Privacy notice

Two of these are unusual enough to state before anything else.

• No guess at anyone’s race or ethnicity. Nothing in this system infers it from a name, a photograph, an address or a business name, and no such guess is recorded anywhere. Eligibility comes from what an owner says about their own business plus documents a person reads — see the eligibility standard.
• No document contents, and no identity numbers. Identity documents, ownership records and investigator reports live in BOBBY’s restricted Microsoft OneDrive and SharePoint storage. BOBBY’s own database holds a pointer to the file and who checked it, never the file, its text, a copy, a cached preview or a number from inside it.
• No card details. Payments go through Stripe. BOBBY never sees or stores a card number.
• No passwords. Signing in uses a one-time link or a Microsoft account; there is no BOBBY password to store or lose.

• Your account: email address, your name if you give one, your role, and when the account was created.
• Listings you manage: which businesses your account is attached to.
• Claims: which listing you claimed, which method you used, and where a verification code was sent — the business domain address or phone number. Codes themselves are stored hashed and expire.
• Vetting cases: that consent was given and how, which checklist items arrived and who checked them, who the investigator was, and the decision. References to documents, never documents.
• Reviews and replies: your rating and text, attached to your account, and an owner’s public reply.
• Photographs uploaded by an owner, and who uploaded them.
• Subscriptions: your Stripe customer and subscription identifiers, the plan, its status and renewal date.
• An audit trail: who did what and when, with the IP address the action came from. Entries record the change, with document references and identity-like fields withheld before they can ever be displayed.

Most of what is in the directory is about businesses, not people: names, addresses, opening hours, telephone numbers. For a sole trader working from home, a business address can be a home address. If that is your situation, ask and BOBBY will remove or generalise it — see corrections and removals.

BOBBY runs on services that each see one slice:

• Supabase — hosts the database and handles sign-in.
• Microsoft (OneDrive / SharePoint) — holds claim and vetting documents.
• Stripe — takes payments and holds card details; BOBBY never sees them.
• Resend — sends verification codes and notifications.
• Vercel Blob — stores listing photographs.
• The hosting provider that runs the application and keeps its server logs.

BOBBY does not sell personal information and does not share it for advertising.

BOBBY uses no third-party analytics and no trackers. There is no advertising pixel, no session recorder and no cross-site tracking. Nothing about your visit is sent to another company.

BOBBY does count a few things about itself, and it is worth being exact about what. For each listing, on each day, it keeps running totals: how many times the page was opened, how many times the listing appeared in a set of results, and how many times someone followed the website link or tapped the phone number. A business owner sees the totals for their own listing; BOBBY sees them for the directory.

Those totals are all that is kept. There is no record of who opened a listing, or when within the day — not your IP address, not an account, not a session, not a browser fingerprint, not a referrer. The table has no column any of that could go in, so it is prevented by the design rather than by a promise about how the data is queried. Requests that look like search-engine crawlers are left out.

There are two cookies, both first-party and both doing one small job:

• Signing you in. You only get this one if you sign in.
• Counting how many listings you have read this month, so BOBBY knows when to ask you to chip in — and when to stop asking, if you say no. It holds a list of listing names and the current month, nothing else: no identifier, no profile, nothing sent anywhere. It never affects what you can read. Clear it and the count starts again.

Every page carries a request identifier in its response, so a problem you report can be matched to the log line for it. It identifies the request, not you.

• Your account and the listings you manage: until you ask for them to be deleted.
• Verification codes: minutes. They expire and are consumed on use.
• Documents attached to a claim: destroyed 10 business days after the claim is decided. A claim document exists to show that a person controls a business; once that is decided it has done its only job. Documents in a vetting case are separate — they are the evidence a trust tier rests on, and are kept with the case.
• The audit trail: kept indefinitely, and it cannot be edited or deleted — the database refuses both. This is deliberate: a record of who changed a business’s trust tier is worthless if it can be quietly rewritten.

Ask at [contact email] — not published yet for a copy of what BOBBY holds about you, a correction, or deletion of your account.

One honest limit: deleting your account removes your profile, and your reviews and claims go with it, but the audit trail keeps the record that actions were taken and by which account identifier. That record is what makes it possible to answer “who changed this listing, and when” years later, and it is not erasable by design. Everything that identifies you by name or address goes.

The operating entity is still to be published here.

Material changes to this notice will be announced on this page, with the date they take effect.