The Black Directory

Privacy Policy

Version 1.1 · Last updated: [DNA: date of publishing]

1. Who We Are

Darren N Anderson trading as The Black Directory, a sole trader based at Flat 14 Betchworth House, London N7 0QL, is the data controller for personal data processed through The Black Directory app (iOS and Android), theblackdirectory.app and api.theblackdirectory.app. ICO registration number: ZC291434. Privacy questions and requests: privacy@theblackdirectory.app. General contact: contact@theblackdirectory.app. We have not appointed a Data Protection Officer; contact us at privacy@theblackdirectory.app.

2. Data We Collect

  • Launch-updates sign-up: email address.
  • Business interest form: business name, business email, city, category.
  • Member accounts: first and last name, email address, password (stored hashed), saved businesses and events, reviews and ratings and any photos you add to them, reports you make and users you block.
  • Sign in with Apple / Google: if you use these, we receive your name and email address (with Apple you may choose to hide your email and we receive a private relay address) and a unique account identifier. We do not receive your Apple or Google password.
  • Business-owner accounts and listings: owner name and contact details, business name, address, opening hours, photos, website and social media links (e.g. Instagram), events, and the contact phone number and email address you give us to claim or verify a business.
  • Recommendations and feedback: businesses you recommend to us and feedback you send in the app.
  • Location: if you allow it, the app uses your precise location on your device to show distances and sort nearby businesses. Your precise location stays on your device and is not sent to us. To draw the map, the app loads map images from our server, so our server can tell the general area being viewed (approximate location). We don't link this to your account or store your coordinates.
  • Usage data: search terms you enter (stored without being linked to you, along with the platform used); views and taps on listings (call, directions, website, social links, saves), counted per business rather than per person, to produce business stats; and your IP address, used to prevent abuse (rate limiting) and deleted automatically after a short period.
  • Bot protection: Cloudflare Turnstile processes technical signals to check you're human.
  • Messages to us: content of emails and support requests.
  • Purchases: if you buy a business plan or member Premium in the app, Apple or Google take the payment. We receive the plan you bought, its price and currency, purchase, renewal and expiry dates, the store's transaction ID and whether it is active, cancelled or refunded, linked to your account. We never receive your card or bank details.

We do not collect data for third-party advertising and do not track you across other companies' apps or websites. The app contains no advertising, analytics or tracking SDKs.

3. How We Use It And Lawful Bases

  • Providing the Service, accounts, listings, saves and reviews – contract.
  • Processing in-app purchases, giving you the features you paid for and handling renewals, cancellations and refunds – contract.
  • Showing nearby businesses using location – consent (device permission), withdrawable in settings.
  • Launch updates and marketing emails – consent (withdraw any time via unsubscribe).
  • Contacting businesses that register interest – legitimate interests / pre-contract steps.
  • Moderating reviews, handling reports and blocks, security, fraud and bot prevention – legitimate interests.
  • Business stats shown to listing owners (aggregated, not identifying individual users) and aggregated usage statistics – legitimate interests.
  • Legal and accounting obligations, including keeping purchase records for tax – legal obligation.

4. Public Information

Business listings, events and your reviews (with the name on your account) are public in the app and on the website.

5. Sharing Your Data

We don't sell your personal data or share it with third parties for their own purposes. Your data is stored on our own server (api.theblackdirectory.app), hosted by IONOS SE in an EU data centre in Germany. Service providers that process data for us under contract, and must protect it to the same standard as this policy, include IONOS SE (hosting) and Cloudflare (network security, bot protection and delivery for our website and API, so Cloudflare handles your IP address). Sign in with Apple / Google: Apple or Google confirm your identity to us and we receive only the details listed in section 2. Maps: map images come from Google but are requested by our server, so Google doesn't receive your location or identity from the app. If you tap Directions, the app opens Google Maps, Apple Maps or Waze, and that company's privacy policy applies. In-app purchases: Apple (App Store) or Google (Google Play) process your payment under their own privacy policies. We use RevenueCat, Inc. (USA) to validate purchases and manage subscriptions; RevenueCat receives your app account ID and purchase records, but not your name, email or card details. We may disclose data where required by law or to protect rights and safety.

6. International Transfers

Your data is stored in the EU (Germany), which the UK recognises as providing adequate protection under UK GDPR. RevenueCat processes purchase data in the United States [DNA: confirm RevenueCat's transfer mechanism, e.g. the UK Extension to the EU–US Data Privacy Framework or the IDTA in its data processing agreement]. Where data leaves the UK for any other country, we use adequacy regulations or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.

7. How Long We Keep It

  • Account data, reviews and review photos, saved items, claims, recommendations and feedback: kept while your account is open and deleted from our live systems when you delete your account.
  • Search logs (not linked to you): deleted after 6 months.
  • Business listings: kept while the listing is active. If you delete your account, listings you managed stay in the directory but are no longer linked to you; a business's public factual details (name, address) may remain listed unless it asks us to remove them.
  • IP addresses used for rate limiting: deleted automatically on a short rolling basis.
  • Reports and moderation records: 12 months.
  • Server logs and security data: 90 days.
  • Launch-updates emails: until you unsubscribe or launch plus 12 months.
  • Database backups: deleted after 30 days, so data you delete can remain in a backup for up to 30 days.
  • * Purchase and subscription records: 6 years after the end of the tax year they relate to, for tax and accounting, even if you delete your account.

8. Deleting Your Account And Data

You can delete your account and associated data at any time:

We complete web and email requests within 30 days. When you delete your account we delete your account details, reviews and review photos, saved businesses and events, claims, recommendations, feedback and pending events. Business listings you managed stay in the directory but are unlinked from you. Copies in our database backups are deleted within 30 days. If you used Sign in with Apple, we also revoke the app's access to your Apple ID when you delete your account. You can delete a single review at any time without deleting your account. Deleting your account doesn't cancel a subscription: cancel it in your App Store or Google Play subscriptions to stop future charges. We keep purchase records for tax as described in section 7.

9. Your Rights

Under UK GDPR you can request access, correction, deletion, restriction, portability, and object to processing, and withdraw consent at any time (this doesn't affect processing before withdrawal). Email privacy@theblackdirectory.app. We will respond within one month.

10. Cookies, SDKs And Similar Technologies

The app is built with the Expo framework and uses Sign in with Apple, Google sign-in and the RevenueCat SDK to process in-app purchases (RevenueCat doesn't track you across apps or show ads). It has no Google Maps SDK: map images load through our own server, and Directions opens Google Maps, Apple Maps or Waze. There are no analytics, advertising or crash-reporting SDKs. The website uses strictly necessary cookies only. Non-essential cookies and similar technologies are only used with your consent, as required by PECR.

11. Children

You can browse the app without an account, but accounts are only for adults aged 18 and over. The Service is not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has created an account or given us their data, contact us and we will delete it.

12. Security

We use appropriate technical and organisational measures, including encryption in transit (HTTPS), hashed passwords and access controls, to protect your data.

13. Complaints

You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), but please contact us first so we can try to help.

14. Changes

We'll post updates here with a new date and tell you in the app or by email about material changes.

15. Contact Us

Darren N Anderson trading as The Black Directory, Flat 14 Betchworth House, London N7 0QL. Email: contact@theblackdirectory.app · privacy@theblackdirectory.app