Privacy Policy

Last updated: 13 August 2026

This policy explains how Collaborative Business Development Limited ("we", "us", "our"), trading as Review & Referral, collects and uses personal data through the Review & Referral platform (the "Service"). We are a company registered in the United Kingdom, with our registered office at 37 Provender House, Waterloo Quay, Aberdeen, AB11 5BS. You can contact us about privacy at info@collaborativebd.com.

Who this policy applies to

The Service is used in two different ways, and this policy covers both:

• Business account holders. If you've signed up for a Review & Referral account on behalf of your business, we are the controller of your own account data (your name, email, business details, and billing information). This policy explains that relationship directly.
• Contacts of a business using the Service. If a business has added you as a contact in order to ask you for a review or a referral, that business is the controller of your personal data, and we act as their processor — we only handle your data on their instructions, to send the messages they've asked us to send and to record your responses. If you have questions about why you received a message, or want to exercise your data rights, your first point of contact should be the business that added you, since they control what data is held and why. Every message we send on a business's behalf includes an unsubscribe / opt-out link that stops further messages immediately.

Information we collect

About business account holders

When you create an account, we collect your business name, email address, and password (stored securely as a one-way hash — we never see or store your actual password). We also collect optional settings you choose to add, such as a sender display name, reply-to email address, SMS sender ID, and links to your review profiles (for example, Google or Trustpilot).

About contacts added to the Service

When a business adds a contact, we hold whatever the business has entered — typically a name, and an email address and/or phone number. We also keep a record of the messages sent (review or referral requests), when they were sent, and any resulting activity, such as a referral submitted through a referral link or an opt-out request.

Payment information

Card and billing details are collected and processed directly by our payment provider, Stripe — we do not receive or store full card numbers ourselves. We keep a reference to your Stripe customer and subscription records so we know your plan is active.

Technical information

Like most web services, our hosting and infrastructure providers automatically log basic technical information (such as IP address and browser/device details) needed to operate the Service securely and reliably.

How we use information

We use personal data to:

• Create and run business accounts, and provide the core Service (sending review and referral requests by SMS and email, and tracking responses);
• Process payments and manage subscriptions and top-up purchases;
• Communicate with account holders about their account, billing, or service updates;
• Maintain the security of the Service and prevent misuse;
• Meet our legal and regulatory obligations.

Our legal bases for processing

For business account holders, we process your data because it's necessary to perform our contract with you (providing the Service you've signed up for), and to comply with legal obligations (such as keeping billing records). For contacts of a business, the business decides the legal basis they rely on to contact you (for example, their own legitimate interest in asking a customer for a review) — we process that data strictly as their processor, under a data processing agreement, and only on their documented instructions.

Who we share information with

We share personal data with a small number of trusted service providers who help us run the Service, and only to the extent needed for them to provide that service to us:

• Supabase — database hosting and account authentication.
• Vercel — application hosting.
• Stripe — payment processing and billing.
• Twilio — sending SMS messages.
• Resend — sending email messages.

We do not sell personal data, and we do not share it with anyone for their own marketing purposes.

International transfers

Some of the providers listed above may process data outside the UK. Where that happens, we put appropriate safeguards in place, such as the UK's International Data Transfer Addendum or Standard Contractual Clauses, so your data continues to be protected to UK standards wherever it's processed. Full details of each provider and where they process data are available on request.

How long we keep information

We keep account and contact data for as long as a business account remains open, since businesses rely on that history (for example, to see who they've already asked for a review). A business owner can permanently delete their entire account at any time from Settings — doing so immediately and permanently deletes the account and everything associated with it, including all contacts, message history, and referral records. We don't currently apply any automatic time-based deletion beyond that.

Your rights

Under UK data protection law, you have the right to access the personal data we (or, if you're a contact of one of our business customers, that business) hold about you, to have inaccurate data corrected, to have it deleted, to restrict or object to certain processing, and to receive a copy of your data in a portable format. If you're a business account holder, contact us at info@collaborativebd.com to exercise these rights. If you're a contact of a business using our Service, please contact that business directly, as they control your data; we'll support them in responding to you. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk.

Security

We use industry-standard measures to protect personal data, including encrypted connections (HTTPS) throughout the Service, securely hashed passwords, and access controls that limit who and what can reach personal data within our systems.

Cookies

We use only essential cookies required to keep you securely signed in. We do not currently use tracking, analytics, or advertising cookies.

Children's privacy

The Service is intended for business use and is not directed at, or knowingly used to collect information from, children.

Changes to this policy

We may update this policy from time to time. If we make significant changes, we'll let account holders know, and the "Last updated" date at the top of this page will always reflect the most recent version.

Contact us

Collaborative Business Development Limited, 37 Provender House, Waterloo Quay, Aberdeen, AB11 5BS
info@collaborativebd.com