Privacy policy

This policy explains how GoldStarred uses personal data. The UK GDPR and the Data Protection Act 2018 govern it. For privacy questions write to hello@goldstarred.com.

1. Who is responsible

The company named at the foot of this page is the controller of the data described here, with one exception. When a business gives us its customers' names and email addresses to send review invitations, the business is the controller and we are its processor. Our data processing agreement sets this out.

2. What we collect

• Business account holders: name, email address, business and domain details, billing details when paid plans exist, and what you do in the dashboard.
• Reviewers: your name or chosen display name, email address, the review you write, the order reference where a business supplied one, and the time of posting.
• Invited customers: the name, email and order details a business gives us, and whether you opened or answered the invitation.
• Technical data: IP address and device information used for security and to detect fake reviews, and the cookies listed in our cookie policy.
• Analytics data: only if you accept analytics cookies (section 6).
• People who write to us: whatever you tell us.

We do not collect special category data on purpose. Please do not put it in a review.

3. Why we use it, and our lawful basis

Purpose	Lawful basis
Run accounts, send sign-in codes, send invitations and notices	Contract, or steps before a contract
Publish reviews and show them on profiles and in widgets	Legitimate interests: giving the public trustworthy reviews
Detect fake reviews, duplicates and abuse, and keep the service secure	Legitimate interests; and legal duties under consumer law
Handle complaints and takedown requests	Legitimate interests; legal obligation
Keep accounting and tax records	Legal obligation
Remember your cookie choice	Strictly necessary, so no consent needed
Analytics	Consent, which you can withdraw

We balance our interests against yours, and you can object (section 9).

4. Who we share it with

• Publicly: a review, your display name and its label are visible to everyone. A business sees who reviewed it where it invited them.
• Service providers: Supabase (database and sign-in), Vercel (hosting), Resend (email) and, only if you accept analytics cookies, Google (Analytics and Tag Manager) and Ahrefs (Web Analytics). They process data for us under contract.
• Others: advisers, and authorities where the law requires.

We do not sell personal data or use it for advertising.

5. Reviewer email addresses and suppression

To stop unwanted or repeat invitations, and to spot abuse, we keep a suppression record of addresses that must not be contacted. Where we only need to recognise an address, we store a one-way hash that cannot be turned back into it. If you ask us to stop contacting you, we keep that record to honour the request.

6. Analytics

If you accept analytics cookies, we use Google Analytics, loaded through Google Tag Manager, to see how the public site is used: the pages visited, how visitors arrived, approximate location from the IP address, device and browser type, and when. We also use Ahrefs Web Analytics, which counts the same kind of visit data without cookies. We do not send either provider your name or email, and analytics never runs on the dashboard or sign-in pages.

The legal basis is your consent. Google processes it for us under its data processing terms, and may do so outside the UK under the safeguards in section 8. We keep it for the period set in our analytics settings, after which Google deletes it.

To withdraw consent, use "Cookie settings" in the footer: we delete the analytics cookies and the tag stops. Our cookie policy lists every cookie we set.

7. How long we keep it

We keep personal data only as long as we need it for the purposes above, then delete or anonymise it. The detailed schedule will be stated here. In outline:

• accounts: while open, and a short period afterwards;
• published reviews: while published. A deleted review leaves public view immediately; backup copies expire with the backup;
• invitation data: as long as the business needs it;
• security and moderation logs: as long as needed to run and audit moderation;
• accounting records: as long as the law requires;
• suppression records: as long as needed to honour your request.

8. Transfers abroad

Some providers process data outside the UK. Where they do, we rely on UK adequacy regulations or the UK addendum to standard contractual clauses.

9. Your rights

You can ask us to access, correct, delete or restrict your data, stop using it, or give you a portable copy (export). You can object to processing based on legitimate interests. To use any of these, email hello@goldstarred.com. We answer within one month. For export and deletion, an email is enough; we may ask you to prove who you are. Where we hold data as a business's processor, we may pass your request to that business.

10. Complaints

You can complain to us first, or to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk.

11. Changes

When we change this policy we change the date above, and tell account holders if the change matters.

GoldStarred is operated by Harber Glaves Trading Ltd, company number 16605946, registered in England and Wales.

Registered office: Unit A, 82 James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE.

Contact: hello@goldstarred.com