Privacy Policy

RepBud is operated by Charnette Ltd, a company registered in England and Wales. We take your privacy seriously. This policy explains what data we collect, why we collect it, and how we protect it.

1. Who we are

RepBud is a product of Charnette Ltd, a company registered in England and Wales under company number 17167712. Our registered office is 20 Wenlock Road, London, England, N1 7GU.

Charnette Ltd is the data controller for the personal data described in this policy, and can be contacted at the address above or by email.

For privacy matters, contact us at: privacy@repbud.app

2. What data we collect

We collect the following categories of personal data:

• Account information — your name, email address and password (encrypted)
• Profile information — your company name, job role and market preferences
• Interaction logs — notes, emails and WhatsApp messages you log through RepBud
• Contact data — names, emails, phone numbers and company details of your professional contacts
• Usage data — how you use the app, features accessed, and session information
• Billing information — processed securely by Stripe; we never store your card details
• Device information — device type, operating system and app version for support purposes, and a push notification token if you use the mobile app
• Technical data — your IP address, browser type and the pages you visit, recorded by our hosting and security providers
• Voice notes, photographs and files you record or upload, including business cards you scan
• Calendar and contact data — event titles, times, locations and attendee names and email addresses, where you connect a Google or Microsoft account
• Message engagement — whether emails you send through RepBud were opened and whether links in them were clicked

If you use RepBud Revenue (our bookkeeping and accounting features), we also process financial data:

• Financial and transaction data — bank and credit-card transactions you import or enter, invoices, bills, expenses, receipts and the categories you assign to them
• Accounting records — your ledger, trial balance, journals, director's loan account and the reports generated from them
• Payroll data — where you run payroll: employee names, salary, National Insurance numbers, tax codes and bank details
• Tax records — VAT returns, Corporation Tax (CT600) and Self Assessment figures, and the documents you generate from them
• Counterparty data — names and contact details of your customers, suppliers and employees appearing in those records

Financial and payroll records are sensitive. We treat them accordingly, and section 5 sets out how they are protected.

3. How we use your data

We use your data solely to provide and improve the RepBud service:

• To operate your account and deliver the RepBud features you use
• To process AI-assisted features (interaction summaries, reports, meeting prep) via Anthropic's Claude API
• To send transactional emails (confirmations, reports, newsletters you create) via Postmark
• To process payments via Stripe
• To send you product updates and notifications — you can opt out at any time
• To investigate and resolve support issues
• To keep your books, produce your accounts and reports, and calculate VAT, Corporation Tax, payroll and Self Assessment figures where you use RepBud Revenue
• To submit returns to HMRC where you choose to file through the app (VAT and PAYE/RTI)
• To comply with legal obligations

We do not use your data for advertising. We do not sell your data to third parties. Ever.

3a. Our lawful basis for each purpose

Data protection law requires us to have a lawful basis for every purpose, and to tell you which one. Ours are:

• Performance of a contract (Article 6(1)(b)) — operating your account, delivering the features you subscribe to including the AI-assisted ones, taking payment, providing support, and submitting VAT or PAYE returns where you ask us to file
• Legitimate interests (Article 6(1)(f)) — keeping the service secure and detecting abuse; diagnosing faults; understanding which features are used so we can improve them; sending you service and product updates about RepBud where you are already a customer; and establishing or defending legal claims. Our interest is running and improving a service you have chosen to use, and we balance it against your interests each time
• Consent (Article 6(1)(a)) — marketing emails where you are not already a customer, and any optional integration you connect, such as a Google or Microsoft account. You can withdraw consent at any time, and doing so does not affect processing carried out before you withdrew it
• Legal obligation (Article 6(1)(c)) — keeping our own accounting and tax records, and responding to lawful requests from authorities

Where you are a customer, marketing about our own similar services is sent on the basis of legitimate interests and the soft opt-in in the Privacy and Electronic Communications Regulations. Every marketing message carries an unsubscribe link, and you can opt out at any time without giving a reason.

One important distinction: the above covers data about you. For the personal data you put into RepBud about other people, you decide the purposes and you hold the lawful basis — we act only on your instructions. Section 7a explains that split.

