Privacy Policy

RepBud is operated by Charnette Ltd, a company registered in England and Wales. We take your privacy seriously. This policy explains what data we collect, why we collect it, and how we protect it.

1. Who we are

RepBud is a product of Charnette Ltd, a company registered in England and Wales under company number 17167712. Our registered office is 20 Wenlock Road, London, England, N1 7GU.

Charnette Ltd is the data controller for the personal data described in this policy, and can be contacted at the address above or by email.

We are registered with the Information Commissioner's Office as a data controller under registration number ZC206607. You can check that entry yourself on the ICO's public register at ico.org.uk/register.

For privacy matters, contact us at: privacy@repbud.app

2. What data we collect

We collect the following categories of personal data:

• Account information — your name, email address and password (encrypted)
• Profile information — your company name, job role and market preferences
• Interaction logs — notes, emails and WhatsApp messages you log through RepBud
• Contact data — names, emails, phone numbers and company details of your professional contacts
• Usage data — how you use the app, features accessed, and session information
• Billing information — processed securely by Stripe; we never store your card details
• Device information — device type, operating system and app version for support purposes, and a push notification token if you use the mobile app
• Technical data — your IP address, browser type and the pages you visit, recorded by our hosting and security providers
• Voice notes, photographs and files you record or upload, including business cards you scan
• Calendar and contact data — event titles, times, locations and attendee names and email addresses, where you connect a Google or Microsoft account
• Message engagement — whether emails you send through RepBud were opened and whether links in them were clicked
• Location — where you use Who’s Nearby, we take a location fix and store its coordinates so we can work out the nearest city. Only the city is ever shown to another member; your coordinates are not. Where you use the mileage tracker, we record the route of a trip you have started, including while the app is in the background. Both are switched on by you and off by you, and neither runs unless you use that feature.

If you use RepBud Revenue (our bookkeeping and accounting features), we also process financial data:

• Financial and transaction data — bank and credit-card transactions you import or enter, invoices, bills, expenses, receipts and the categories you assign to them
• Accounting records — your ledger, trial balance, journals, director's loan account and the reports generated from them
• Payroll data — where you run payroll: employee names, salary, National Insurance numbers, tax codes and bank details
• Tax records — VAT returns, Corporation Tax (CT600) and Self Assessment figures, and the documents you generate from them
• Counterparty data — names and contact details of your customers, suppliers and employees appearing in those records

Financial and payroll records are sensitive. We treat them accordingly, and section 5 sets out how they are protected.

3. How we use your data

We use your data solely to provide and improve the RepBud service:

• To operate your account and deliver the RepBud features you use
• To process AI-assisted features (interaction summaries, reports, meeting prep) via Anthropic's Claude API
• To send transactional emails (confirmations, reports, newsletters you create) via Postmark
• To process payments via Stripe
• To send you product updates and notifications — you can opt out at any time
• To investigate and resolve support issues
• To keep your books, produce your accounts and reports, and calculate VAT, Corporation Tax, payroll and Self Assessment figures where you use RepBud Revenue
• To comply with legal obligations

When you connect with another RepBud member, you each agree to be contacted by the other by email or message through RepBud, and each of you can add the other to your RepBud contacts. You can unsubscribe from any email, or disconnect, at any time.

We do not use your data for advertising. We do not sell your data to third parties. Ever.

3a. Our lawful basis for each purpose

Data protection law requires us to have a lawful basis for every purpose, and to tell you which one. Ours are:

• Performance of a contract (Article 6(1)(b)) — operating your account, delivering the features you subscribe to including the AI-assisted ones, taking payment, providing support, and submitting VAT or PAYE returns where you ask us to file
• Legitimate interests (Article 6(1)(f)) — keeping the service secure and detecting abuse; diagnosing faults; understanding which features are used so we can improve them; sending you service and product updates about RepBud where you are already a customer; and establishing or defending legal claims. Our interest is running and improving a service you have chosen to use, and we balance it against your interests each time
• Consent (Article 6(1)(a)) — marketing emails where you are not already a customer, and any optional integration you connect, such as a Google or Microsoft account. You can withdraw consent at any time, and doing so does not affect processing carried out before you withdrew it
• Legal obligation (Article 6(1)(c)) — keeping our own accounting and tax records, and responding to lawful requests from authorities

Where you are a customer, marketing about our own similar services is sent on the basis of legitimate interests and the soft opt-in in the Privacy and Electronic Communications Regulations. Every marketing message carries an unsubscribe link, and you can opt out at any time without giving a reason.

