Privacy Policy

This policy explains what personal data ViroLinks (“we”) collects, why, and your rights under UK data protection law. We are the controller of account and business-owner data; for feedback that a visitor leaves on a business’s page, the business is the controller and we act on its behalf.

1. What we collect

• Account data: your name, sign-in email (or Google account identity), a contact email, and a private contact phone number.
• Business data: the business name, address, public phone, website, images, links and Google listing details you choose to publish.
• Visitor data on your page: page views, NFC taps, link clicks, star ratings and any private feedback message a visitor writes. We do not collect visitors’ names or contact details unless they type them into feedback.
• Billing data: subscription status and amounts. Card details are handled by Stripe and are not stored by us.
• Records of acceptance: when you accepted our Terms and this policy, and which versions.

2. Why we use it

• To provide and secure the Service and your business page (contract).
• To show you analytics and to support you (contract / legitimate interests).
• To take payment and keep billing records (contract / legal obligation).
• To prevent abuse and keep evidence of your agreement to our Terms (legitimate interests).

3. Who we share it with

Service providers that run the platform: hosting and network (Cloudflare), database and sign-in (Supabase), payments (Stripe), and Google (sign-in with Google, business search, and the review destination visitors are sent to). We do not sell personal data.

4. Your private phone number

The contact phone you give us is private. It is never shown on your public page and is visible only to you and ViroLinks staff who administer the platform. It is separate from the public business phone.

5. How long we keep it

While your account is active and for a limited period afterwards for legal, billing and security reasons. Acceptance records are kept as an audit history.

6. Your rights

You can ask to access, correct, delete or export your personal data, object to or restrict processing, and complain to the Information Commissioner’s Office. Contact us through the support contact in your account.

7. Security and international transfers

We use access controls, encryption in transit and role-based permissions. Some providers process data outside the UK under appropriate safeguards.

8. Changes

We will update this policy and its version date when it changes materially.