No legal boilerplate on this page. Plain answers to the questions a business owner actually asks before connecting an account. The formal documents are linked at the bottom.
If a field is not on this list, we do not store it.
| DATA | WHY WE NEED IT | WHERE IT LIVES | KEPT |
|---|
We never store payment card details — those go straight to our payment processor and never touch our servers. We do not store your platform passwords; connections use OAuth tokens you can revoke at any time from the platform itself.
Every company that could technically see your data. We publish changes here 30 days before they take effect.
UK GDPR and EU GDPR give you these rights. Plenty of companies make you write in and wait a month. We built them into the product because a right you have to ask for twice is not much of a right.
We are not SOC 2 or ISO 27001 certified yet. Both are in progress and we will publish the reports here when they land. Any company claiming certification before the audit is finished is telling you something about how it treats the truth. If you need a completed audit before you can sign, tell us and we will give you a real date.
Your public page is only created because you claimed it and connected your own sources. Even then, each platform sets its own rules about republishing what its users wrote. We follow them to the letter rather than hoping nobody checks.
This is why collecting your own Voi’s matters. A Voi you gather belongs to you, appears in full, and cannot be withdrawn by a platform changing its terms. Over time your page should stand mostly on your own Voi’s, with the platforms as corroboration rather than the foundation.
This is the question every business now asks, and most platforms answer it in a footnote. Ours is one line: we do not use your data to train models, and neither do our providers.
We use commercial AI providers under zero-retention agreements. Your text is processed to produce your answer and is not retained by them afterwards. It is never pooled with other businesses’ data, never used to improve a shared model, and never sold.
This page states intent and must be reviewed by a data-protection solicitor before it goes live. The four documents above need drafting, an ICO registration is required for a UK controller, and the sub-processor list must be confirmed against the providers actually contracted.
A real person replies, usually the same day. If you are a larger organisation and need a security questionnaire completed, say so and we will turn it round.