One important distinction: the above covers data about you. For the personal data you put into RepBud about other people, you decide the purposes and you hold the lawful basis — we act only on your instructions. Section 7a explains that split.

4. AI processing

RepBud uses Anthropic's Claude AI to power features including interaction summaries, client reports, meeting preparation and newsletter drafting.

Voice notes you record in the mobile app are sent to OpenAI for transcription using their Whisper model.

When you use these features, relevant data is sent to the provider's API for processing. Neither Anthropic nor OpenAI uses commercial API data to train their models.

Retention is a separate question, and we would rather be accurate than reassuring: under Anthropic's standard commercial terms, inputs and outputs are held for up to 30 days for operational and abuse-detection purposes, and for longer where a request is flagged under their usage policy. OpenAI applies a comparable 30-day abuse-monitoring retention. We do not currently hold a zero-retention agreement with either provider. If we obtain one, we will say so here.

RepBud's assistant, Ray, answers questions on the website and in the app, and is also powered by Anthropic's Claude. When you ask Ray something, your question and the earlier questions and answers in that conversation are sent to Anthropic. If you are signed in, Ray is also given what he needs to answer about your own account: your plan and account type, your most recent logged conversations, the names, job titles and companies of the contacts you have worked with most recently, your open tasks, and the titles and entrant counts of your prize wheel draws. Entrants' names and email addresses are not sent.

We keep the questions asked and Ray's answers. On the public website a conversation is stored with the page it was asked on and a one-way code made from your network address (not the address itself), and is deleted after 90 days. A signed-in member's conversations are stored with their account and are deleted when the account is deleted. We read the questions people ask in order to improve the answers. We are also told when someone asks Ray for a person or asks several questions in a short time, so that we can help; if you were signed in, that note includes your name and sign-in address. Ray makes no decisions about your account and cannot change anything on it.

If your account is on a Charter team plan, the Team Pulse feature sends named team members' individual activity metrics to Anthropic and asks the model to write commentary and suggestions about them for the account administrator. No decision with legal or similarly significant effect is made automatically — the output is guidance for a person to weigh — but if you are a team member, you should know that this happens.

In RepBud Revenue, two features send financial data to Anthropic: "Ask" (questions about your books, which sends the relevant ledger figures) and receipt capture (which sends the receipt image for reading). Your accounting records are therefore transmitted to Anthropic when — and only when — you use those features. No financial data is sent to any AI provider otherwise, and none of it is used for model training.

Posts and pictures that members share in community areas, such as photos and pictures in group chats and posts on community boards, are checked by an automated safety service before other members see them. The check is made by OpenAI's moderation service; anything it marks is held for a person at RepBud to review, and only its author can see it until then. If we switch on a second automated check for borderline items, Anthropic's Claude makes it. OpenAI states that data sent to its API is not used to train its models unless the customer opts in, and its data controls list the moderation service with no abuse-monitoring retention. Anthropic states that by default it does not use inputs or outputs from its commercial products, including its API, to train its models. Direct messages are not checked.

You can review Anthropic's privacy policy at anthropic.com/privacy.

5. Data storage and security

Your data is primarily stored on Supabase infrastructure located in Ireland (EU). Two qualifications we would rather state than gloss over: files uploaded through RepBud Relay are stored in Cloudflare R2, which we have not restricted to an EU region, and several of the providers in section 6 are US-based and receive data in the course of the features they power. Section 6 sets out the safeguards that apply.

• All data is encrypted in transit using TLS
• All data is encrypted at rest
• Row Level Security (RLS) ensures users can only access their own data
• Passwords are hashed and never stored in plain text
• Access to production systems is strictly controlled

RepBud is designed so that your data is isolated from other accounts. Within your own account, though, data is shared exactly as you choose to share it: colleagues on a team or Charter plan see what the plan gives them, an accountant you grant access to sees the entity you granted, and a client you invite to a shared report sees that report. We do not share your contacts or logs with anyone you have not authorised.

6. Google user data, and the Limited Use restrictions

Where you connect a Google account, RepBud requests a single scope — https://www.googleapis.com/auth/calendar.readonly — which lets it read your calendar. RepBud never creates, changes or deletes an event.

