Privacy Policy

1. Who we are

The Service is operated by Mash'al Abdulqadir, trading as Dazenga (“Dazenga”, “we”, “us”, “our”). For most personal data we process, Mash'al Abdulqadir, trading as Dazenga is the data controller.

You can contact us about privacy at privacy@dazenga.com (or support@dazenga.com). Our postal address is 166 Hagley Road, Birmingham, B16 9NZ.

2. The two groups this policy covers

Dazenga is used by two groups, and we handle their data differently:

• Account holders — the businesses, and the people acting for them, who sign up, subscribe and manage feedback. For account-holder data we are the controller.
• Members of the public — customers of those businesses who tap or scan a Dazenga card and choose to leave private feedback, or scan a business’s voucher QR code and claim a voucher. For the content of that feedback, and for the details given to claim a voucher, we act as a processor on behalf of the business it was left for: that business decides what to do with it. We are the controller for the limited technical data we collect to run and protect the Service (section 5).

3. Data we collect from account holders

• Account & identity: your email address, a password (stored only as a salted hash by our authentication provider — we never see it), and an account name.
• Business details you enter: business name, category, address, phone number, website, your review link, and a notification email address.
• Billing: your plan and subscription status, and a record of payments (amount, date, currency, type). Card details are entered directly with our payment provider, Stripe, and are not stored by Dazenga.
• Hardware orders: quantities, delivery name and address, and tracking references for cards you order.
• Partner Programme data (if you join): your name, how you plan to promote Dazenga, and the payout details you give us (a PayPal email, or an account name, sort code and account number), plus a record that you accepted the Partner terms.
• Technical & usage data: IP address, browser and device information, pages visited and actions taken in the app. We use short-lived IP-based records to rate-limit requests and prevent abuse.
• Support correspondence: messages you send us and our replies.

4. Data we collect from members of the public

When someone uses a Dazenga card and chooses “Report an issue / speak to management”:

• Their message — the free text they write.
• Their email address — only if they provide it. Leaving feedback anonymously is offered and supported; if they choose that, no email is collected.
• A source tag (NFC, QR or link) and the date and time.

When someone uses a card at all (either option, or just the landing page):

• We record anonymous, aggregated events (a visit, a redirect to the review site, a feedback submission) for the business’s statistics. These contain no names or contact details.
• We process the visitor’s IP address transiently to rate-limit submissions and filter automated traffic. Where any IP-derived value is kept beyond the moment (for example in our referral-click log) it is stored as a one-way hash, not the address itself.

When someone claims a Comeback Voucher (Growth and Multi plans), by scanning a business’s voucher QR code:

• Their email address, which we use to send the voucher, to check the address is theirs when the business has switched that on (a six-digit code is emailed to it), and to stop the same person claiming more than the business allows.
• Whether they ticked the optional box to hear from the business about its offers. It is unticked by default and separate from claiming. The business sees the email in full only if the box was ticked; otherwise it sees a masked version (for example sam•••••@gmail.com).
• The voucher itself: a random code, the offer, and the dates it was issued, expires, was used or was cancelled.
• An anonymous count of each time the claim page is opened, with no personal details, and the visitor’s IP address handled transiently to rate-limit claims and filter automated traffic, as above.

A voucher is a thank-you for visiting. It is never offered in return for a review, and the claim page does not ask for one.

When someone writes to us through the “Message us” box on our website (or, for customers, “Contact support” in the dashboard), we store the conversation (their messages and our replies), the email address a visitor gives (customers are identified by their account), and the page they were on. For customers we also see the plan and businesses on the account, so we can answer properly. We use this only to answer. A visitor’s chat is remembered in their own browser using a random code; we keep only a scrambled (hashed) copy of that code, so the chat can be found again on that device. We receive an email notice when a message arrives, sent by our email provider.

We do not ask members of the public for anything more than this, and we ask that special category data (such as health, or political or religious views) is not submitted through the feedback form.

5. Why we use personal data, and our legal bases (UK GDPR)

We do not use your data for advertising, we do not sell it, and we do not send marketing emails unless you have separately opted in. Where we rely on legitimate interests we have weighed them against your rights and do not consider our processing overridden. You can object at any time (section 9).

6. Automated decision-making

We use automated checks to flag possible referral fraud (for example, a partner referring themselves) for a person to review. We do not make solely automated decisions that produce legal or similarly significant effects — a person always reviews a flag before any action is taken.

AI-drafted replies and weekly summaries. On plans that include the Google features we use AI, from our provider Anthropic, in two places. First, the dashboard can draft a reply to a Google review or to a private Feedback message. A draft is created only when the business asks for one, by sending the text being replied to (the reviewer’s name and star rating for a Google review, and earlier messages in the conversation for Feedback), and a person at the business always reads, edits and sends any reply. Second, each Monday we write a short weekly summary of each location’s week. For that we send the text of that week’s private Feedback messages (without customers’ email addresses) and Google reviews (the text and star rating, without reviewers’ names), together with numbers we have already calculated. The summary appears in the business’s dashboard, and the email we send about it contains numbers only, with no review or feedback text. Apart from the optional Autopilot described next, nothing is posted or sent to a customer by AI, and we do not use AI to make decisions about individuals.

