Privacy policy

Last updated: 23 March 2026
Version 1.0

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

DATA CONTROLLER
Matthew Stout, trading as Boarding Soon
51 Gosberton Road, London, SW12 8LE, United Kingdom
Email: matt@getboardingsoon.com
Website: www.getboardingsoon.com

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. INTRODUCTION

This Privacy Policy explains how Boarding Soon ("we", "us", "our"), operated by Matthew Stout, collects, uses, stores and protects your personal data when you visit our website at www.getboardingsoon.com, make a purchase, or use our Google Sheets travel planner products.

We are committed to protecting your privacy and handling your personal data in a transparent, lawful and fair manner. This policy is written in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully. By using our website or purchasing our products, you acknowledge that you have read and understood this policy.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

2. WHO WE ARE

Boarding Soon is a sole trader business based in the United Kingdom, operated by Matthew Stout. We create and sell destination-specific travel planner templates built in Google Sheets, sold through our website at www.getboardingsoon.com and via the Etsy marketplace.

As the operator of our website and the creator of our digital products, Matthew Stout is the data controller responsible for your personal data under UK GDPR.

We are not registered as a limited company and do not have a company registration number. We are not VAT registered.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

3. WHAT DATA WE COLLECT

3.1 Data You Provide to Us

When you interact with Boarding Soon, we may collect the following personal data:

PURCHASE DATA
Your name, email address and billing address when you make a purchase. Payment card details are handled entirely by Shopify Payments and are never seen or stored by us.

CONTACT DATA
Your name and email address if you contact us via our website contact form or via Etsy with a question or support request.

EMAIL MARKETING
Your email address if you choose to sign up for our newsletter or marketing emails. This is always optional and requires your explicit consent.

────────────────────────────────────────────────────────────────────

3.2 Data Collected Automatically

When you visit our website, certain technical data may be collected automatically by Shopify, the platform that powers our store. This may include:

- IP address
- Browser type and version
- Operating system
- Pages visited and time spent on those pages
- Referring website (how you found us)
- Date and time of your visit

This data is collected by Shopify as part of their standard platform operation and is used for fraud prevention, security and basic store functionality. We do not use third-party analytics tools such as Google Analytics on our website.

3.3 Data From Our Google Sheets Products — Important

Our travel planner products are built using Google Apps Script, which runs inside Google Sheets. When you use one of our planners, the script requests your permission to access your Google account. This section explains precisely what Google user data is collected, how it is used, and how it is protected.

WHAT GOOGLE USER DATA THE SCRIPT COLLECTS AND ACCESSES:

The script accesses only the specific Google Sheet you are actively using. It does not access any other Google services, files or accounts. Specifically, the script:

- Reads from and writes to the Google Sheet you are using, in order to build your personalised travel planner from the details you enter during setup
- Stores small amounts of data in the document's own property storage (for example, your trip dates and traveller names), held entirely within that sheet and never transmitted externally
- Creates a time-based trigger that runs once per day to update a language feature within your planner dashboard
- Fetches a live currency exchange rate via Google Finance to display in your planner dashboard

WHAT THE SCRIPT DOES NOT ACCESS:

The script operates under Google's 'spreadsheets.currentonly' permission scope, which strictly limits it to the sheet you are actively using. It cannot and does not access:

- Your Gmail or any other Google account data
- Any Google Drive files other than the specific sheet you are using
- Your Google Calendar, Contacts, or any other Google service
- Your Google account profile, name or email address
- Any other spreadsheets, documents or applications

HOW WE USE THIS GOOGLE USER DATA:

Google user data accessed by our script is used solely to provide the functionality of the travel planner you have purchased. Specifically:

- Spreadsheet read/write access is used to populate your planner with personalised content based on your setup inputs
- Document property storage is used to remember your trip configuration between sessions so the planner functions correctly
- The daily trigger is used to update the Word of the Day feature automatically
- The currency rate fetch is used to display a live conversion rate in your dashboard

We do not use Google user data for any purpose other than providing the planner functionality you have chosen to use. We do not use this data for advertising, profiling, or any commercial purpose beyond operating the product. We do not sell, share, transfer or disclose Google user data to any third party for any purpose.

IMPORTANT: We do not collect, store, transmit or have any access to the data you enter into your planner. Your trip details, traveller names, expenses and itinerary entries live entirely within your own Google Sheet, in your own Google account. We have no visibility of this data at any point.

The permissions granted when you authorise the script are scoped exclusively to the current spreadsheet ('spreadsheets.currentonly') and do not grant us access to any other part of your Google account.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

4. HOW WE USE YOUR DATA

We use the personal data we collect for the following purposes:

TO FULFIL YOUR PURCHASE
Processing your order and delivering your digital product.
Legal basis: Performance of a contract (UK GDPR Article 6(1)(b)).

TO PROVIDE CUSTOMER SUPPORT
Responding to your questions, support requests or complaints via our contact form or Etsy.
Legal basis: Legitimate interests (UK GDPR Article 6(1)(f)).

