Privacy notice
Draft privacy notice for a UK controller. TrustMetrics Ltd (company number 12596565, registered office 20-22 Wenlock Road, London, England, N1 7GU) is the controller for account data.
Contact: support@trustmetrics.io.
For support, email support@trustmetrics.io or use the support form.
What we process
- Account email and sign-in events.
- Organization, location, and billing details, including Stripe customer and subscription ids, and the billing name, address, and any VAT number entered at Checkout so the correct tax is charged.
- Google Business Profile reviews, locations, and reply text that you connect.
- Customer contact details and consent records that you upload or enter for review requests.
- Support messages you send us.
Why
We process account and billing data to provide the contract, and keep billing and tax records to meet our legal obligations. Google and customer contact data are processed on your instructions so you can run review operations. See the DPA when you are the controller of that customer data and we are the processor.
Sub-processors
- Supabase — database and authentication
- Vercel — application hosting
- Stripe — payments
- Resend — transactional email
- Twilio — SMS, using credentials you supply
- Vercel AI Gateway and Anthropic — draft replies when you use that feature
- Google — Business Profile data you connect
Retention and rights
We keep data for these periods.
| Data | Retention |
|---|---|
| Account data | While the account is active |
| Billing and tax records | 6 years |
| Support messages | 2 years |
| Google review content | Up to 30 days after the last sync |
| Customer contacts and campaign data | Until you delete them, or 30 days after the subscription ends |
| AI usage ledger | Cost metadata only, not review text |
You can ask for access, correction, deletion, or restriction where the UK GDPR gives you that right. Customer data you uploaded is handled under the DPA.
International transfers
Some of our providers store data in the United States: Supabase, Vercel, Stripe, Anthropic (via Vercel AI Gateway), Google, Resend, and Twilio. For transfers out of the UK we rely on the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses with the UK Addendum, and on UK adequacy regulations where they apply (including the UK-US Data Bridge).
Data protection officer
TrustMetrics has not appointed a data protection officer. One is not required for the processing we do. Privacy questions go to support@trustmetrics.io. You have the right to complain to the Information Commissioner’s Office (ICO).