Privacy Policy

Last updated: 31 October 2026

1. Who we are

TrustClap is operated by VECTORSPELL LTD, registered in England and Wales, company number 17167562, Prime Apartments 483 Green Lanes, London, N13 4FG, United Kingdom. Contact: our contact page.

2. Two kinds of data, two roles

• Account data (people who sign up for TrustClap: name, email address, sign-in details, plan and billing status, workspace and team settings). We decide how this is used, so we are its controller.
• Feedback data (what a business's customers send through a collection page, and testimonials a business imports). We store and process it on behalf of that business, which decides how it is used. For this data the business is the controller and we are its processor. If you sent feedback to a business, contact that business first; we will help them answer you.

3. What a collection page collects

The answers to the business's questions, and, when the business asks for them: a star rating, name, job title, company, a photo and an email address. The customer also chooses whether the business may publish their answers, and which of their details may be shown with them. We store that choice with its date and the version of the wording they saw.

4. What becomes public and what never does

• Public only after the business publishes a testimonial with the customer's permission: the quoted words (shortened only with a visible "…"), the star rating for that testimonial, and only the details the customer allowed (name, job title, company, photo). Imported testimonials show where they came from.
• Never public: email addresses, feedback without permission to publish, private notes and tags, client comments, and any technical data.

5. Withdrawal and removal

After sending feedback, each customer gets a personal link to withdraw it entirely, or to hide their name, job title, company and photo while keeping the words. Withdrawn testimonials leave the business's widgets and hosted wall within a minute. Anyone can ask for removal from a hosted wall; the business receives the request.

6. Technical data

• To stop spam and repeated submissions, we keep a keyed one-way hash of the connection address with each submission, and short-lived counters (one hour) in our rate limiter. We do not store connection addresses themselves with feedback.
• View counts for collection pages, widgets and walls are kept only as numbers per day. Widgets and walls set no cookies and load no third-party trackers. TrustClap uses no third-party analytics.
• The app keeps you signed in with your browser's local storage. Our landing pages set no tracking cookies.

7. Who else processes data

Our hosting providers run the servers that store TrustClap's data. Stripe processes payments (we never see full card numbers). Our email provider sends account emails and short notices about your workspace, such as new feedback or a client's decision; notices never contain your customers' words or contact details. TrustClap does not use AI services and does not send feedback to any other third party.

8. How long we keep data

• Feedback and testimonials stay in a workspace until the business archives the brand and asks us to delete it, or asks us to delete its account (both from the Help page in the app). There is no button for deleting a single response. A customer's withdrawal takes their testimonial off every public page, and the business keeps it only as private feedback. Downgrading never deletes anything.
• Uploaded images that are no longer used (for example a replaced logo, or a photo for a testimonial that was never saved) are removed after 24 hours.
• When an account is deleted through our reviewed deletion process, its workspace content, images and team memberships are removed, and the account is anonymised. Financial records are kept as the law requires.

9. Security

Data travels over encrypted connections. Private fields are only visible to the workspace that collected them; client reviewers see only the testimonials waiting for their own brand, and only their public form. Links for reviewers, reports, withdrawals and invitations are long random secrets, and we store only a hash of them.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, and to object to or restrict its use. Account holders can export their feedback as a CSV at any time and request a copy of their data or account deletion from the Help page; a person checks that the request is really theirs first. For feedback you sent to a business, contact that business; you can also use your withdrawal link. You can complain to your data protection authority (in the UK, the ICO).

11. Changes

We will update this policy when TrustClap changes and tell account holders about significant changes.