Privacy Policy

Effective date: 21 August 2026

1. Who we are

Vouchbase is a customer review service operated by Truvas Limited, a company registered in England and Wales (company number 11702342, registered office 115 Portland Road, London, England, SE25 4UN). Vouchbase helps online stores collect and publish reviews from their real customers.

For questions about this policy or about your personal data, contact us at privacy@vouchbase.net.

This policy explains how we handle personal data in three situations: when you receive a review invitation from a store that uses Vouchbase (sections 2–4), when you write a review (section 5), and when you run a store that uses Vouchbase or simply visit this website (section 6). Sections 7–12 apply to everyone.

2. If you received a review invitation email

A store you bought from uses Vouchbase to ask its customers for reviews. The email was sent on behalf of that store — the store is responsible for the message, and replies go to the store, not to us. We sent it as the store's service provider.

You are under no obligation to do anything. Every invitation contains an unsubscribe link; using it stops all future review emails relating to that store, permanently. If you do nothing, we delete the personal data connected to your order from our systems after approximately 90 days (see section 7).

3. What data we receive from stores, and why

When a store connects Vouchbase, its e-commerce system sends us limited information about qualifying orders so that a review invitation can be sent:

• your email address and first name,
• the order reference, date, total, and currency,
• the items in the order, and
• whether the order's payment was confirmed through the store's payment gateway (a yes/no signal — we do not receive card or payment details).

We use this data for exactly one purpose: inviting you, on the store's behalf, to review your purchase, and — if you write a review — recording that it came from a real order. We do not use this data for advertising, we do not sell it, and we do not send you anything except the review invitation and at most one reminder.

4. Legal roles and lawful basis

For invitation data, the store is the data controller and Truvas Limited is its data processor: we act only on the store's documented instructions under a data processing agreement. The lawful basis for sending you the invitation belongs to the store, which collected your email address in the course of your purchase and is required to offer you the opportunity to opt out. Every email we send on a store's behalf also carries a working unsubscribe link, and we enforce unsubscribes across our entire system.

For some processing we act as a controller in our own right: publishing review content on vouchbase.net (section 5), operating merchant accounts and billing (section 6), running this website, and preventing fraud and abuse of the service (legitimate interests).

5. If you write a review

Reviews on Vouchbase are voluntary. When you submit one:

• Your review text, star rating, and chosen display name are published on the store's Vouchbase profile and, for product reviews, on the store's own website. You choose the display name, and you can choose to post without a name (shown as "Verified customer").
• Your review is linked to your order so that it can be labelled as coming from a verified purchase where the order's payment was confirmed through the store's payment gateway.
• Published reviews cannot be edited — by you, by the store, or by us. This is how we keep reviews trustworthy. You can, however, delete your review at any time.

Deleting your review and your data:the link in your invitation email works indefinitely as your control panel. One click withdraws your review — from vouchbase.net and from the store's website — with no account and no form. If you have lost the email, a request via privacy@vouchbase.net triggers the same deletion. A withdrawn review is removed from all ratings and displays; its verification page shows only a note that the review was withdrawn by the reviewer.

Your chosen display name is the only identifying information that remains attached to a published review after the order data is deleted under section 7.

6. Merchants and website visitors

Merchants. If you create a Vouchbase account for your store, we process your account details (name, email, store domain), your store connection data, and your billing information as a controller, on the basis of our contract with you. Payments are processed by Stripe; we do not store card numbers. We retain merchant account records for the life of the account and as required for tax and accounting law afterwards.

Website visitors. vouchbase.net uses no advertising or analytics cookies and no non-essential cookies on public pages — which is why you see no cookie banner. Our infrastructure providers keep short-lived technical logs (IP address, request data) for security and delivery of the site.

7. How long we keep data

We keep personal data only as long as it does its job:

• Orders that led to a review:approximately 90 days after the invitation completes, we permanently remove the customer name and email address from the order record. What remains — order reference, date, total, and payment-confirmation status — contains no personal data and is kept to preserve the review's verification record.
• Orders that did not lead to a review: the order, its items, and the invitation are deleted in full approximately 90 days after the invitation completes or expires.
• Reviews:published until withdrawn by the reviewer or removed under our content policies; only the reviewer's chosen display name is attached.
• Unsubscribes: kept indefinitely in a protected suppression list (stored as a cryptographic hash of the email address, not the address itself), because honouring an opt-out permanently is a legal obligation.
• Merchant records: life of the account plus statutory retention periods.

8. Who we share data with (sub-processors)

We use a small number of service providers to run Vouchbase. Each processes data only on our instructions:

We also share review content with the store it belongs to (product reviews are delivered to the store's website for display). We do not sell personal data and do not share it with advertisers. We may disclose data where the law requires it.

9. International transfers

Reviewer and order data is stored in the United Kingdom, and invitation emails are sent from the European Union. Where a provider involves a transfer outside the UK or EEA (see the table above), the transfer is protected by safeguards recognised under UK data protection law, including the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, as applicable per provider.

10. Your rights

Under UK and EU data protection law you have the right to access your personal data, correct it, have it deleted, restrict or object to its processing, and receive a copy in a portable format. For review invitations, the fastest routes are built in: the unsubscribe link stops emails, and the link in your invitation deletes your review and associated data. For anything else — or if you no longer have the email — contact privacy@vouchbase.net.

Where the store is the controller (section 4), we will either handle your request on the store's behalf or pass it to the store without delay — you don't need to work out which of us to ask.

You also have the right to complain to a supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk).

11. Security

Access to personal data is restricted and logged. Review links use high-entropy tokens. Payment details never touch our systems. Data is encrypted in transit. No system is perfectly secure, but the design principle throughout Vouchbase is to hold as little personal data as possible, for as short a time as possible — the deletion schedule in section 7 exists to shrink what could ever be exposed.

12. Changes to this policy

We will post any changes on this page and update the effective date. If a change materially affects how reviewer data is handled, stores using Vouchbase will be notified so they can inform their customers where required.

Truvas Limited, 115 Portland Road, London, England, SE25 4UN. Company number 11702342.