natterback Get started

Privacy Policy (UK)

Last updated: 18 October 2026

This policy explains how aufintools handles personal data when UK businesses use the Natterback website and service. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

Who we are

aufintools (“we”, “us”) operates Natterback and is the controller of the personal data described here. We are based in Australia. Contact: [email protected]. Website: natterback.com. More about us: aufintools.com.

Natterback helps UK trade businesses reply to Google reviews. We text you each new review with a draft reply, and you approve it by text or on our website.

What we collect

  • Sign-up: email address, mobile number, country and time zone, and a record of your consent to receive texts from us: when you gave it, the wording you agreed to, and that you confirmed your number with a code we texted you.
  • Product use: Google Business Profile connection details, the reviews on your profile (including reviewers’ names as shown on Google) and the replies you approve, billing details via Airwallex, and message delivery logs.
  • Free demo: the review text you paste in, and the email and mobile you give us. We don’t text demo contacts unless you sign up.
  • Website analytics: usage data via Google Analytics and PostHog (for example pages viewed, device type, and how you use forms and buttons). Our analytics don’t store your IP address. Our hosting and payment providers process IP addresses to deliver the site, protect it from abuse, and prevent fraud.
  • Communications: messages you send us, including text replies such as “yes” or your own wording.

How we use it, and our lawful basis

  • To provide the service you pay for (contract): set up your account, connect your Google Business Profile, draft replies, text them to you, and post the replies you approve.
  • To bill you and give support (contract, and legal obligation for tax records).
  • To keep the service secure and improve it (legitimate interests: running a reliable, safe service).
  • To process reviews and reviewers’ names (legitimate interests: helping you reply to reviews that customers have chosen to post publicly on Google). We only use this data to draft and post your replies.
  • To text you new reviews and drafts (consent, which you give at sign-up).
  • Website analytics (consent where cookies or similar technology require it).

Texts and PECR

We only text you after you’ve agreed and confirmed your number. We send drafts, reminders and account notices on weekdays between 9am and 5pm UK time, unless you’re texting us at that moment. You can opt out at any time by replying STOP, and opt back in by replying START. We record when you opt out and stop texting you straight away. Opting out of texts does not cancel your subscription. We never text your customers, and we do not sell your number.

Google Business Profile data

When you connect a Google Business Profile, we process review text and related listing data only to provide Natterback. Nothing is posted to Google without your explicit approval. When you disconnect Google at natterback.com/account, or your subscription ends, we revoke our access with Google and delete our copy of your access token.

Who we share it with

We use these service providers. They may only use your data to provide their services to us. We do not sell personal data.

  • Cloudflare: website hosting and security (global network).
  • Supabase: our database.
  • Twilio: text messages (USA).
  • Google: sign-in, your Business Profile, and AI drafting with Gemini.
  • DeepSeek: backup AI drafting, used only if Gemini is unavailable (China). It receives the review text, star rating, reviewer’s first name and business name, never your contact details.
  • Airwallex: payments. We do not store card numbers.
  • PostHog: product analytics (EU).
  • Google Analytics: website analytics.
  • Discord: internal alerts to our team (USA).

International transfers

We are based in Australia and some of our providers are in the USA, China and elsewhere, so your data is transferred outside the UK. Australia and China do not have a UK adequacy decision. Where a transfer needs safeguards, we rely on the UK International Data Transfer Agreement or Addendum, or on the UK-US Data Bridge for US providers certified under it. Email us for details of the safeguards for a particular provider.

How long we keep it

We keep account data while you subscribe and for as long as we need it for tax, accounting and legal reasons afterwards. Consent and opt-out records are kept so we can show we had permission to text you. You can ask us to delete your data at any time, and we will unless the law requires us to keep it.

Your rights

Under UK GDPR you have the right to access your data, correct it, have it deleted, restrict or object to how we use it, and receive a copy in a portable format. Where we rely on consent, you can withdraw it at any time. Email [email protected] and we will respond within one month.

If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk. We’d appreciate the chance to sort it out first.

Security

We take appropriate technical and organisational steps to protect personal data against loss, misuse and unauthorised access. Google access tokens are encrypted, and access to data is limited to people who need it to run the service.

Children

Natterback is for business owners and operators, not children.

Changes

We may update this policy. The “Last updated” date at the top will change when we do, and we will tell subscribers about significant changes.

Contact

Questions about privacy: [email protected].