Privacy Policy
Effective Date: 14 August 2026 | Last Updated: 7 November 2026
Introduction & Overview
Trust and transparency are central to the operation of the Platform. This Privacy Policy explains how TBHreviews ("we", "us", or "our") collects, uses, stores, and protects your personal information when you use our website, write reviews, save service providers, or claim a business listing.
We operate the TBHreviews community review directory at www.tbhreviews.co.uk (the "Platform").
1. Who We Are (Data Controller)
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the Data Controller responsible for your personal information is:
- Entity/Name: Victoria Johnson
- Location: United Kingdom
- Contact Email: support@tbhreviews.co.uk
2. Information We Collect
We collect information directly from you, automatically when you use our site, and through third-party infrastructure.
A. Account & Profile Information
- Community Members: Name, email address, and profile credentials when you register an account.
- Business Owners: Business email, contact details, business owner name, and listing preferences.
- Account History & Location: Your username history (to enforce username changes) and, if you allow it, your approximate location (to show providers near you).
B. User Reviews & Community Interactions
We may collect:
- Text content of your reviews
- Proof of appointment (receipts, booking confirmations or message screenshots). Seen only by our moderators and never published
- Star ratings and subcategory selections
- Photos uploaded alongside reviews (stored privately and served via time-limited secure links)
- Saved or favourited providers
- Helpfulness votes on other reviews
- Moderation records (what was decided, by whom and when)
How you appear on a review: reviews are posted as “Anonymous” by default. If you choose to post with your name, only your first name and the initial of your last name are shown (for example, “Tasha M.”), taken from the name on your account. Your username, email and proof are never shown. To have your name shown on, or removed from, a review you've already posted, email support@tbhreviews.co.uk.
C. Business Claim Verification Documents
If you apply to claim a business listing, we may collect proof-of-ownership documentation, such as identity documents, utility bills, or business registration certificates. These documents are stored in an encrypted, private storage location and are accessible only to authorised administrators.
We also collect your phone number and business email, and, where the listing has one, a verification code you send us from the business's Instagram account.
D. Community Safety & Reports
We collect information provided when you report a review, listing, or user for violations of our policies.
E. Technical & Usage Data
We may collect IP address, browser type, operating system, timestamp information, referring URLs, and session/authentication information. Secure tokens may be stored locally in your browser to keep you signed in.
F. Waitlist Signups
If you join our pre-launch waitlist, we collect your email address and any service providers you tell us you'd like to see on the Platform. We use this to email you when we launch, and to decide which businesses to add to the directory first.
G. Invite and Share Links
If you arrive through a provider's share link, we record which link you used, so our moderators can tell solicited reviews apart. This uses a small cookie. It isn't shown publicly.
If you join through a friend's invite link, we record that they invited you. They see how many people joined, never who.
H. Messages and Notifications
Messages you send through our contact form, and in-app notifications we send you.
3. How & Why We Use Your Information
Under the UK GDPR, we process personal data only where we have a valid lawful basis.
| Purpose | Data Used | Lawful Basis |
|---|---|---|
| Account creation and sign-in | Email, name, credentials | Contractual necessity |
| Publishing community reviews | Review text, ratings, photos | Contractual necessity & Legitimate interests |
| Review moderation & fraud prevention | Review content, metadata, moderation records | Legitimate interests |
| Checking proof of appointment | Proof documents | Legitimate interests |
| Share-link attribution | Which share link you used | Legitimate interests |
| Invite links from friends | Which friend's invite link you joined through | Legitimate interests |
| Business claim verification | Verification documents, business contact info | Legitimate interests & Contractual necessity |
| Transactional emails | Email address, name | Contractual necessity |
| Waitlist signup and launch notification | Email address, suggested business names | Legitimate interests |
| Platform security & abuse prevention | IP address, reports, security logs | Legitimate interests |
Where we rely on legitimate interests, we have considered those interests against your rights and freedoms. We may also process information to comply with legal obligations.
4. How We Share & Store Your Information
We do not sell, rent, or trade your personal data to third parties for marketing purposes. We share information only where necessary to operate, secure, and improve the Platform, including with trusted service providers:
- Supabase Inc.: Database, authentication, and cloud storage infrastructure.
- Vercel Inc.: Web hosting, infrastructure, and automated backend operational tasks.
- Resend Technologies Inc.: Transactional email services (account confirmations, password resets, notifications).
- Umami Software, Inc.: Cookieless visitor statistics (see section 7). No personal data is sent.
5. Data Retention & Deletion
Account & Profile Data: Retained while your account remains active. Upon deletion, personal details are permanently deleted or anonymised unless legal obligations require retention.
Public Reviews: Published reviews remain visible to maintain directory integrity. If your account is deleted, reviews remain visible in an anonymised form.
Proof of Appointment & Claim Documents: Kept privately for as long as the review or claim exists, so it can be rechecked. You can ask us to delete it. If we ask you for more proof after you've submitted a review, what you send us through that link is deleted 30 days after we've approved or rejected the review.
Waitlist Data: Retained until launch and for up to 12 months afterwards. Email support@tbhreviews.co.uk at any time to be removed.
6. Your Rights Under UK GDPR
Depending on the circumstances, you have the following rights regarding your personal information:
- Right of Access: Request a copy of the personal information we hold.
- Right to Rectification: Request correction of inaccurate/incomplete data.
- Right to Erasure: Request deletion of your personal information.
- Right to Restrict or Object: Ask us to limit or stop processing under certain conditions.
- Right to Data Portability: Request your data in a structured, machine-readable format.
To exercise these rights, contact us at support@tbhreviews.co.uk. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).
7. Cookies & Local Storage
TBHreviews uses essential local storage and session cookies required for secure operation:
- Authentication Tokens: Maintain your logged-in session.
- Security Tokens: Prevent unauthorized access and malicious requests.
- Preference Storage: Remember essential interface choices.
- Preview Access: While the site is invite-only, remember that you've entered the access password or used an invite link.
- Share-link Attribution: If you arrive through a provider's share link, remember which link you used (see section 2G).
- Invite-link Attribution: If you open a friend's invite link, remember it for up to 7 days, until you confirm your email (see section 2G).
Visitor statistics: we use Umami to count page visits, waitlist sign-ups and submitted reviews, so we can see what's working. It is cookieless: it sets no cookies and stores nothing on your device to identify you. We never send it your email, name, account, the businesses you review or your ratings, and every page address is cleaned of codes and private links before it is sent. It respects your browser's Do Not Track setting.
We don't use advertising or tracking cookies.
8. International Data Transfers
Some service providers process data outside the UK (including the US). Where international transfers occur, we ensure appropriate safeguards are in place, such as UK adequacy regulations or International Data Transfer Agreements (IDTA).
9. Security
We employ robust technical and organisational security measures including:
- Encrypted connections via HTTPS/TLS
- Database access controls & Row-Level Security (RLS)
- Secure authentication mechanisms
- Restricted access and private storage for sensitive verification documents
10. Age Limitations & Automated Decisions
Age Limitations: TBHreviews is not intended for individuals under 16, and we do not knowingly collect personal data from children under 16.
Automated Decisions: We do not make decisions based solely on automated processing. Key moderation, verification, or account suspension decisions involve human oversight.
11. Changes & Contact Info
We may update this Privacy Policy as TBHreviews grows. Any changes will be published here with an updated "Last Updated" date.
For questions or requests, contact us at support@tbhreviews.co.uk
Questions? Contact us at support@tbhreviews.co.uk