TO SEND MARKETING EMAILS
Sending newsletters or promotional content about new products and destinations, if you have opted in.
Legal basis: Consent (UK GDPR Article 6(1)(a)). You can withdraw consent at any time by clicking unsubscribe in any email.

TO COMPLY WITH LEGAL OBLIGATIONS
Retaining purchase records for tax and accounting purposes as required by HMRC.
Legal basis: Legal obligation (UK GDPR Article 6(1)(c)).

We do not use your personal data, and do not use Google user data accessed through our script, for any purpose beyond those described above. We do not sell, use for advertising, or share your data or any Google user data with third parties for their own commercial purposes.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

5. HOW LONG WE KEEP YOUR DATA

We keep your personal data only for as long as is necessary for the purposes set out in this policy:

PURCHASE RECORDS
Retained for 7 years to comply with HMRC requirements for financial records.

CUSTOMER SUPPORT CORRESPONDENCE
Retained for up to 2 years after your last interaction.

MARKETING EMAILS
Retained until you unsubscribe or withdraw consent, after which your email address will be removed from our mailing list within 30 days.

TECHNICAL/PLATFORM DATA
Data collected automatically by Shopify is retained in accordance with Shopify's own data retention policies.

GOOGLE USER DATA
Google user data accessed by our script is not retained by us at any point. All data processed by the script remains within your own Google Sheet and Google account. When you delete your copy of the planner, all associated data is deleted with it. You may also revoke the script's access at any time via your Google account security settings at myaccount.google.com/permissions, which will prevent any further access.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

6. WHO WE SHARE YOUR DATA WITH

We do not sell, rent or trade your personal data to any third party. We do not transfer or disclose Google user data to any third party for any purpose. We may share your personal data with the following trusted service providers who assist us in operating our business, strictly for the purposes described in this policy:

ETSY
If you purchase through our Etsy shop, your order data is handled by Etsy in accordance with their own privacy policy. We receive only the information necessary to fulfil your order.

SHOPIFY
Our website is built on Shopify. When you make a purchase or browse our store, Shopify processes your personal data as part of providing their platform. Shopify handles payment processing via Shopify Payments, which is PCI-DSS compliant. We never see or store your full card details.

EMAIL MARKETING
If you subscribe to our newsletter, your email address is stored with our email marketing provider. This provider is contractually required to handle your data in compliance with UK GDPR.

GOOGLE
Our travel planner products run via Google Apps Script within Google Sheets. Google's own privacy policy governs how Google handles data within its platform. The script accesses only the specific spreadsheet you are using and no other Google account data. We do not share any Google user data with Google or any other party beyond what is necessary for the script to function within your own sheet.

All third-party providers we use are required to process your data only on our instructions and in accordance with applicable data protection law.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

7. YOUR RIGHTS UNDER UK GDPR

As a data subject, you have the following rights regarding your personal data:

RIGHT OF ACCESS
You have the right to request a copy of the personal data we hold about you.

RIGHT TO RECTIFICATION
You have the right to ask us to correct any inaccurate or incomplete data we hold about you.

RIGHT TO ERASURE
You have the right to ask us to delete your personal data, where there is no lawful reason for us to continue holding it.

RIGHT TO RESTRICT PROCESSING
You have the right to ask us to pause processing of your data in certain circumstances.

RIGHT TO DATA PORTABILITY
You have the right to receive your personal data in a structured, commonly used format and to transfer it to another controller.

RIGHT TO OBJECT
You have the right to object to processing based on legitimate interests, and to opt out of direct marketing at any time.

RIGHT TO WITHDRAW CONSENT
Where we rely on consent as our legal basis, you can withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us at matt@getboardingsoon.com. We will respond within one calendar month. You will not be charged for making a request.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

8. COOKIES

8.1 What Are Cookies

Cookies are small text files placed on your device when you visit a website. They help websites function correctly and remember information about your visit.

8.2 Cookies We Use

Our website is built on Shopify, which uses cookies as part of its standard operation. These include:

ESSENTIAL COOKIES
Required for the website and checkout to function correctly. These include session management, cart functionality, fraud prevention and security cookies. These cannot be disabled as the store cannot operate without them.

SHOPIFY PLATFORM COOKIES
Shopify sets its own cookies to enable core store functionality including the shopping cart, checkout process and purchase confirmation. These are governed by Shopify's Cookie Policy.

We do not use advertising cookies, tracking cookies or third-party analytics cookies on our website. You can manage cookie preferences through your browser settings at any time.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

9. DATA SECURITY

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure or destruction.

These measures include:

- Use of HTTPS encryption on our website
- Access controls limiting who can view customer data
- Use of reputable, security-certified third-party processors (Shopify, Google)
- Regular review of our data handling practices

With regard to Google user data specifically: our script operates within Google's own secure infrastructure. We do not store, transmit or retain any Google user data on external servers. All script operations occur within Google's platform and your data remains within your own Google account at all times. Security procedures are in place to protect the confidentiality of your data and we use Google's secure APIs to access the minimum necessary information.

