Privacy policy

Who we are

ReviewPostie is operated by DARKFORGE LABS LTD, company number 17033392, a company registered in England and Wales ("we", "us"), at 19 Beehive Way, Bawdeswell, Dereham, England, NR20 4WH. We are the controller of the personal data you give us to run your account, and the processor of the customer details you enter to send review requests (see "Your customers' data" below).

Questions about this policy go to support@reviewpostie.co.uk. Operator details and this draft policy will be reviewed before public launch.

What we collect

Your account. Your email address and password (stored hashed by our authentication provider), your business name, trade, Google review link and message template, and the usual technical logs (IP address, browser, timestamps) that come with running a web service.

Your customers. The mobile number and optional first name entered by you or submitted through your QR form, request timestamps, sending channel, provider reference and any sending error. A sent status records acceptance by the SMS provider, not confirmed delivery to a handset. For messages opened in your own SMS or WhatsApp app, we record the handoff rather than whether you sent them.

Permission evidence. To prevent an unapproved send, we retain a minimised, tenant-scoped record for the exact recipient, channel and purpose: a keyed number fingerprint and four-digit suffix, controlled source and collection method, collector type, notice version, controlled original consent source and collection time, server recording and expiry times, and a separate GDPR basis selected by the business. Withdrawal, expiry and one-use consumption are recorded as controlled state. We do not store raw phones, message text, URLs, QR tokens or collector notes in this evidence.

Accounting connections. If you connect an accounting provider, we store encrypted access credentials, connection details and paid-invoice references, dates and available customer contact details. Scheduled checks use these records to prepare requests when you enable automatic sending.

Optional features. Google business search sends your search to Google. AI message suggestions are disabled.

Google Business Profile. If you connect Google to view published reviews, we store encrypted access credentials and your selected account and location identifiers. We retrieve your business list and reviews from Google when you use the feature; we do not keep a permanent review archive or send review content to analytics services. We do not edit your listing or publish replies. Disconnecting removes the stored connection and requests revocation of Google access. If Google cannot complete revocation, we show you how to remove access in your Google account. Google does not identify which request link produced a review.

Link clicks. When someone taps a tracked link (for example https://reviewpostie.co.uk/r/k7f2d9qa) we record the time of the tap, then send them on to your Google review form. The click record does not include an IP address or browser identifier; hosting providers may separately process IP addresses in technical logs.

Billing. Stripe handles payment details and billing documents. ReviewPostie stores Stripe customer and subscription identifiers, subscription status, billing periods and text usage. Card details are entered with Stripe; ReviewPostie does not store full card numbers.

We show request and link-click statistics within your account. We do not use advertising trackers or buy data about you.

Service reliability and website statistics. With your permission, we use PostHog, Vercel Web Analytics and Speed Insights to understand page visits, selected button clicks, sign-up progress, subscription take-up and loading performance. On our public homepage we also collect click positions and scrolling to create heatmaps. We retain campaign source, medium, campaign and content labels, and known referring sites, to understand which marketing brings visitors. We omit search terms, advertising click identifiers and full referrer URLs. Our analytics configuration removes other URL query strings and replaces account-history identifiers with route templates. Customer review links, QR forms and account-confirmation pages are excluded. Application logs record operation names, timings, outcomes and error classifications; our structured logger does not include form contents, customer numbers, messages, passwords or access tokens. Hosting providers also maintain their own technical logs. We send minimized error reports and application logs to PostHog in the EU to diagnose service problems. Error reports use a new random identifier for each report, without analytics cookies, form contents or URL queries. General automatic interaction capture is disabled. With separate session replay consent, PostHog records masked page layouts, clicks and scrolling across our site and app, including sign-in and customer pages, to help us find usability problems and bugs. All text and form entries are masked; images, embedded frames, QR codes, console contents and network payloads are excluded. Page addresses use route templates without queries or private identifiers. Our selected-click events use fixed labels and do not collect button text, form contents, account names or email addresses.

Lawful basis

We process your account data because it is necessary to perform our contract with you (UK GDPR Article 6(1)(b)), and to keep the service secure and to meet our legal obligations, for example tax records.

We process your customers' data on your instructions, as your processor. You decide who to contact, including through enabled accounting automation and reminders. You are responsible for the lawful basis and any consent needed under PECR and UK GDPR. Having a customer relationship, booking, invoice or prior request does not by itself establish permission to send every message. PECR permission and the GDPR basis are separate records; we do not infer one from the other. If the required basis or exact permission evidence is missing, stale or withdrawn, the service does not dispatch the message. See the ICO's guidance on electronic messages.

We rely on our legitimate interests to keep security logs and to send you occasional service emails about your account. We will not send you marketing emails without asking first, and you can opt out at any time.

Your customers' data

For the numbers and names processed for your business, you are the controller and our legal operator is the processor. We use the data to prepare the requests and reminders you enable, track link openings, prevent repeat or suppressed requests and run the service. The hosting, database and messaging providers listed below process data as needed for these purposes.

Numbers are shown to you masked (for example 07700 ••• 123) throughout the app. Our Terms include a short data-processing summary that sets out our obligations to you as processor.

Opting out and how long we keep data

SMS that we send, called Postie Texts, is sent through Twilio. Texts from a named sender include an unsubscribe link because that sender cannot receive replies. Opening the link does not opt you out: the confirmation button stops review requests from the business named on that page. The review-link page also provides a confirmation form. For messages sent from your own phone, you must handle replies and requests to stop yourself.

