap sees your IP address when you look at a field.
That list is complete, not a sample. We do not sell anything to anyone, we run no analytics or advertising, and nobody else is sent your details. We would hand data to the police or a court if we were lawfully required to, and to a buyer if the business were ever sold — in which case this notice comes with it.
Outside the UK
Some of the companies above are American: Stripe, Vercel and Cloudflare. Your details reach them because they run the payment, the site and the sign-up check, and each is covered by the standard contractual clauses the UK requires for that, with the UK addendum. Supabase is American too, but the database itself sits in London. Brevo is French and The SMS Works is British. Nothing is sent anywhere else, and nothing is sent for any purpose but the one named beside the company.
Nothing here makes an automated decision about you. There is no scoring, no profiling and no algorithm deciding whether you may book — a booking succeeds if the slot is free and the card clears.
How long we keep it
- Bookings and customer details
- Held while the field owner's account is open, because that is their record of who came and what they paid. Deleted within 30 days of an account closing. An owner can delete a customer sooner.
- Waiting-list entries
- Cleared once the date they watch has passed.
- Owner accounts and fields
- Held while the account is open, and deleted within 30 days of it closing.
- Billing records
- Kept for six years after the tax year they belong to, because HMRC requires it. This is the one thing an erasure request cannot reach.
- Sign-in and invite links
- Expire on their own — 24 hours and 14 days — and the stored hash goes with the row.
- Rate-limit counters
- Swept within days. They exist to count the last few minutes, not to keep a history.
- “Tell me when it opens”
- Deleted once we have written to you and you have decided, and in any case within twelve months. Ask us sooner and it goes sooner — there is nothing here we need to keep.
Your rights
You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to stop or limit what we do with it, and object to it. A field owner can also export their whole customer list and booking history as a spreadsheet at any time, including on the day they leave. We answer within one month and we do not charge for it.
If you booked a walk, send the request to the field owner — they are the controller and we act on their instruction. We will act directly where the data is ours to act on, and pass on anything that is not.
How to reach us
Email hello@wagfield.co.uk and a person reads it — that is the fastest way to get something put right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator.
Changes
When this changes, the date at the top changes with it. If a change matters to you — a new processor, a new purpose — you will get an email about it rather than being left to notice.
Which agreement covers what, for a customer and for an owner, is set out in who you are dealing with.