Privacy Policy
Last updated: 17 August 2026
Who we are
Trey is operated by Matthew Kazantzis, a sole trader trading as Trey, and is the data controller for the processing described in this policy except where stated otherwise below.
| Postal address | 52 Ravenscroft Drive, Derby, DE21 6NX, United Kingdom |
|---|---|
| info@trey.today | |
| Phone | +44 7941 052034 |
| ICO registration | Registered with the Information Commissioner’s Office, reference ZC225001. |
The three groups of people this covers
Trey processes personal data about three different groups, and the rules differ for each. This policy is written in that order.
- Trey customers — businesses that subscribe to Trey.
- Reviewers — people who leave public Google reviews for those businesses.
- Prospective customers — businesses we may approach about Trey, whose details we obtained from public sources rather than from them.
1. If you are a Trey customer
What we collect: your name, business name, WhatsApp number, email address, business address, business type, your Google Business Profile identifiers, your reply preferences and brand voice notes, tap activity from your stand, and billing information handled directly by Stripe (we never see or store your card details).
| Why | Lawful basis |
|---|---|
| To provide the service you signed up for — alerts, drafted replies, reports, your stand | Performance of a contract |
| To take payment and handle refunds and cancellations | Performance of a contract |
| To keep accounting and tax records | Legal obligation |
| To tell you about changes to the service you use | Legitimate interests — you need to know about changes to something you pay for |
How long: while you are a subscriber, and for 12 months afterwards in case you come back. Accounting records are kept for 6 years as tax law requires. Say the word and we will delete everything not legally required, sooner.
2. If you left a Google review
When a business uses Trey, we read the public reviews on their Google Business Profile — the reviewer name, star rating, review text and date, exactly as already visible to anyone on Google. We use it to draft a reply for that business to approve, and to show them simple statistics.
For this data the business is the controller and Trey is their processor. We act on their instructions, we do not decide what happens to it, and it is governed by the data processing terms in our Terms. If you want your data removed, the quickest route is to delete or edit your review on Google, which removes it from Trey too. You may also contact us and we will pass the request to the business.
An AI drafts the reply, but a human always approves it. No reply is ever published automatically, and no decision with legal or similarly significant effect is made about you by automated means.
How long: reviews are refreshed from Google rather than archived. A short quotation from a review may be retained where it forms part of a business record; it is deleted on request.
3. If we have approached you about Trey
We keep a list of businesses that might benefit from Trey. We did not get these details from you, so UK GDPR requires us to tell you where they came from.
| What we hold | Business name, category, address, business phone number, business email where published, website, Google rating and review count, how often the owner replies to reviews, and sometimes a short quotation from a recent public review. |
|---|---|
| Where it came from | Publicly available Google Maps business listings, collected via Apify, and the Google Places API. Occasionally from a conversation in person. |
| Why | To decide which businesses to approach, and to have a relevant conversation when we do. |
| Lawful basis | Legitimate interests — promoting a business service to other businesses. We have weighed this against your interests: the data is business contact information already published by you, we hold very little of it, we do not profile individuals, and you can object at any time and we will stop. |
| How long | Until you ask us to stop, or until we conclude you are not interested. If you opt out we keep the minimum needed — usually just your phone number — solely to make sure we do not contact you again. |
Separately from data protection, electronic marketing is governed by PECR. We do not send marketing emails, texts or WhatsApp messages to sole traders or partnerships without consent. We screen against opt-out requests, every message identifies Trey and tells you how to stop, and replying STOP to any WhatsApp message removes you immediately and permanently.
To be removed from the list entirely, email info@trey.today and say so. No explanation needed and no questions asked.
Google user data and API services
Trey uses Google APIs — including the Google Business Profile API and the Google Places API — to read your public review data and to post the replies you approve. Trey's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Our use of information obtained through Google Maps and Places services is additionally governed by the Google Maps Platform Terms of Service and the Google Privacy Policy. We use Google user data only to provide the features described above. We do not sell it, use it for advertising, transfer it to others except as needed to provide the Service, or allow humans to read it, except where you have consented, where it is necessary for security or to comply with the law, or in a limited way to operate and support the Service. You can disconnect Trey at any time by removing us as a manager on your Google Business Profile, and on request or when you close your account we delete the Google Business Profile data we hold for you. Map coordinates obtained from Google are deleted within 30 days, as Google's terms require.
What we never do
- We do not sell, rent or trade anyone's data to any third party
- We do not build marketing lists for anyone else
- We do not use your business data or your reviewers' data to train AI models
- We do not run advertising or tracking on this site
Who we share data with
| Service | What it's used for | Where |
|---|---|---|
| Google (incl. Gemini) | Reading public review data, drafting reply suggestions, posting approved replies, maps | US / global |
| Twilio | Delivering WhatsApp alerts and reports | US / global |
| Netlify | Hosting Trey and storing your data | US / global |
| Stripe | Taking subscription payments | US / global |
| Resend | Sending service emails | US / global |
| Apify | Collecting public business listings for the prospect list | EU / global |
None of these providers may use the data for their own purposes beyond providing their service to Trey.
Sending data outside the UK
Several of the providers above are based in, or store data in, the United States and other countries outside the UK. Where that happens we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the provider is certified under it. Copies of the safeguards are available on request.
Your rights
Under UK GDPR you have the right to:
- ask what personal data we hold about you, and get a copy
- have inaccurate data corrected
- have your data deleted
- restrict how we use it
- receive it in a portable format
- object to processing based on legitimate interests — including everything in section 3 above
- withdraw consent at any time, where we relied on consent
Email info@trey.today. We will respond within one month, free of charge. We may ask you to confirm who you are first, so we do not hand your data to someone else.
If you are unhappy with how we handle your data
Please tell us first — info@trey.today — and we will try to put it right. You also have the right to complain to the UK's data protection regulator at any time, and you do not have to speak to us before doing so:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint
Security
Data is stored encrypted with our hosting provider and reached only over HTTPS. Access to the administration tools is protected by a secret token. Links we send you are signed, so only the person holding the link can open the page it points to — treat those links as you would a password.
Cookies
Trey sets no advertising or analytics cookies and does not track you across other websites. The administration pages store a sign-in token in your own browser so you are not asked for it repeatedly; nothing is shared with anyone.
Changes to this policy
Material changes will be communicated by WhatsApp or email before they take effect, and the date at the top will change.
Contact
Matthew Kazantzis, trading as Trey
info@trey.today · +44 7941 052034