Link confirmations apply to the named business only. Where a reply-capable number receives a processed STOP reply (including STOPALL, UNSUBSCRIBE, CANCEL, END or QUIT), our global suppression prevents messages from every business. Existing global suppressions remain in place. A processed START, UNSTOP or YES reply can remove a global suppression, but does not remove a separate business-specific link opt-out. Businesses can see only their own masked business-specific stop records.

A permission withdrawal is committed before the next database dispatch check, and a matching check then denies the send. A provider request already begun before that check can still be accepted because the database and provider do not share an atomic transaction. We do not claim a distributed lease or cross-system rollback.

Our daily retention job clears raw mobile numbers and customer names from request and imported-invoice records older than 90 days. Request history retains a masked number, including its prefix and last three digits. We retain a business-specific, keyed number fingerprint for up to 12 months to check your repeat-request cooldown. This fingerprint is pseudonymous personal data, not anonymous data. Suppressed numbers remain on the global stop list until that suppression is removed so we can continue to honour the request. Separately, we retain business-specific suppression fingerprints, the last four digits, dates and source, and hashed unsubscribe links bound to the same business and recipient, for as long as needed to honour the choice and keep issued links working. These are pseudonymous personal data. They do not expire with the 90-day contact cleanup or 12-month cooldown, and are removed when that business account is deleted. Permission evidence has separate provisional ceilings: 90 days for manual review or reminder records, 10 minutes and one use for a QR request, and 15 minutes and one use for an owner self-test. Expired evidence is removed by the retention job and cannot authorise a send; withdrawal events remain attached only for the evidence lifetime or approved erasure/suppression handling.

Sub-processors

These providers support the service. Processing locations and contractual safeguards are subject to the final launch review.

We will update this list before adding a new sub-processor that handles your customers' data.

Connected accounting providers

When you connect Xero, FreeAgent or QuickBooks Online, you authorise ReviewPostie to read selected invoice, payment and contact data. We process the data returned to us on your instructions for the connected accounting features described above. Each provider remains governed by its own terms and privacy information. For QuickBooks Online, Intuit states that it acts as an independent controller for personal information in the service; see its UK Terms of Service and GDPR Centre.

Retention

• Trial protection. To prevent repeat free trials, we retain a protected fingerprint of your verified mobile for 12 months from activation, including after account deletion. This record contains the fingerprint and activation/expiry dates, with no raw number, email or account ID. It is pseudonymous personal data. Account-linked phone evidence expires at the same time; an existing account keeps its activation status. Verification codes are never stored by ReviewPostie. Successful challenges are removed immediately; expired challenges are cleared within 24 hours. Verification rate-limit evidence is cleared within 48 hours. Twilio processes your mobile and code for verification under its own retention arrangements.
• Customer contacts. Raw phones and names in request and invoice records are cleared after 90 days by a daily job. Masked request numbers, invoice references, send outcomes and click history remain with your account. Cooldown fingerprints expire after 12 months. Permission evidence is minimised, tenant-scoped and expires at 90 days for manual review/reminder records, 10 minutes for one-use QR requests and 15 minutes for one-use owner self-tests, pending counsel's final schedule.
• Usage and abuse prevention. Request-attempt identifiers and timestamps, without phones or names, are retained for up to 13 months for allowance checks and billing reconciliation. Salted IP hashes used to limit QR submissions are cleared after 48 hours.
• Account data. Deleting your account removes its operational account, request, connection, invoice and usage records. Global customer suppressions are retained; its business-specific suppression and unsubscribe-link records are removed. We disconnect accounting access before erasure; FreeAgent approval must first be removed in FreeAgent. If disconnection or billing cancellation fails, the account is kept for retry. Stripe and infrastructure providers may retain billing records, backups and logs under their own retention arrangements.
• Provider logs and backups. Final retention periods and any accounting-record obligations will be confirmed before public launch.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you (access);
• correct it (rectification);
• delete it (erasure);
• stop or limit how we use it (restriction and objection);
• send it to you or another provider in a usable format (portability).

Email support@reviewpostie.co.uk with your request. If one of your customers contacts us directly about their data we will pass the request to you, as you are the controller, and help you answer it.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to sort things out first.

Cookies

ReviewPostie uses essential cookies for sign-in and secure account connections. These can contain session identifiers. We do not use advertising or social-media tracking cookies. Our review-link click records are stored in the database rather than in advertising cookies.

Analytics and session replay have separate optional controls. Accept all enables both; Reject all disables both; Customise lets you choose either independently. If you allow either, we store a random browser identifier for the permitted activity. Analytics additionally stores first and latest campaign attribution for up to 30 days and flags to avoid counting a conversion milestone repeatedly. We store your choices locally. These records are pseudonymous and are not linked to your account identity in PostHog. You can change or withdraw either choice below. Withdrawal stops future collection for that category and clears its browser data; rejecting both removes the shared identifier. Earlier recordings are not automatically deleted by withdrawal. Do Not Track and Global Privacy Control signals are respected. Essential minimized error reporting continues without a stored identifier.

International transfers

Providers may process data outside the UK. The final policy will identify the relevant processing locations, agreements and international-transfer safeguards after these have been reviewed for the production setup.

Children

ReviewPostie is a business tool for adults. You must be 18 or over to hold an account, and you should not use it to text anyone you know to be under 18.

Changes to this policy

If we make a material change we will email you at least 14 days before it takes effect and update the date at the top of this page. Minor wording changes may be made without notice.

Contact

DARKFORGE LABS LTD (17033392), 19 Beehive Way, Bawdeswell, Dereham, England, NR20 4WH. Email support@reviewpostie.co.uk.