PopagainPrivacy notice
Last updated 13 October 2026. Version 0.1 (draft).
1. Who we are
Popagain is a trading name of [Company name], company number [number], registered at [address] ("we", "us"). We are registered with the Information Commissioner's Office under number [ICO number]. You can contact us about anything in this notice at privacy@popagain.uk.
Popagain asks a business's customers for a public review after a visit, reminds them once, and shows the business what came back. We process personal data in two different roles, and this notice covers both.
2. Two roles: controller and processor
| Whose data | Our role | What this means |
|---|---|---|
| Businesses that use Popagain and their staff | Controller | We decide why and how it is processed. Sections 3 to 5 apply. |
| Those businesses' customers (the people who receive review requests) | Processor | The business is the controller. We act only on its instructions under our data processing agreement. Section 6 applies. |
| People who fill in a form on this website | Controller | Section 7 applies. |
3. Data about businesses and their staff (we are the controller)
What we collect
- Business details: business name, the name you sign messages off with, your public review page address, time zone, sending preferences and tone guidance, and the email address alerts go to.
- Staff logins: name, email address and a password, which we store only as a bcrypt hash. We never see the password itself.
- Billing: the plan you chose and identifiers from our payment provider (Stripe). Card details go directly to Stripe and never touch our systems.
- Connections you set up: if you connect a calendar link we store it encrypted and read only finished entries from it; if you set up email forwarding we store a hashed address token and the sender addresses you list; API keys are stored only as hashes.
- Activity: a record of actions taken on the dashboard (logins, settings changes, visits added, drafts approved, keys created) with the staff member who took them, kept for accountability.
- Technical: server logs with request identifiers and the business identifier. Logs never contain names, phone numbers, email addresses or message text.
Why, and on what basis
- To provide the service you signed up for, including sending your review requests, showing your dashboard and billing you: performance of a contract (UK GDPR Article 6(1)(b)).
- To keep the service secure, prevent abuse and keep an audit trail: legitimate interests (Article 6(1)(f)), namely running a reliable and accountable service.
- To meet legal obligations such as tax records: legal obligation (Article 6(1)(c)).
How long
For as long as you have an account, then 90 days to allow for reactivation, after which the account and its data are deleted except what we must keep for tax (seven years for invoices) and the opt-out list described in section 6.
4. Who we share it with
We use the following sub-processors. Each is bound by contract to protect the data and to use it only to provide its service to us.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| [Hosting provider] | Running the application and database | All of the above | United Kingdom [confirm region] |
| Twilio | Sending and receiving text messages | Customer mobile numbers and message text | United States; UK International Data Transfer Addendum in place [confirm] |
| Resend | Sending and receiving email | Email addresses, message text, staff alert emails | United States; Addendum in place [confirm] |
| Anthropic | Personalising message wording, classifying replies, drafting replies for staff approval, summarising themes | Customer first name, reply text, forwarded report text. Never phone numbers or email addresses | United States; Addendum in place; zero data retention where available [confirm] |
| Stripe | Payments and subscriptions | Business billing details | United States and EU; Stripe's own transfer safeguards |
We do not sell personal data and we do not share it with anyone else, unless the law requires it.
5. Your rights as a business user
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to processing, or to receive it in a portable form. Email privacy@popagain.uk and we will respond within one month. You can also complain to the ICO at ico.org.uk, though we would rather you told us first.
6. Data about a business's customers (we are the processor)
When a business uses Popagain, it sends us a note that one of its customers has finished a visit. The business is the controller of that data and is responsible for having a lawful basis to contact its customers. We process it only to do what the business has asked. In practice that means:
- What we hold: a first name, a mobile number or email address, the time the visit finished, and (for businesses outside health settings only) a short label for the type of visit. For health businesses we never store what the visit was for. We hold any reply the customer sends, whether the link was opened, and a one-way hash of the contact detail.
- What we never hold: clinical or treatment details, dates of birth, addresses, or anything beyond the above.
- What we send: at most two messages per visit: one request and one reminder, never during the business's quiet hours, and never again after the customer opens the link or replies STOP.
- Opting out: replying STOP (or unsubscribing from an email) puts a one-way hash of the contact on a suppression list that applies to every business using Popagain, immediately and permanently. That hash cannot be turned back into a phone number or email address, and it is the only thing we keep forever.
- How long: names, contact details, reply text and draft text are removed after 12 months, or after 90 days for health businesses. Forwarded report emails are removed after 30 days. Counts and dates remain so the business can see its own statistics.
- Where the model is used: the first name and any reply text may be sent to Anthropic to personalise wording, classify a reply or draft a response for a member of staff to approve. The model never decides who is contacted or when, and nothing it writes is sent to a customer without a check by our software and, for replies, a person.
If you are a customer of a business that uses Popagain and want to exercise your rights, contact that business; it is the controller. If you contact us instead we will pass your request on and help the business respond.
7. This website
- Free audit and sign-up forms: we keep your name, business name, email and anything you type in the note field for 12 months so we can send what you asked for and follow up. Basis: your request (legitimate interests, or consent where you tick a box). We do not add you to a newsletter unless you ask.
- Demo text: if you ask us to text you an example message we send one text to the number you give, store the number hashed for the day to prevent repeats, and keep nothing else.
- Cookies: the website sets no cookies. The application sets one session cookie when you log in, which is strictly necessary and needs no consent.
- Campaign parameters: if you arrive from an advert we record which campaign it was, nothing more.
8. Security
In brief: the service runs on servers in [the UK]; connections are encrypted in transit; passwords are hashed with bcrypt; API keys, link tokens and opt-out contacts are stored only as hashes; connected calendar links are encrypted at rest; logins are limited against guessing; every business's data is kept separate and this is tested automatically; staff actions are recorded; personal data is removed on the schedule above. Fuller detail is in Annex 2 of the data processing agreement.
9. Changes
We will post changes here with a new date and, for material changes affecting business users, email the alert address on the account.