Privacy notice

Aboveboard ("we", "us") provides an Ad Safety & Conversion Scan for UK businesses in regulated and high-scrutiny sectors. The data controller is Thumb Stop Ltd (trading as Aboveboard), company number 17549283, registered office 22 Slipps Close, Frome, BA11 1FW. We take your privacy seriously: the work we do involves your commercial materials and we treat them accordingly. This notice explains what we collect, how we use it, and how long we keep it.

What you give us

• Booking details, practice name, practice website and optional Facebook page. Your email is normally collected by Stripe at payment; for a referral booking we collect it before payment to check that it is not a self-referral, then pass it to Stripe. We use it to match your booking and provide account access.
• Payment, card details are entered directly into Stripe and never reach our servers. From Stripe we receive and store the payment status, amount, and the transaction, customer and session references needed to match your payment to your booking.
• Your uploaded assets, screenshots, PDFs, recordings, and landing-page URLs you send via the private upload link after payment.

Where it lives

Your booking record sits in a small, access-controlled database used only to run this service. Uploaded files are held in private, access-controlled cloud storage, visible only to your reviewer, never public, until you ask us to delete them.

What we will never do

• Share your ads, materials, or contact details with anyone beyond the sub-processors listed below that run this service.
• Use your materials to train AI models. Our AI drafting provider is contractually barred from training on API data, see its data-usage policies.
• Run analytics, heatmaps, or trackers on uploaded files.
• Sell, swap or rent your details for marketing.

How long we keep it

• Uploaded files: kept in private storage until you ask us to delete them. Ask us at any time and we will delete them as soon as reasonably possible.
• Booking record (name, email, invoice reference): retained for 6 years for UK tax / accounting purposes.

If we contacted you first

We email limited companies and LLPs about the ads they are running. We use business contact details the practice publishes (its website, its Google listing), its live ads from the Google Ads Transparency Center and the Meta Ad Library, and company details from Companies House. Our lawful basis is legitimate interests: telling a business about a risk in its own public advertising. We don't buy lists.

Links in emails we send to businesses include a reference, so we can see which email led to a visit and which pages were viewed. We don't use cookies for this.

To stop hearing from us, reply "no thanks" or email hello@above-board.co.uk and we won't contact you again. Outreach records are deleted 12 months after our last contact unless you become a client.

Your rights (UK GDPR)

You can ask us to confirm what we hold, correct it, delete it, or send you a copy, at any time. Email hello@above-board.co.uk and we will respond within one month, as UK GDPR requires. You can also complain to the ICO at ico.org.uk.

Sub-processors we use

• Stripe, card payments. Subject to Stripe's own privacy policy.
• Lovable Cloud, database and encrypted file storage for the booking + upload flow.
• Email provider, to send your report and any service emails.
• Airtable, our client and outreach records.
• Google Workspace / Gmail, email.
• Apify, collecting your live ads from the public ad libraries and fetching your public website pages for review.
• AI drafting provider (OpenAI, via Lovable's AI gateway), reading captured ad images and public pages to produce the first draft of your report. A person checks every report before release.
• Google Analytics, measuring public-page visits and booking steps only after you accept analytics cookies. We do not send names, emails, practice details or private-account activity.
• Trustpilot, collecting and displaying customer reviews, subject to its own privacy notice.

Cookies

We use Google Analytics only if you choose Accept in the cookie banner. Analytics is denied by default, and Google Analytics is not loaded before you accept. Its _ga cookies distinguish visits and help us understand public-page use and booking steps. We do not enable advertising features or track private account or report pages. Reject keeps analytics off. You can change your choice through Cookie settings in any public-page footer; rejecting later removes our Google Analytics cookies. We remember your choice in your browser. Strictly necessary payment and sign-in storage may still be used to provide those services.

Contact

hello@above-board.co.uk