Last updated: 15 September 2026.
1. Who is responsible for your data?
Recard is a trading name of HHAS HOLDINGS LTD, company number 17385624, registered office Suite Ra01, 195–197 Wood Street, London, England, E17 3NU. For Recard’s own website, account, billing, support, security and service-administration data, HHAS HOLDINGS LTD is the data controller. Contact us at privacy@recard.co.uk.
2. This policy and the Recard service
This policy explains Recard’s own processing and the way the platform handles private feedback. Where a business uses Recard Plus to collect private feedback from its customers, that business will normally decide why and how the feedback is collected and will normally be the controller of that feedback. Recard normally hosts and processes it for that business. Questions about how a particular business uses private feedback should first be directed to that business.
3. Information we collect
We may collect business and account information, including names, work email addresses, phone numbers, business name, logo, review URL, subscription and billing records, support messages, login and security information, and correspondence. When a visitor uses a client’s feedback page, the page may collect the rating selected, private feedback message, any contact details the visitor chooses to provide, the date and time, the relevant business page, and limited operational event information such as a page open or Google-review click.
4. Why we use information
We use account and business data to respond to enquiries, set up cards and pages, deliver the service, authenticate users, provide support, manage subscriptions, prevent misuse, maintain security, improve reliability, meet legal obligations and handle disputes. For private feedback, we process information to provide the feedback service to the relevant client and to keep the platform secure. Our legal bases may include performance of a contract, legitimate interests in running and protecting Recard, compliance with legal obligations, and consent where required.
5. Who can see private feedback?
A Recard Plus client can view private feedback submitted through that client’s own Recard page. The dashboard does not permit a client to view another business’s feedback, and clients cannot currently export the feedback. Recard does not routinely inspect private feedback or use it for marketing. Access by authorised Recard personnel is restricted and may occur only where needed for security, technical support requested by the client, troubleshooting, legal compliance, fraud prevention or enforcement of our terms.
6. Service providers and sharing
We use suppliers that help us run Recard, including Cloudflare for hosting and security, Supabase for application database and authentication services, Fastmail and Resend for business email, and Stripe for payment processing when payments are activated. We only share information where needed to provide the service, comply with law, protect rights and security, or with your instruction. We do not sell personal data. Source-code management is maintained through GitHub; customer data should not be intentionally stored in source code.
7. International transfers
Some suppliers may process information outside the UK. Where a transfer takes place, Recard will use appropriate safeguards required by UK data-protection law, such as an adequacy decision or approved contractual safeguards, where applicable.
8. Retention and deletion
We keep account and service information only for as long as needed for the purposes above. Active client feedback is kept while the client’s service remains active. After a Recard Plus subscription ends, relevant account configuration and service data are normally held for up to 30 days to allow reactivation or a deletion request. We may keep limited data longer where required for tax, accounting, fraud prevention, legal claims or compliance. A client may request deletion by contacting privacy@recard.co.uk.
9. Security
We use reasonable organisational and technical measures to protect data, including access controls, role separation, encryption in transit where supported by our providers, and restricted access to production systems. No online service can guarantee absolute security. If you believe account access has been compromised, contact us promptly.
10. Your rights
Depending on the circumstances, UK data-protection law gives people rights to request access, correction, deletion, restriction, objection, portability or withdrawal of consent. To exercise a right relating to Recard’s own processing, email privacy@recard.co.uk. For private feedback, we may need to refer you to the relevant business where it is the controller, while assisting as required.
11. Complaints
Please contact us first so we can try to resolve a concern. You may also complain to the Information Commissioner’s Office at ico.org.uk.
12. Cookies and changes
Our use of browser storage and similar technology is described in the Cookie Policy. We may update this policy when the service, law or providers change. The latest version is published on this page.