4. AI processing

RepBud uses Anthropic's Claude AI to power features including interaction summaries, client reports, meeting preparation and newsletter drafting.

Voice notes you record in the mobile app are sent to OpenAI for transcription using their Whisper model.

When you use these features, relevant data is sent to the provider's API for processing. Neither Anthropic nor OpenAI uses commercial API data to train their models.

Retention is a separate question, and we would rather be accurate than reassuring: under Anthropic's standard commercial terms, inputs and outputs are held for up to 30 days for operational and abuse-detection purposes, and for longer where a request is flagged under their usage policy. OpenAI applies a comparable 30-day abuse-monitoring retention. We do not currently hold a zero-retention agreement with either provider. If we obtain one, we will say so here.

If your account is on a Charter team plan, the Team Pulse feature sends named team members' individual activity metrics to Anthropic and asks the model to write commentary and suggestions about them for the account administrator. No decision with legal or similarly significant effect is made automatically — the output is guidance for a person to weigh — but if you are a team member, you should know that this happens.

In RepBud Revenue, two features send financial data to Anthropic: "Ask" (questions about your books, which sends the relevant ledger figures) and receipt capture (which sends the receipt image for reading). Your accounting records are therefore transmitted to Anthropic when — and only when — you use those features. No financial data is sent to any AI provider otherwise, and none of it is used for model training.

You can review Anthropic's privacy policy at anthropic.com/privacy.

5. Data storage and security

Your data is primarily stored on Supabase infrastructure located in Ireland (EU). Two qualifications we would rather state than gloss over: files uploaded through RepBud Relay are stored in Cloudflare R2, which we have not restricted to an EU region, and several of the providers in section 6 are US-based and receive data in the course of the features they power. Section 6 sets out the safeguards that apply.

• All data is encrypted in transit using TLS
• All data is encrypted at rest
• Row Level Security (RLS) ensures users can only access their own data
• Passwords are hashed and never stored in plain text
• Access to production systems is strictly controlled

RepBud is designed so that your data is isolated from other accounts. Within your own account, though, data is shared exactly as you choose to share it: colleagues on a team or Charter plan see what the plan gives them, an accountant you grant access to sees the entity you granted, and a client you invite to a shared report sees that report. We do not share your contacts or logs with anyone you have not authorised.

6. Third-party services

We use the following third-party services to operate RepBud:

• Supabase (Ireland, EU) — database, authentication and file storage
• Vercel (US/EU) — web hosting and content delivery
• Cloudflare (global) — DNS, inbound email routing, and R2 object storage for files uploaded through RepBud Relay
• Anthropic (US) — AI processing for intelligent features, including "Ask" and receipt capture in RepBud Revenue
• OpenAI (US) — transcription of voice notes recorded in the mobile app
• Google (US/global) — calendar and contact sync where you connect a Google account, and web font delivery
• Microsoft (US/global) — Outlook calendar sync and Teams meeting creation where you connect a Microsoft account
• Stripe (US/EU) — payment processing
• Postmark (US) — transactional email delivery, including invoices you send
• Resend (US) — newsletters and connection invitations
• Twilio (global) — WhatsApp message processing
• Meta (WhatsApp Business API, global) — WhatsApp integration
• Mapbox (US) — geocoding company addresses and rendering trade-event venue maps
• Hunter.io (France, EU) — Smart Email Finder; we send a contact's name and their employer's domain to find a likely work email address
• Expo (US) — push notification delivery to the mobile app
• Sentry (EU/US) — error monitoring in RepBud Revenue

Each of these providers operates under their own privacy policies and data processing agreements. We have selected providers that meet high standards for data security and privacy.

HMRC is different and does not belong in that list. Where you choose to submit a VAT or PAYE/RTI return through the app, we transmit your return — which for payroll includes each employee's National Insurance number, tax code, pay and deductions — to HMRC. HMRC is not our supplier; it receives that data as an independent controller under its own statutory powers, and what it does with it is governed by HMRC's own privacy notice.

International transfers: where a provider processes data outside the UK or EEA, that transfer is made under an appropriate safeguard, being the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the provider is certified under it. You can obtain a copy of the safeguard relied on for any particular transfer by emailing privacy@repbud.app, and we will provide it or tell you where it is published.

