Privacy Notice

Who we are

Track.Reviews is operated by MILES KAY LTD, a company registered in England and Wales, company number 16870338, registered office 128 City Road, London, United Kingdom, EC1V 2NX. MILES KAY LTD is the data controller for personal data described in this notice, except where we act as a processor on behalf of a business customer (see “Customer feedback and end-customer data”).

To contact us about privacy, please use our contact page. We do not publish a direct privacy mailbox; contact requests reach the same team.

Data we collect from business users

• Account and authentication data: email address, one-time verification codes (stored hashed), sign-in events, and any name you provide.
• Organisation and team data: business name, locations, addresses used for delivery of Smart Review Cards, team member roles and invitations.
• Business listing data: the public Google business listing you select or search for, including business name, address, place identifier, rating and review counts obtained through a third-party listing lookup service.
• Product usage data: touchpoints and devices you create, QR and NFC configuration, dashboard activity, support and diagnostic logs.
• Billing and subscription data: plan, tier, trial status, active location counts and hardware entitlements. Where card payments are taken, payment details are collected and processed by our payment provider, not by us.
• Technical data: IP address (stored only as a salted hash for abuse control), browser and device information, and approximate location derived from network data.

Customer feedback and end-customer data

When a customer of one of our business users taps or scans a Track.Reviews touchpoint, we may collect: the rating given, written feedback, an optional name and contact detail (email or phone) they choose to provide, the touchpoint, location and staff member involved, whether the interaction was an NFC tap or a QR scan, timestamp, and a hashed IP address.

We never block, filter or discourage anyone from leaving a public Google review. Every customer is offered the Google option regardless of the rating they give.

For this end-customer data, the business that operates the touchpoint is the controller and we act as processor on their instructions. We use it to provide the service, keep it secure, and produce aggregate analytics and insights.

Analytics and advertising data

With your consent we load the Google tag for Google Ads conversion measurement, which records that a free QR code was created and the campaign identifier you arrived with. Ad personalisation signals are disabled and we do not send names, email addresses or feedback content to Google for advertising. See our cookie notice to change your choice.

Why we use data, and our lawful bases

• Contract: creating and running your account, provisioning QR codes and Smart Review Cards, showing dashboards and reports, handling subscriptions and hardware fulfilment.
• Legitimate interests: keeping the service secure, preventing abuse and cost attacks, improving product quality, aggregate benchmarking, and business communications to existing customers.
• Consent: non-essential analytics and advertising cookies, marketing emails where required, and optional contact details a customer chooses to give so a business can follow up.
• Legal obligation: tax, accounting and responding to lawful requests.

AI features

Some features generate summaries of feedback and draft replies to reviews using third-party AI models accessed through our platform provider. Only the review or feedback text and related context needed for the task is sent. Drafts are never posted anywhere automatically — a person must review and act on them.

Processors and service providers

We use a small number of categories of provider, each under contract and limited to what the service needs:

• Cloud database, authentication and file storage (Supabase infrastructure).
• Application hosting, edge delivery and error monitoring.
• Transactional email delivery (Resend) for verification codes and alerts.
• Google services: public business listing lookup, review links and review data retrieval, and the Google tag for advertising measurement.
• AI model providers for summaries and draft replies.
• Payment processing, where a paid subscription or hardware order is taken.
• Print and logistics partners for Smart Review Card fulfilment.

International transfers

Some providers process data outside the UK and EEA, including in the United States. Where that happens we rely on UK adequacy regulations or the International Data Transfer Agreement / EU Standard Contractual Clauses with the UK Addendum, together with appropriate technical safeguards such as encryption in transit and at rest.

Retention

• Account, organisation and billing records: for the life of the account and then as needed for legal and accounting purposes.
• Verification codes: minutes, then expired and deleted.
• Customer feedback and interaction records: retained for the account so businesses can report on trends; end-customer contact details are removed once they are no longer needed for follow-up.
• Aggregated and anonymised analytics: retained indefinitely, as it no longer identifies anyone.

Security

Data is segregated per organisation with row-level access controls, access is role-based, transport is encrypted, IP addresses are stored only as salted hashes, and privileged operations are logged. No system is perfectly secure, but we design for least privilege and review access regularly.

Your rights

Under UK GDPR you may request access to your personal data, correction, erasure, restriction, portability, and object to processing based on legitimate interests. You may also withdraw consent at any time, including for cookies. To exercise a right, contact us via our contact page. If you are a customer of a business using Track.Reviews, we will usually refer your request to that business as controller and support them in answering it.

You have the right to complain to the Information Commissioner’s Office (ICO), ico.org.uk, though we would appreciate the chance to resolve the matter first.

Children

Track.Reviews is a business tool and is not directed at children. We do not knowingly collect data from children.

Changes to this notice

We may update this notice as the service develops. The date at the top shows the latest version, and material changes will be communicated in-app or by email.