privacy policy

To make this policy easier to read, here are some terms we use:

• Brag – a customer review submitted via BragBox (video, audio, text, or image).
• Business User – the company using BragBox to collect and manage reviews.
• Customer / Review Submitter – the individual who submits a review.
• Purpose of Collection – Brags are collected so businesses can showcase authentic feedback and improve their services.

BragBox is a trading name of DatrBox Ltd, registered in England under company number 16562581.

Registered Office: 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.

We take your privacy seriously and are registered with the Information Commissioner's Office (ICO) under registration number ZB938203.

This Privacy Policy explains how we collect, use, disclose, and protect personal data when:

• (a) Businesses use BragBox to receive and manage reviews.
• (b) Customers submit a review via BragBox.
• (c) A prospective signup, referrer, or visitor interacts with BragBox — for example, starting registration, joining our waitlist, referring someone, or following a link from a customer's brag video — before or without becoming a full business user.

We collect personal data directly from you or, in some cases, from the business that invited you to submit a review.

We use cookies and similar technologies to operate the service (essential cookies), understand usage (analytics cookies), and recognise when you've arrived via a referral link or a customer's brag video (attribution cookies — for example, a single cookie that remembers which brag video referred you, kept for up to 365 days, so we can apply the right trial length or credit if you sign up). You can manage cookies in your browser settings, and where required by law we ask for your consent before setting non-essential cookies.

We use artificial intelligence tools, including OpenAI services, to:

• Transcribe review content (e.g. convert speech to text).
• Analyse and summarise reviews.
• Provide sentiment tagging to support reporting.

When reviews or user information are sent to OpenAI, they may also be used by OpenAI to train and improve its models.

All AI processing is carried out with safeguards. AI screens every incoming brag, and in most cases a brag becomes visible automatically once screening completes, without a person reviewing it individually. Where AI flags a brag as potentially harmful or inappropriate, it is held back and a person reviews it before any decision is made, and we let you know the outcome. If you believe an automated decision has significantly affected you and want it looked at by a person, contact us at privacy@bragbox.co.uk.

Separately, your business's public brag wall is a normal public web page, and — like any public page — it can be read and indexed by AI-powered search and answer services (for example, tools built on ChatGPT, Perplexity, or similar), not just traditional search engines like Google. This is distinct from our own use of OpenAI described above: it's simply how publicly published web pages work, and applies to anything published there, the same way it would on any other public website.

• Contract: To provide and administer the platform, host and display reviews, and support your account.
• Legitimate Interests: To maintain and improve the service, prevent misuse, and protect security (balanced against your rights).
• Consent: For review collection and display where required, for non-essential cookies, and for certain marketing communications.
• Legal Obligation: To comply with applicable laws and enforce our terms.
• Marketing: Where you consent to receive marketing from us, we will use your contact details to send updates and offers. You can opt out at any time using the unsubscribe link in our emails or by contacting us.
• Signup Assistance: If you tell us it's okay when starting to register, we may follow up by email to help you finish setting up your account or to check in after your trial. This is separate from general marketing — you can withdraw it at any time (see Section 8), and doing so won't affect any other communication preference you've set.
• Referrals & Discovery Rewards: To track referral invitations and video-discovery links, apply any resulting trial extension or account credit correctly, and prevent abuse of these programmes.
• Content Moderation & Payment Disputes: To review reports about brag content, enforce our content and acceptable use policies (whether or not something has been reported to us), and to respond appropriately — including suspending an account — if a payment is disputed or charged back.

To provide our service, we will send service communications (for example confirmations, status updates, or review links) via email and SMS. These may be automated.

If you wish to receive marketing and business communications from us, you can give your permission when:

• Signing up as a business user (including, separately, if you ask us to help you finish signing up or check in after your trial).
• Completing a review.
• Joining our guestlist for paused sign-ups.
• Subscribing to our mailing list.

You can withdraw permission to receive marketing and business communications at any time by emailing hello@bragbox.co.uk or privacy@bragbox.co.uk. We will process your request within 5 working days.

If you use live chat on our website or dashboard — whether as a business user, a customer, or simply a visitor — we keep a written record of that conversation (including any images or GIFs shared within it) so our team can respond, pick up where a previous conversation left off, and improve our support over time. Chat records are stored and protected under the same safeguards described elsewhere in this policy (see Sections 11 and 12) and are not used for anything beyond providing and improving support.

