Privacy policy

Promotello is operated by Promotello Ltd, a company registered in England and Wales (company number 17546946), whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom (“we”, “us”). We are the controller of the personal information described in this policy.

For anything about your personal information, email hello@promotello.com or use our contact page.

Your account. Your email address, password (stored only as a secure hash), name and, if you add it, your town or city. If you sign in with Google, we don't get a password; see Signing in with Google.

Vouchers. The offers you claim, your voucher codes, when you claimed them and when a business marked them as used.

Loyalty cards. The cards you join, each stamp and reward, and when they happened.

Businesses you follow. Which businesses you follow, when you started, and whether you want their emails. We also record which new-offer emails we've sent you, so you never get the same one twice.

Review links. When you click through to leave a business a Google review, we record the click so we don't ask you again. What you write on Google is covered by Google's privacy policy, not this one.

Your email preferences, including any unsubscribe requests.

Business accounts. If you run a business on Promotello: the business's details, locations, opening hours, offers and team members, and your role in the team. Card payments are taken by Stripe; we receive your subscription status and billing contact details but never your full card number. In your first weeks we send a few emails to help you finish setting up, and a reminder before a free trial ends; you can turn the setup tips off in your notification settings.

Business previews. We sometimes set up a private preview of a local business before it joins, using details the business publishes itself (its name, address and website) and, if we know it, the owner's first name. Previews aren't shown to customers. If the business doesn't claim it, we delete it, and the link stops working after 90 days. Ask us and we'll delete it straight away.

Business waitlist. If your business is somewhere we haven't launched yet and you join our waitlist: your name, email address, business name and town. We only use it to tell you when we launch near you.

Messages to us through the contact form, including your name, email address and what you tell us.

Usage counts. We count views of business and offer pages and scans of QR posters so businesses can see how they're doing. These counts aren't linked to you: for QR scans we keep only the type of device (mobile, tablet or desktop), not your IP address.

Your town or city. To show offers near you, our hosting provider (Vercel) works out your approximate town from your IP address when you visit. We use it to pick the nearest city and don't store it. If you choose “Use my location”, your browser shares your position with the page, which uses it on your device to find the nearest city; it isn't sent to us. If you ask us to tell you when Promotello comes to your town, we keep your email address and town for that, and only that.

Website analytics. Only if you accept analytics cookies: Google Analytics collects information about your visit, such as the pages you view, your device and browser, and your approximate location.

You can create a Promotello account, or sign in to one, with your Google account. This is optional: you can always use an email address and password instead.

What we receive. When you choose “Continue with Google”, Google asks your permission and then shares only your basic profile: your name, your email address (and whether Google has verified it), your profile photo and your Google account ID. We ask only for the standard openid, email and profile permissions. We can't see your Google password, contacts, Gmail, calendar, files or anything else in your Google account.

How we use it. Only to create and sign you in to your Promotello account, to recognise you when you come back, to show your name and photo in your account, and to send the service emails described below. We don't use Google user data for advertising, we don't sell it, and we don't use it to build profiles of you or to train AI models.

Who sees it. It's stored by our sign-in and database provider, Supabase, and isn't shared with anyone else except as this policy describes (for example, a business you visit sees your first name on your voucher). People at Promotello only look at it to provide support, for security, or where the law requires.

How long we keep it, and deleting it. We keep it while you have an account. Delete your account in Account → Privacy & data and we delete it as described under “How long we keep information”. You can also remove Promotello's access at any time in your Google Account's third-party connections; you can then still sign in with an email and password if you set one.

Promotello's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

UK data protection law requires a legal basis for each use:

• To provide Promotello (contract): your account, claiming and using vouchers, loyalty cards, following businesses, business dashboards, team invitations and subscriptions.
• Service emails (contract): voucher confirmations, sign-in and password emails, team invitations and important account notices. You can't turn these off while you have an account.
• New-offer emails (consent): when you follow a business, you ask us to email you when it posts a new offer. Other optional emails, such as deals, product news and feedback requests, are off unless you turn them on. You can withdraw consent at any time; see below.
• Review prompts and business statistics (legitimate interests): asking for a review after a recent visit, and showing businesses totals such as views, claims, stamps and follower numbers, which helps them decide whether Promotello works for them.
• Showing your nearest city (legitimate interests): using your approximate town, without storing it, so you see offers near you first. Launch updates for your town are sent only if you ask for them (consent).
• Website analytics (consent): only if you accept analytics cookies. You can change your choice in our cookie settings.
• Keeping Promotello safe (legitimate interests): approving businesses and offers, preventing fraud such as self-stamping, and keeping audit logs of admin actions.
• Legal obligations: keeping billing and tax records.

Every marketing email has an unsubscribe link. You can also:

• use your email app's own unsubscribe button, which works in one click;
• turn off emails from one business, or from all businesses, in your notification settings;
• unfollow a business.

Unsubscribing takes effect straight away and doesn't affect service emails.

Businesses you use. When you use a voucher or loyalty card, that business's staff see your first name, the voucher or card, and its history, so they can serve you. Businesses see statistics about their followers, such as how many there are, but not who they are or their email addresses. Businesses don't receive customers' email addresses from us.

Your business team. If you're a member of a business's team, its owners and admins can see your email address and role.

Service providers who process information for us under contract:

• Supabase: database, sign-in (including Google sign-in) and file storage
• Vercel: website hosting
• Resend: sending emails
• Sentry: error reports when something breaks, such as the page and browser involved (not your name, email or IP address)
• Stripe: subscription payments for businesses
• Google: Google Analytics if you accept analytics cookies, and maps or review links you choose to open

We may also share information if the law requires it, or to a buyer if Promotello is sold, in which case this policy continues to apply. We never sell personal information.

• Account, voucher, loyalty and follow information: while your account is open. When you delete your account, we delete it or make it anonymous within 30 days.
• Records of sent emails and review clicks: deleted with your account.
• Billing and tax records: 6 years, as UK law requires.
• Contact-form messages: 2 years.
• Page view and QR scan counts aren't personal information, so we may keep them.
• Google Analytics data: 2 months, after which Google deletes it.

Some of our providers are based in, or use staff in, the United States. Where your information leaves the UK, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the UK International Data Transfer Addendum to protect it. Our database, sign-in and file storage (Supabase) are hosted in the European Union, which the UK recognises as protecting personal information adequately.

Under UK data protection law you can ask us to:

• give you a copy of your personal information;
• correct information that is wrong;
• delete your information;
• restrict or object to how we use it;
• send information you gave us to you or another service.

You can delete your account yourself at any time in Account → Privacy & data.

Make a request by emailing hello@promotello.com from your account email, or through our contact page. We'll reply within one month, and may ask you to confirm your identity first.

If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

We use essential cookies to keep you signed in, and Google Analytics cookies only if you accept them. We don't use advertising cookies. See our cookie policy.

We'll update the date at the top of this page when the policy changes. If a change affects how we use your information, we'll tell you by email or in the app before it takes effect.