How we handle your data

What we collect, and why

What we hold depends on how you interact with us:

• Business directory listings: if your business is listed with us, we hold its contact details (phone, email, address, social media links if provided) — published on your listing page if it's public. A named contact person may also be on file, kept internal, never published.
• Client portal accounts: an email or account number, and a password (stored as a one-way hash, never in plain text), so you can sign in.
• Contact form messages: if you message a business through the directory, or message us directly, we hold your name, email, phone and message so it can be forwarded and answered.
• Agreements and signatures: if you sign a contract with us, we keep the signer's name, email, the IP address and browser used to sign, and an image of the drawn signature — this is how we prove a document was validly signed.
• Invoicing and billing: if you're invoiced by us, or you use our platform to invoice your own customers, we hold the billing contact's name, email and address.
• Sign-in and security logs: every login attempt (successful or not) is logged with the IP address it came from and the network/ISP that address belongs to, so we can spot suspicious activity and help if you're ever locked out.
• Photos you upload: for your directory listing or generated website. Please don't upload photos of identifiable people without their knowledge, since we can't monitor and be responsible for this.

We collect this to provide the service you've asked for — a listing, a website, an invoice, a signed agreement — or because we have a legitimate interest in keeping our platform secure (the sign-in logs above).

Who we share it with

We don't sell or trade your data. It's shared only with the providers we use to run the platform:

• Our email provider, to send messages, invoices and agreement copies.
• Cloudflare, who store uploaded photos and host published websites.
• Stripe, if you pay an invoice or agreement via a payment link — your card details go straight to Stripe's own payment page; we don't see or store them.
• If you use our AI website generator, the business description and any photos you upload are sent to Anthropic (our AI provider) to help draft your site's content.
• Google, for the Maps embed on listing pages, and if you use our Google Ads or Google Business Profile management services, to set up and run your account with Google — see our cookie policy for what the Maps embed involves.

Where your data is stored

Our main application and database — business records, client portal accounts, invoices, agreements and sign-in logs — is hosted on Railway's infrastructure in the United States. Uploaded photos and published website files are stored on Cloudflare, in Europe. Where data leaves the UK, we rely on our providers' own safeguards for international transfers.

How long we keep it

We keep your data for as long as you have an active listing, account or business relationship with us, or as long as the law requires (invoices, for example, for tax purposes). Sign-in sessions expire automatically after 30 days of inactivity. If you'd like something deleted sooner, contact us and we'll action it unless we're required to keep it.

Your rights

Under UK GDPR, you can ask us to: show you what we hold about you, correct it, delete it, restrict how we use it, give you a copy in a portable format, or stop using it for a particular purpose. If anything about how we've handled your data doesn't sit right with you, talk to us first — get in touch via our contact page or simply call us, and we'll put it right. You're also entitled to raise a complaint with the UK's data protection regulator, the Information Commission.

Cookies

Cookies are covered separately on our cookie policy page.

Questions

Get in touch via our contact page.