From time to time, new signups may be automatically and randomly selected to receive a promotional reward (such as a discount on your subscription or a small physical gift) as part of a limited campaign. Whether you receive a reward, and which one, is determined automatically at the point of signup — not everyone is selected, and not receiving one is not an error. If you're selected for a physical reward, we'll ask for a delivery address, which is used only to fulfil that reward and is handled under the same safeguards as other personal data in this policy (see Sections 11 and 12).

Referral programme: If you're an existing paying customer, you can refer someone to BragBox. We use the name and email address you give us to send them an invitation, and to track whether they sign up and later subscribe. If they do, they receive a discount on their first month and you receive an account credit — full current terms are shown on your referrals page in the dashboard. Referral invitations expire after a set period and are limited per month; we may withhold or reverse credits if we reasonably suspect abuse.

Video discovery credit: Videos we help you produce may carry a link or QR code inviting a viewer to find out more about BragBox. If someone follows that link, we set a cookie to remember which video referred them (see Section 5). If they later sign up, their trial may be extended; if they go on to subscribe, the business whose video they discovered us through receives an account credit. We don't collect any personal information about that viewer unless and until they choose to sign up themselves.

Promotional and discount codes: We may also issue promotional codes — either automatically as above, or as a code you enter yourself at signup or in your billing settings, whether personal to you or shared more widely. Redeeming a code applies whatever discount or benefit it carries to your account, subject to any expiry, eligibility, or one-per-account conditions attached to that specific code.

Occasionally we run a promotion that gives new signups full free access to BragBox with no trial or billing at all. Where this is active, it applies automatically at signup; we may start, change, or end this at any time.

Campaigns, codes, and programmes described in this section are limited in scope and may be changed, paused, or withdrawn at any time.

We share data with service providers (for example, hosting, email, analytics, payments) strictly as needed to provide the service. We do not sell your personal data to anyone, and we do not share it with third parties for their own independent purposes beyond the service providers described below.

• Primary Storage: Data is hosted in the United Kingdom.
• International Systems: Some processing and storage occurs outside of the UK (e.g. in the USA) using secure cloud partners. We apply enterprise-grade security measures when transferring data and have verified the security and data handling standards of our partners. Where required, we use the UK Addendum to the EU Standard Contractual Clauses to ensure legal protections.

Plain explanation: this means we sometimes use trusted, secure systems in other countries to make sure the service is fast and reliable.

• Business User Data: Retained for the duration of the subscription and deleted within 90 days of account closure unless we must keep it longer by law.
• Reviews: Retained until withdrawn by the customer or deleted by the business controller.
• Logs / Analytics: Retained for a limited period necessary for security and performance.

Retention periods are determined based on the minimum time necessary to fulfil the purposes set out in this policy, legal requirements, and the potential need to resolve disputes or enforce agreements.

• Compliance: BragBox complies with UK GDPR and the Data Protection Act 2018.
• Location: Your data is stored and processed on reputable cloud infrastructure providers, with our database and other systems hosted in UK-based data centres. Some secure processing takes place outside the UK. Contact us if you'd like more detail on the specific systems that support BragBox and hold your data.
• Security: Encryption in transit and at rest; access restricted to authorised personnel; enterprise-grade monitoring and safeguards.
• Partner Standards: We verify the security and data controls of all third-party providers.
• Incident Response: We assess, mitigate, and notify where required by law.

Under UK GDPR, you may have the following rights:

• Right to be Informed – about how we process your data.
• Right of Access – to obtain a copy of your personal data.
• Right to Rectification – to correct inaccurate data.
• Right to Erasure – to request deletion of your data.
• Right to Restrict Processing – to limit how your data is used.
• Right to Data Portability – to receive your data in a usable format.
• Right to Object – to processing based on legitimate interests or for marketing.
• Rights Related to Automated Decision-Making and Profiling – to request human review.

Where processing is based on consent, you can withdraw consent at any time.

You can lodge a complaint with the ICO at ico.org.uk, or with your local supervisory authority if outside the UK.

Customers can withdraw their review at any time by:

• Clicking the withdraw link provided in the SMS or thank-you email after submission.
• Contacting us at privacy@bragbox.co.uk.

Important note: The business (data controller) may already have downloaded or shared your review. While withdrawal removes it from active display and the BragBox platform, it cannot undo distribution that has already happened online. If you wish to remove content that has been shared elsewhere, you may need to contact search engines (like Google) or hosting providers directly.

BragBox is not directed to children under 16. Do not submit reviews from minors without appropriate parental/guardian consent and compliance with applicable law.

We may update this policy from time to time. Material changes will be notified via the service or by email.

You can contact our Data Protection Officer by email at privacy@bragbox.co.uk for any privacy-related queries.

Postal: 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