RepBud’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In particular: we do not use, transfer or sell Google user data — raw, aggregated or derived — to create, train or improve any foundational or generalised machine learning or artificial intelligence model. Your calendar events are passed to our AI provider only at the moment your own briefing is written, so that the briefing can mention the meetings you have that day. They are not retained by that provider for training, and they are shown only to you.

7. Third-party services

We use the following third-party services to operate RepBud:

• Supabase (Ireland, EU) — database, authentication and file storage
• Vercel (US/EU) — web hosting and content delivery
• Cloudflare (global) — DNS, inbound email routing, and R2 object storage for files uploaded through RepBud Relay
• Anthropic (US) — AI processing for intelligent features, including "Ask" and receipt capture in RepBud Revenue
• OpenAI (US) — transcription of voice notes recorded in the mobile app, and the automated safety check of posts and pictures shared in community areas
• Google (US/global) — calendar and contact sync where you connect a Google account, and web font delivery
• Microsoft (US/global) — Outlook calendar sync and Teams meeting creation where you connect a Microsoft account
• Stripe (US/EU) — payment processing
• Postmark (US) — transactional email, newsletters and connection invitations, including invoices you send
• Meta (WhatsApp Business API, global) — WhatsApp integration
• Twilio (US) — provides the phone number RepBud uses for WhatsApp; WhatsApp messages do not pass through Twilio, but if you phone or text that number, Twilio carries the call or text and receives your phone number
• Modal (US) — processing presentations you import into RepBud Reveal; the file you upload is sent there whole so its slides, pictures and video can be read
• Mapbox (US) — geocoding company addresses and rendering trade-event venue maps
• Hunter.io (France, EU) — Smart Email Finder; we send a contact's name and their employer's domain to find a likely work email address
• Jina AI (Germany/global) — reading a company's public website when you ask us to scan it
• Expo (US) — push notification delivery to the mobile app
• RevenueCat (US) — in-app purchases and subscription status in the mobile app
• Sentry (EU/US) — error monitoring in RepBud Revenue

Each of these providers operates under their own privacy policies and data processing agreements. We have selected providers that meet high standards for data security and privacy.

International transfers: where a provider processes data outside the UK or EEA, that transfer is made under an appropriate safeguard, being the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the provider is certified under it. You can obtain a copy of the safeguard relied on for any particular transfer by emailing privacy@repbud.app, and we will provide it or tell you where it is published.

8. Data retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or regulatory purposes (for example, billing records).

Interaction logs, contacts and notes are deleted immediately upon account deletion.

Financial records are different, but not in the way software providers usually claim. Accounting records generally have to be kept for six years from the end of the accounting period, and payroll records for at least three years — but those duties fall on you, as the company and employer whose records they are. They are not our grounds for holding on to your data. So where you close your RepBud Revenue account we will, at your choice, either return your accounting data to you or delete it, and we will not refuse deletion by pointing at a retention rule that is yours to satisfy. Exporting your books before you go is worth doing for exactly that reason.

Separately, we keep our own business records about you as a customer — our invoices to you, payment records and correspondence — for six years, because we have our own statutory duty to do so. That is a small set of data about you as our customer, not the contents of your account.

8a. Who controls your data

For your own account — your name, email, billing and how you use RepBud — Charnette Ltd is the data controller, and this policy explains what we do with it.

For the data you put INTO RepBud about other people — your contacts, customers, suppliers and employees, including their financial and payroll records — you are the data controller and we are your data processor. We only act on your instructions.

That relationship is governed by our Data Processing Agreement, which sets out the scope, our obligations, the sub-processors we use and what happens to the data when you leave. It forms part of our terms and applies automatically when you use RepBud — you do not need to request or sign one.

9. Your rights (GDPR)

These rights come from the UK GDPR. We apply them to every RepBud user, wherever you are — if you are in South Africa, Kenya, Tanzania or the United States, you get the same rights as a user in London. You may also have rights under your own country's law in addition to these.

• Right of access — request a copy of all data we hold about you
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data ("right to be forgotten")
• Right to data portability — receive your data in a machine-readable format
• Right to restrict processing — limit how we use your data
• Right to object — object to processing based on legitimate interests, and an absolute right to object to direct marketing at any time
• Right to withdraw consent — where processing is based on consent, at any time and as easily as you gave it; withdrawing does not affect processing already carried out
• Rights in relation to automated decision-making — we do not make decisions about you by automated means that produce legal or similarly significant effects

To exercise any of these rights, email privacy@repbud.app. We will respond within one month, which we may extend by two further months for complex requests — if we need to do that, we will tell you why within the first month. There is no charge.

