Privacy notice

Two of these are unusual enough to state before anything else.

• No guess at anyone’s race or ethnicity. Nothing in this system infers it from a name, a photograph, an address or a business name, and no such guess is recorded anywhere. Eligibility comes from what an owner says about their own business plus documents a person reads — see the eligibility standard.
• No document contents, and no identity numbers. Identity documents, ownership records and investigator reports live in BOBBY’s restricted Microsoft OneDrive and SharePoint storage. BOBBY’s own database holds a pointer to the file and who checked it, never the file, its text, a copy, a cached preview or a number from inside it.
• No card details. Payments go through Stripe. BOBBY never sees or stores a card number.
• No passwords. Signing in uses a one-time link or a Microsoft account; there is no BOBBY password to store or lose.

• Your account: email address, your name if you give one, your role, and when the account was created.
• Listings you manage: which businesses your account is attached to.
• Claims: which listing you claimed, which method you used, and where a verification code was sent — the business domain address or phone number. Codes themselves are stored hashed and expire.
• Vetting cases: that consent was given and how, which checklist items arrived and who checked them, who the investigator was, and the decision. References to documents, never documents.
• Reviews and replies: your rating and text, attached to your account, and an owner’s public reply.
• Photographs uploaded by an owner, and who uploaded them.
• Subscriptions: your Stripe customer and subscription identifiers, the plan, its status and renewal date.
• An audit trail: who did what and when, with the IP address the action came from. Entries record the change, with document references and identity-like fields withheld before they can ever be displayed.

Most of what is in the directory is about businesses, not people: names, addresses, opening hours, telephone numbers. For a sole trader working from home, a business address can be a home address. If that is your situation, ask and BOBBY will remove or generalise it — see corrections and removals.

BOBBY runs on services that each see one slice:

• Supabase — hosts the database and handles sign-in.
• Microsoft (OneDrive / SharePoint) — holds claim and vetting documents.
• Stripe — takes payments and holds card details; BOBBY never sees them.
• Resend — sends verification codes and notifications.
• Vercel Blob — stores listing photographs.
• The hosting provider that runs the application and keeps its server logs.

BOBBY does not sell personal information and does not share it for advertising.

BOBBY runs no analytics and no third-party trackers. There is no advertising pixel, no session recorder and no cross-site tracking. The only cookie is the one that keeps you signed in, and you only get it when you sign in.

Every page carries a request identifier in its response, so a problem you report can be matched to the log line for it. It identifies the request, not you.

• Your account and the listings you manage: until you ask for them to be deleted.
• Verification codes: minutes. They expire and are consumed on use.
• Identity documents attached to a claim: deleted a set period after the claim is decided, unless a vetting case is still open. [retention period to be confirmed] — the mechanism is built and the number is the one thing still to be set.
• The audit trail: kept indefinitely, and it cannot be edited or deleted — the database refuses both. This is deliberate: a record of who changed a business’s trust tier is worthless if it can be quietly rewritten.

Ask at [contact email] — not published yet for a copy of what BOBBY holds about you, a correction, or deletion of your account.

One honest limit: deleting your account removes your profile, and your reviews and claims go with it, but the audit trail keeps the record that actions were taken and by which account identifier. That record is what makes it possible to answer “who changed this listing, and when” years later, and it is not erasable by design. Everything that identifies you by name or address goes.

The operating entity and its postal address are still to be published here.

Material changes to this notice will be announced on this page, with the date they take effect.