Privacy Policy

1. Introduction

MasterGuest Ltd ("MasterGuest", "we", "us", "our") runs a mystery-guest platform: businesses ("Clients") commission visits to their venues ("Venues") and vetted individuals ("Reviewers") carry them out and report back. This policy explains what personal data we collect through https://masterguest.app and the MasterGuest reviewer app (together, the "Service"), why, who we share it with and what rights you have.

We are the data controller for the personal data described here. We are a private limited company registered in England and Wales under company number 13769991, with our registered office at Red Lion, The Green, Shamley Green, Guildford, GU5 0UB, and we process personal data in accordance with the UK GDPR and the Data Protection Act 2018. You can contact us about anything in this policy at jamie@masterguest.co.uk.

Our Terms of Service govern your use of the Service and use the same defined terms as this policy.

2. The data we collect

Account data. Your name, email address and a password, which we store only in hashed form. If you change your email address we keep a record of the pending change until it is verified.

Reviewer profile data. Your Reviewer rating and any temporary boosts to it, your notification preference, the Reviews you request, the invitations you receive and how you respond to them, and any feedback you send us about the platform.

Application data. When you apply to review we ask for your date of birth (Reviewers must be 18 or over), the countries you are willing to review in, whether you work or have worked in hospitality and, if so, your role and current or most recent employer, how you heard about us, and anything else you choose to tell us. We also ask for a link to your LinkedIn profile or a copy of your CV, or both. Our team reads these to decide whether to approve your application, and records that decision together with a private note. Reviewers who joined before the application existed are asked for the same facts, minus the LinkedIn profile or CV, the next time they sign in.

Review content. Everything you enter when carrying out a Review: your answers, ratings, comments, timings, the amount you spent, the date and time of your visit, reservation details, and any photographs or receipts you upload. Photographs are resized on your device before upload. Review content may also include names or descriptions of Venue staff you encountered, which the Review asks for so that a Client can recognise good service.

Client and organisation data. For people who use the Service on behalf of a Client: your name and email address, the organisation you belong to and your role in it, and the Venues, review templates and question libraries your organisation sets up, including the addresses of Venues and the email addresses that should receive completed reports.

Device and notification data. If you enable push notifications in the reviewer app, the push token that identifies your device, and the platform it runs on.

Usage and technical data. The pages and screens you visit, when you are signed in, the IP address, browser or device type, operating system and language your device reports, and diagnostic information about errors. While you are signed in, the Service records which screen you are on so that our team can see who is active and offer help; this is kept for 24 hours.

Correspondence. Anything you send us by email or through the Service, including requests to delete your account.

Location. The reviewer app and the web browse map may ask for permission to use your device's location to show Venues near you and how far away they are. Your location is used on your device only and is not sent to our servers.

We do not collect payment card details. Reimbursement is arranged through a passphrase or voucher for the Venue, or by a method agreed with you outside the Service.

3. Where the data comes from

Most of the data above comes directly from you. Some comes from other sources:

• a Client may add your name and email address to its organisation, which sends you an invitation;
• our team creates and adjusts Reviewer ratings and adds corrections, scores and a short summary when auditing a Report;
• the Service generates usage and technical data automatically as you use it.

4. Why we use it and our lawful basis

Purpose	Data	Lawful basis
Creating and securing your account, verifying your email, signing you in	Account data, technical data	Performance of a contract
Deciding whether to approve a Reviewer's application, and offering Reviews only in the countries they have chosen	Application data	Steps taken at your request before entering a contract; our legitimate interest in vetting the people who visit our Clients' Venues
Offering Reviews to Reviewers, managing requests, invitations and assignments	Reviewer profile data, application data	Performance of a contract; our legitimate interest in matching the right Reviewer to each visit
Carrying out, auditing, scoring and delivering Reports to Clients	Review content, account data	Performance of a contract; our and the Client's legitimate interest in an accurate assessment
Arranging reimbursement and checking spend against receipts	Review content	Performance of a contract
Sending emails and push notifications needed to run the Service: verification, invitations, reminders, nudges, audit outcomes and account notices	Account, device data	Performance of a contract
Emailing Reviewers when new Reviews are available	Account data	Our legitimate interest in filling visits; you can opt out at any time
Drafting the short summary that accompanies a delivered Report	Review content, with the Reviewer's identity removed	Our legitimate interest in producing clear reports efficiently; our team reviews and edits every draft
Seeing who is using the Service and where, to support users and run operations	Usage data	Our legitimate interest in running the Service
Detecting and preventing fraud, abuse and security incidents	All categories	Our legitimate interest in a trustworthy Service; legal obligation
Producing statistics and benchmarks and improving the Service	Aggregated or anonymised data	Our legitimate interest in improving the Service
Responding to your requests and complying with law	Correspondence, and whatever else is relevant	Legal obligation; legitimate interest

Where we rely on legitimate interests we have considered the effect on you and concluded that our processing is proportionate. You can ask us for more detail at any time.

