Privacy Policy
This page explains what personal data we process when you use ScoreReviews as a reviewer or as a business customer, the lawful bases we rely on, how long we keep it, and how to exercise your rights under UK GDPR.
What we collect
Account data (name, email, role), review content you submit, invitation metadata (order ref, hashed identifiers), device/log data, and billing data for paid plans.
Why we process it
To operate the review platform, verify that reviews come from real interactions, prevent fraud and abuse, deliver invitations you've requested, and comply with legal obligations.
Lawful basis
Contract (delivering the service you signed up for), legitimate interests (fraud prevention, platform integrity), legal obligation (tax, dispute records), and consent where required (marketing).
Retention
Reviews are retained for as long as the business profile is active. Invitation metadata is kept for 24 months. Billing records are kept for 7 years to meet UK accounting law.
Sharing
We use vetted sub-processors for hosting, email delivery, payments and analytics. We do not sell personal data. A full sub-processor list is available on request.
Your rights
Access, rectification, erasure, restriction, portability and objection. To exercise any right, email privacy@scorereview.uk. We respond within 30 days.
What you get
- UK-based data controller
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Role-based access with least-privilege internal controls
- Annual independent security review
- Sub-processor changes notified 30 days in advance
- DPO contact published on this page