AI Autopilot (optional, off by default). A business on a plan with the Google features can switch on Autopilot for a Google listing. From then on, each new Google review that arrives is sent to Anthropic, without anyone asking each time, to draft a reply. We send the review’s text, its star rating and the reviewer’s first name. For the star ratings the business has chosen, and after automatic safety checks, the reply is posted to Google in the business’s name some time later, without anyone at the business reading it first. Everything else, and the first three replies, waits for the business to approve it. Because of Google’s rules we do not keep the review: we keep only its Google identifier, its star rating, our drafted or sent reply and a status, and we fetch the review live from Google whenever it is shown. The business can pause Autopilot, dismiss a review, or take back a reply (which deletes it from Google) at any time. The reviewer is not told that AI helped to write the reply, and the business is responsible for the replies sent in its name.

A business can also write its own instructions for how replies should sound: what to mention or avoid, extra wording for happy or unhappy reviews, and one email address or phone number to add to replies to unhappy reviews. These are the business’s own words, not customers’, and they are sent to Anthropic together with the text being replied to whenever a reply is drafted, whether by Autopilot or when the business asks for a draft.

7. Who we share personal data with

We use a small number of service providers (“sub-processors”) who process personal data on our behalf under contract and may only use it to provide services to us.

We may also disclose personal data:

• to professional advisers (lawyers, accountants) under confidentiality;
• if we buy or sell a business or assets, to the prospective buyer or seller;
• where required by law, court order, or to establish, exercise or defend legal claims, or to protect the rights, property or safety of Dazenga, our users or others.

We are not responsible for the privacy practices of Google or any review platform your card links to — your use of those services is governed by their own terms and privacy policies.

8. International transfers

Our primary database is hosted in the UK/EU. Some providers (Vercel, Stripe, Resend, Anthropic) are based in, or transfer data to, the United States or other countries outside the UK. Where they do, the transfer is protected by an appropriate safeguard — an adequacy decision, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum. Ask us using the contact in section 1 for more detail.

9. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data (“right to be forgotten”), subject to legal retention obligations;
• restrict or object to our processing;
• data portability — receive certain data in a structured, machine-readable format;
• withdraw consent at any time where we rely on it (this does not affect earlier processing);
• not be subject to solely automated decisions with legal or significant effect (section 6).

Account holders can export their data and permanently delete their account from the Account page in the app. To exercise any other right, email privacy@dazenga.com. We will respond within one month.

Members of the public: private feedback you leave is controlled by the business it was left for. To have it corrected or deleted, contact that business, or contact us and we will pass your request on and act on our own records.

You also have the right to complain to the ICO (ico.org.uk, 0303 123 1113), though we would ask you to contact us first so we can try to help.

10. US account holders — state privacy rights

If you hold a Dazenga account as a US business, certain US state privacy laws (such as California’s CCPA/CPRA, and similar laws in other states) may give you additional rights over data we hold about you as an individual connected to that account — broadly similar to the rights in section 9: the right to know what personal data we hold, to request its deletion, and to correct it. We do not sell personal data or share it for cross-context behavioural advertising, so there is no “opt out of sale” action needed. To exercise a state privacy right, email privacy@dazenga.com; we will not discriminate against you for making a request.

11. How long we keep personal data

• Account data: for as long as your account is open, then deleted when you delete your account, except where we must keep certain records longer.
• Financial records (payments, invoices): retained for at least 6 years to meet UK tax law, including within Stripe.
• Private feedback: kept for the business it was left for while their account is open; deleted with the business or the account, or earlier on a valid erasure request.
• Comeback Vouchers: the customer’s email is cleared 90 days after a voucher ends (used, cancelled or expired), unless they ticked the box to hear from the business, in which case it is kept for as long as the business’s account is open or until they ask for it to be removed. Until a campaign is deleted we keep a one-way scrambled form of the address, which cannot be turned back into the email, so a repeat claim can still be spotted. One-time email codes are deleted within a day of expiring. Everything is deleted with the business or the account, or earlier on a valid erasure request.
• Weekly summaries: kept for about six months, then deleted. A summary made while a Google listing was connected is deleted straight away when the listing is disconnected, because part of it is based on Google review content.
• Support chats: kept while they are open and for 12 months after they are resolved (visitor chats nobody has written in for 12 months are also deleted), or until you delete your account, and deleted earlier on request. Chats from customers are included in “Export my data”.
• Security and rate-limiting records: short-lived — automatically purged (rate-limit records within about 24 hours).
• Aggregate statistics: kept indefinitely in non-identifying form.
• Backups: our providers keep encrypted backups for a limited rolling period; data in backups is overwritten on their normal cycle.

12. How we protect personal data

Data is encrypted in transit (HTTPS/TLS) and at rest by our hosting providers. Access to production systems is limited to those who need it. Passwords are stored only as salted hashes. We apply security headers, rate limiting and abuse filtering across the Service. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data, and we will notify the ICO and affected individuals of a personal data breach where the law requires.

13. Cookies

See our separate Cookie Policy. In short: we use a strictly-necessary cookie to keep you logged in, and one cookie to credit a partner who referred you. We use no advertising or third-party analytics cookies.

14. Children

The Service is for businesses and is not directed at children. We do not knowingly collect data from children. The feedback form is intended for adult customers of a business.

15. Changes to this policy

We may update this policy. The “last updated” date will change, and for significant changes affecting account holders we will send an email. Continuing to use the Service after a change means you accept the updated policy.

16. Contact

Mash'al Abdulqadir, trading as Dazenga
166 Hagley Road, Birmingham, B16 9NZ
privacy@dazenga.com