7. Data retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or regulatory purposes (for example, billing records).

Interaction logs, contacts and notes are deleted immediately upon account deletion.

Financial records are different, but not in the way software providers usually claim. Accounting records generally have to be kept for six years from the end of the accounting period, and payroll records for at least three years — but those duties fall on you, as the company and employer whose records they are. They are not our grounds for holding on to your data. So where you close your RepBud Revenue account we will, at your choice, either return your accounting data to you or delete it, and we will not refuse deletion by pointing at a retention rule that is yours to satisfy. Exporting your books before you go is worth doing for exactly that reason.

Separately, we keep our own business records about you as a customer — our invoices to you, payment records and correspondence — for six years, because we have our own statutory duty to do so. That is a small set of data about you as our customer, not the contents of your account.

7a. Who controls your data

For your own account — your name, email, billing and how you use RepBud — Charnette Ltd is the data controller, and this policy explains what we do with it.

For the data you put INTO RepBud about other people — your contacts, customers, suppliers and employees, including their financial and payroll records — you are the data controller and we are your data processor. We only act on your instructions.

That relationship is governed by our Data Processing Agreement, which sets out the scope, our obligations, the sub-processors we use and what happens to the data when you leave. It forms part of our terms and applies automatically when you use RepBud — you do not need to request or sign one.

8. Your rights (GDPR)

These rights come from the UK GDPR. We apply them to every RepBud user, wherever you are — if you are in South Africa, Kenya, Tanzania or the United States, you get the same rights as a user in London. You may also have rights under your own country's law in addition to these.

• Right of access — request a copy of all data we hold about you
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data ("right to be forgotten")
• Right to data portability — receive your data in a machine-readable format
• Right to restrict processing — limit how we use your data
• Right to object — object to processing based on legitimate interests, and an absolute right to object to direct marketing at any time
• Right to withdraw consent — where processing is based on consent, at any time and as easily as you gave it; withdrawing does not affect processing already carried out
• Rights in relation to automated decision-making — we do not make decisions about you by automated means that produce legal or similarly significant effects

To exercise any of these rights, email privacy@repbud.app. We will respond within one month, which we may extend by two further months for complex requests — if we need to do that, we will tell you why within the first month. There is no charge.

Providing your data is not a statutory requirement, but the account information and billing details we ask for are necessary to enter into and perform our contract with you. Without them we cannot provide RepBud. Everything else is optional.

9. Cookies

The RepBud app itself uses essential cookies only — required for authentication and to keep you signed in. We do not use advertising cookies or behavioural tracking in the app, and we do not run analytics that profile you.

The web platform (repbud.app) is hosted on Vercel, which may set an essential security cookie to protect the site from automated abuse.

One thing on the public website we would rather name than bury: our free visa-requirements tool at /tools/visas embeds a widget supplied by VisaHQ, whose scripts may set cookies or read information from your browser for their own purposes, including affiliate attribution — we earn a commission if you go on to buy a visa through them.

Nothing from VisaHQ loads unless you ask for it. The tool sits behind a consent step that tells you who receives data before anything is requested, and if you never press the button, no third-party script runs at all. Once loaded, a single link on the same page withdraws consent again — no email, no form. No RepBud account data is shared with VisaHQ either way.

Some pages also load web fonts from Google, which discloses your IP address to Google in the course of serving the font.

10. Children's privacy

RepBud is a professional tool intended for adults working in the travel industry. We do not knowingly collect data from anyone under the age of 18. If you believe a minor has created an account, please contact us immediately at privacy@repbud.app.

11. Changes to this policy

We may update this privacy policy from time to time. We will notify you of significant changes by email and by updating the "last updated" date at the top of this page.

Where a change materially affects your rights we will give you at least 30 days’ notice by email before it takes effect. A privacy notice tells you what we do with your data; it is not something you consent to, so continuing to use RepBud is not treated as agreement to a change. Where we rely on your consent for something, we will ask you again rather than assume it.

12. Contact us

For any privacy-related questions or data requests, please contact us. Our Data Processing Agreement is published in full and needs no separate request.