While we take all reasonable steps to protect your data, no internet transmission or electronic storage is completely secure. We cannot guarantee absolute security, but we will notify you and the ICO promptly in the event of a data breach that is likely to affect your rights or freedoms.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

10. CHILDREN'S PRIVACY

Our website and products are not directed at children under the age of 13. We do not knowingly collect personal data from anyone under 13. Our script does not collect data from child-directed applications. If you believe we have inadvertently collected data from a child under 13, please contact us immediately and we will delete it.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

11. LINKS TO OTHER WEBSITES

Our website may contain links to third-party websites, including Etsy and Google. We are not responsible for the privacy practices of those websites and encourage you to read their own privacy policies. This Privacy Policy applies only to our website at www.getboardingsoon.com and our products.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

12. INTERNATIONAL DATA TRANSFERS

Some of our third-party service providers are based outside the UK. Where this is the case, we ensure that appropriate safeguards are in place to protect your data.

Shopify is headquartered in Canada, which has an adequacy decision from the UK, meaning transfers of personal data to Shopify are permitted without additional safeguards.

Google's services are operated internationally. Google LLC is certified under the UK-US Data Bridge, which provides an appropriate level of protection for transfers of personal data from the UK to the United States.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

13. GOOGLE OAUTH AND SCRIPT PERMISSIONS — DETAILED DISCLOSURE

This section is provided to give full transparency about the Google permissions our travel planner products request, in accordance with Google's requirements for applications using OAuth 2.0 and the Google API Services User Data Policy.

13.1 Permissions Requested and Why

SPREADSHEETS.CURRENTONLY
Allows the script to read from and write to the specific Google Sheet you are actively using. This scope is the minimum necessary for the product to function. The entire planner works by reading your setup inputs from the sheet and writing your personalised itinerary, packing lists, expense tracker and destination guide back into the sheet. We request only this narrower 'currentonly' scope rather than full spreadsheet access, meaning the script cannot access any other Google Sheets or Drive files. Without this permission the product cannot function at all.

SCRIPT.STORAGE
Allows the script to store small amounts of data in the document's own property storage. This is used solely to remember that you have initialised your trip, and to store configuration data such as your traveller names, trip dates and home currency preference. This data is stored within the spreadsheet's own document properties and never transmitted externally. Without this permission the planner cannot remember your settings between sessions.

SCRIPT.SCRIPTAPP
Allows the script to create a time-based trigger that runs once per day. This trigger is used exclusively to update the Word of the Day feature in your planner dashboard, refreshing the displayed vocabulary word each morning. The trigger operates only within the context of your spreadsheet. It does not access any other part of your Google account. Without this permission the Word of the Day would only update when you manually open the sheet.

SCRIPT.EXTERNAL_REQUEST
Used to fetch a live currency exchange rate via Google Finance. This is a read-only lookup that retrieves the current exchange rate between your home currency and your destination currency, displayed in your planner dashboard. No personal data is transmitted in this request. Without this permission the currency converter would display a static rate rather than a live one.

13.2 What We Do Not Access

Our script operates under the 'currentonly' scope, strictly limiting it to the spreadsheet you are actively using. It cannot and does not access:

- Any other files in your Google Drive
- Your Gmail, Google Calendar, Google Contacts or any other Google service
- Your Google account profile, name or email address
- Any other spreadsheets or documents
- Any data from any other application or service

13.3 How We Use Google User Data

Google user data accessed by our script is used solely for the following purposes, which are directly related to providing the travel planner functionality you have purchased:

- Spreadsheet data is read to understand your trip setup inputs and written to display your personalised planner content
- Document property data is used to maintain your session configuration
- The trigger is used to refresh the Word of the Day each day
- The external request is used to display a live currency conversion rate

We do not use any Google user data for advertising, user profiling, market research, or any purpose other than providing the planner functionality described above. We do not share, sell, transfer or disclose Google user data to any third party.

13.4 Data Storage and Retention for Google User Data

All Google user data processed by our script remains within your own Google Sheet and Google account. We do not store Google user data on any external server, database or system operated by Boarding Soon or any third party.

When you delete your copy of the planner, all associated data is deleted with it. If you revoke the script's permissions via your Google account security settings, the script will no longer be able to access your sheet and all associated triggers will be removed.

13.5 Revoking Permissions

You can revoke the script's permissions at any time by visiting Google's security settings at myaccount.google.com/permissions and removing 'Boarding Soon Travel Planner' from the list of connected apps. Revoking permissions will prevent the script from functioning but will not affect any data you have already entered into your sheet.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

14. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, products or legal obligations. When we make material changes we will update the 'Last updated' date at the top of this policy. If we change how we use Google user data in any way, we will update this policy before making those changes and notify affected users where required.

We encourage you to review this policy periodically. Continued use of our website or products after changes have been made constitutes your acceptance of the updated policy.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

15. CONTACT US

If you have any questions about this Privacy Policy, wish to exercise any of your rights, or have a complaint about how we have handled your personal data, please contact us:

Boarding Soon
Matthew Stout
51 Gosberton Road
London
SW12 8LE
United Kingdom
Email: matt@getboardingsoon.com
Website: www.getboardingsoon.com

We aim to respond to all privacy-related enquiries within 30 days.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Your cart is empty

Privacy policy