Reviewer ratings. We use your rating to decide which Reviews you can see and to prioritise invitations. Ratings are set and adjusted by our team, who consider the timeliness and quality of your Reports; we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

5. Who we share it with

Clients and Venues. A Client receives the Reports commissioned for its Venues, including photographs, receipts and any staff names the Report records. A Reviewer's identity is never disclosed to a Client or Venue. Reports are delivered without the Reviewer's name, email address or rating, and our systems withhold those fields from every Client-facing view. Clients are contractually prohibited from attempting to identify Reviewers.

Our service providers. We use a small number of companies to run the Service. They process data only on our instructions and under contracts that protect it:

• Convex hosts our database and stores uploaded files such as photographs, receipts and finished reports.
• Vercel hosts the website.
• Resend delivers our emails.
• Expo, together with Apple and Google's notification services, delivers push notifications to the reviewer app.
• Vercel AI Gateway and Anthropic provide the AI model that drafts the summary accompanying a Report. The draft is generated from the Report's content only; the Reviewer's name and details are not included.
• Google provides the address lookup our team uses when adding a Venue.
• OpenFreeMap serves the map tiles on the browse map; your browser or app requests tiles from it directly, so it receives your IP address when you view the map.

Others. We may share personal data with our professional advisers, with a purchaser or successor if our business is sold or reorganised, and with courts, regulators or law enforcement where the law requires or permits it.

We do not sell personal data and we do not share it with third parties for their own marketing.

6. International transfers

We are based in the United Kingdom. Several of the providers listed above are established in the United States and process data there. Where personal data leaves the UK we rely on the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as applicable, so that it remains protected to UK standards. You can ask us for a copy of the relevant safeguard.

7. How long we keep it

• Account and profile data is kept while your account is open. If you ask us to close your account we remove your name, email address, password and profile within 30 days.
• Reports are a record of a commissioned visit that the Client has paid for, so the content of a submitted Report, including photographs and receipts, is retained for as long as the Client's engagement and our legal obligations require. When a Reviewer's account is closed, their Reports are detached from them and attributed to an anonymous "Former reviewer" record; nothing in the retained Report identifies them.
• Open Reviews, invitations and requests connected to a closed account are withdrawn.
• Application data is kept while your account is open, because it is part of your Reviewer profile. If your application is declined, a CV you uploaded is deleted 90 days after the decision; your LinkedIn link and answers are kept with the account so that a later decision can be made. Closing your account deletes the application and any CV with it.
• Emails we have sent are logged by our email provider for a limited period so that we can resolve delivery problems.
• Presence data (which screen you are on) is kept for 24 hours.
• Marketing preferences. If you unsubscribe from availability emails we keep a record of that so we honour it.
• Backups are retained for a limited period and overwritten in the ordinary course.

8. Security

Data is encrypted in transit. Passwords are stored as salted hashes. Access to personal data within MasterGuest is limited to the people who need it to run the Service, and Client accounts can only see the data for their own organisation. No system is perfectly secure, so we cannot guarantee the security of information you send us, and you should keep your password confidential and tell us if you think it has been compromised.

9. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• rectify data that is inaccurate or incomplete (you can change your name, email address and notification preference in your profile);
• erase your data in certain circumstances, including when you close your account;
• restrict or object to our processing where we rely on legitimate interests;
• portability: receive the data you gave us in a structured, machine-readable format;
• withdraw consent at any time where we rely on it, for example by turning off push notifications on your device;
• opt out of availability emails using the unsubscribe link in any such email or the setting in your profile.

To exercise any of these rights, email jamie@masterguest.co.uk from the address on your account. We may ask you to confirm your identity and will respond within one month. Some rights are limited where the data is needed to fulfil a contract with a Client or to comply with a legal obligation; where that is the case we will explain.

If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office at https://ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.

10. Cookies and local storage

The Service uses only cookies and local storage that are strictly necessary to run it, so it does not show a cookie banner:

• Session cookies keep you signed in and protect against cross-site request forgery. They are set when you sign in and removed when you sign out or they expire.
• Preference storage remembers settings such as your light or dark theme, in your browser's local storage.
• The reviewer app stores your session in the device's secure storage and remembers whether it has already asked you about notifications.

We do not use analytics, advertising or tracking cookies, and we do not track you across other websites. You can clear cookies and local storage through your browser settings; if you do, you will need to sign in again.

11. Children

The Service is for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, contact us and we will remove it.

12. Links to other sites

The Service may link to websites we do not operate. This policy does not cover them, and we encourage you to read their privacy policies.

13. Changes to this policy

We may update this policy from time to time. We will post the current version here and update the date at the top. If a change materially affects how we use your personal data we will tell you by email or through a notice in the Service before it takes effect.

14. Contact

Questions, requests and complaints about personal data to jamie@masterguest.co.uk.