Providing your data is not a statutory requirement, but the account information and billing details we ask for are necessary to enter into and perform our contract with you. Without them we cannot provide RepBud. Everything else is optional.

10. Cookies

The RepBud app itself uses essential cookies only — required for authentication and to keep you signed in. We do not use advertising cookies, analytics companies or any third-party tracking in the app, and nothing in the app profiles you.

To see which parts of the app are used, the app records when it is opened and when you save a log, add a contact, start an import, request a report or open the upgrade page, and which step of setting up your account you have reached and the kind of account it is, together with the app version and whether you are on iOS or Android. When you set up your account on the website, it records the same thing: which step you reached and the kind of account. These records are kept in RepBud’s own database under your account. They never contain what you wrote or who it was about, no other company receives them, and nothing is stored on your device for them. They are covered by the usage data in section 2 and the legitimate interest in section 3a.

While you are setting up your account, the answers you have given so far are saved with your sign-in details, so that you can stop and carry on later from the website or the app. They are removed once setup is finished.

The web platform (repbud.app) is hosted on Vercel, which may set an essential security cookie to protect the site from automated abuse.

On the public website (repbud.app) we use Vercel Web Analytics to count visits and see which pages and referring sites bring people in. It is cookieless — it sets no cookie, stores nothing on your device and does not follow you across other websites — so it runs without a consent prompt, and there is no cookie banner on the site. It records aggregate details of the page view only, such as the page, the referring site, country and device type, and it is not connected to your RepBud account. We removed Google Analytics from the website in August 2026; it set cookies and disclosed your IP address to Google, and we decided the measurement was not worth asking you for.

Your browser also keeps a short note of how a visit to the public website began: the first page you opened, the name of the website that linked you there (not the full link) and any campaign tag on that link. It is kept in session storage for that browser tab only and it is deleted when you close the tab. When the visit begins we add one to a daily count of visits by first page and source: we receive the page, the name of the linking website and any utm_source tag, and nothing else — no IP address, account or identifier is stored with the count, and it is never linked to you. If you create a RepBud account during that visit, details from it are saved to your own profile so we can see which pages and websites bring people who sign up; if you do not, it stays in the tab and is deleted with it.

One thing on the public website we would rather name than bury: our free visa-requirements tool at /tools/visas embeds a widget supplied by VisaHQ, whose scripts may set cookies or read information from your browser for their own purposes, including affiliate attribution — we earn a commission if you go on to buy a visa through them.

Nothing from VisaHQ loads unless you ask for it. The tool sits behind a consent step that tells you who receives data before anything is requested, and if you never press the button, no third-party script runs at all. Once loaded, a single link on the same page withdraws consent again — no email, no form. No RepBud account data is shared with VisaHQ either way.

The travel links on the event pages (hotels, flights, car hire, transfers and similar) are affiliate links. Each one goes through repbud.app/go first, which counts the click and then sends you on. We keep the event page, which link and where on the page it sat, the type of device, the name of the website that linked you to the page, whether the request looked automated, and a code made from your IP address, your browser and the date with a secret key, so it changes every day. That code cannot be turned back into your IP address and is not linked to a RepBud account. From there you pass through the affiliate network to the booking site: CJ for Booking.com, Expedia and NordVPN, Travelpayouts for Kiwi.com, Airalo and airport transfers, and Awin for Holiday Extras, JustPark and the city pass. Those companies set their own cookies so that a booking can be credited to us, under their own privacy policies. We do not receive your booking details, and no RepBud account data is passed to them.

Some pages also load web fonts from Google, which discloses your IP address to Google in the course of serving the font.

11. Children's privacy

RepBud is a professional tool intended for adults working in the travel industry. We do not knowingly collect data from anyone under the age of 18. If you believe a minor has created an account, please contact us immediately at privacy@repbud.app.

12. Changes to this policy

We may update this privacy policy from time to time. We will notify you of significant changes by email and by updating the "last updated" date at the top of this page.

Where a change materially affects your rights we will give you at least 30 days’ notice by email before it takes effect. A privacy notice tells you what we do with your data; it is not something you consent to, so continuing to use RepBud is not treated as agreement to a change. Where we rely on your consent for something, we will ask you again rather than assume it.

13. Contact us

For any privacy-related questions or data requests, please contact us. Our Data Processing Agreement is published in full and needs no separate request.