Privacy notice

Last updated: 14 October 2026

1. Who we are

"Rivet Builds" is a trading name of Jeremy Steel, a sole trader. It is not a limited company and has no company number. Jeremy Steel is the "controller" of the personal data described here, which means he decides why and how it is used.

We build enquiry tools for the websites of trade and service businesses. This notice explains how we handle personal data when we contact businesses to tell them about that work (business-to-business marketing).

Contact for anything about your data, or to opt out:

• Email: jeremy@rivetbuilds.com
• Phone: +44 7907 310458

Data protection fee: registered with the ICO, registration number ZC270399.

2. Who this notice is for

People at UK businesses that we contact, or are considering contacting, about our work. In practice that means the person who reads a business inbox such as info@, a named person whose work email address we hold, and a director or owner of the business whose name is on the public record.

We only send marketing email to incorporated businesses (for example limited companies and LLPs), at an address on the business's own website domain. We do not send marketing email to sole traders, ordinary partnerships, or people at personal webmail addresses such as gmail.com or outlook.com.

3. What personal data we hold

For each business we hold a record containing some or all of:

• the business name, website, address and general business phone number;
• a business email address (for example info@company.co.uk, or firstname@company.co.uk);
• where we have it, the name and role of a person at the business (taken from the business's own website, or from the names of current directors on the Companies House register);
• public company information (company number and status);
• public facts about the business that we note so our message is relevant, for example its Google rating and number of reviews, what trade it is in, and whether its website has an enquiry form;
• our own notes: what we sent you, the date, whether you replied and what you said, and whether you asked us to stop;
• if the link tracking described in section 6 applies: a record of when a link in an email we sent was clicked;
• where an email shows a quote from one of your business's public Google reviews: the reviewer's initials only, not their name (section 12a).

We do not collect special category data (such as health, race, religion or politics). We do not collect information about the private lives of the people involved.

4. Where we got it

Because we did not collect your details from you directly, the law requires us to tell you where they came from. They came from these sources:

1. The business's own website, including its contact and about pages.
2. The business's public Google Maps / Google Business Profile listing. We collect this using a service called Apify (see section 7).
3. The Companies House public register (company status, registered details, and the names and roles of current directors).

If you replied to us or spoke to us, we also hold what you told us.

5. Why we use it, and our lawful basis

We use these details to decide which businesses might benefit from our work, and to send a small number of emails, written for each business and sent by hand by Jeremy, offering a free demo or a free tool. Each email is prepared from a template with details about your business filled in, with help from an AI assistant, and is read and sent by a person. We rank businesses using public facts (for example review count and website features) to choose whom to write to first. No decision with legal or similarly significant effect is made about anyone by automated means.

We also keep your business phone number so that we do not ring a number on the Telephone Preference Service (TPS) or Corporate TPS register, and so that we can ring businesses that are not on those registers.

Our lawful basis under UK GDPR is legitimate interests (Article 6(1)(f)). Our interest is telling businesses that are likely to benefit about a product that helps them. We have written down why we think that is fair to you, using the ICO's three-part test (purpose, necessity, balancing) in a legitimate interests assessment, which you can ask to see. Our reasons in short: we use the minimum data, the details were published to invite business contact, volume is low, every email is read and sent by a person, and you can say no at any time.

Under the Privacy and Electronic Communications Regulations (PECR), emailing a company (a corporate subscriber) does not need prior consent, but we must identify ourselves honestly and give you an easy way to opt out in every message. We do both.

6. The tracked links in our emails

Some links in our emails go through our own server first, so that we can see whether they were clicked: the link to a demo walkthrough, and the picture of your website with our reviews widget drawn on it, which opens a page showing the widget working. Every email also carries a plain link to this notice, which is not tracked. This section says exactly what a tracked link does.

We do not use a tracking image

Our emails contain no invisible "tracking pixel", so we do not record when an email is opened. We have never sent an email containing one.

What a tracked link records

A tracked link goes through t.rivetbuilds.com first. If you click it we record:

• the internal record number of your business in our system;
• a short code saying which email it was (so two emails to the same business stay apart);
• the first 200 characters of the "user agent" text your browser sends (usually the name and version of the software and the operating system);
• the date and time.

We then send you straight on to the page on demos.rivetbuilds.com (the demo, or the reviews widget page). Where you land is not stored.

What we do not record

Our system does not store your IP address, your location, or the contents of your inbox. The link sets no cookies and runs no scripts on your device. (The page you land on after clicking is a separate page that you choose to visit; see "Page views on our demo pages" below.) The web address is signed so it cannot be altered, and it cannot be used to send you anywhere other than our own demo pages.

One caveat about web hosting

The click has to reach a web server, and our server is run by our hosting provider, Vercel (section 7). Like any web host, Vercel handles technical request data such as IP addresses in order to deliver the page, and may keep it in its own logs for up to 30 days. We do not store it and do not use it.

What it tells us, and what it does not

It tells us roughly whether a link was clicked. It is not reliable: some security scanners click links as soon as an email is delivered. Nothing in our system sends you further emails automatically because of a click, and the counts are used to judge whether our emails are any good. We do not use the click record for any one business to decide whom to contact next; the data is used only in aggregate.

Page views on our demo pages

The pages on demos.rivetbuilds.com count visits with Vercel Web Analytics. It uses no cookies and does not store your IP address. Each page view records the page, the site you came from, your approximate location (country, region and city), and your device type, operating system and browser. A visitor is recognised only within one day, by a temporary code made from the request, which Vercel discards after 24 hours. We see these figures only as totals; they are not joined to the click records above or to any business.

Why

To find out whether the demo or the widget is of interest, so that we send fewer and better emails. We rely on legitimate interests for the personal data involved.

How to avoid it

We do not ask you to opt in before the link is tracked. We tell you about it here, and you can avoid it:

• Do not click a tracked link. Type the address into your browser instead (demos.rivetbuilds.com for the demos, demos.rivetbuilds.com/reviews-widget for the widget page), or reply and we will send you the direct address.
• Ask us not to measure you. Reply to any email, or write to jeremy@rivetbuilds.com, and say so. We will add you to our suppression list and stop emailing you, which ends all tracking for you.

7. Who we share it with

We do not sell your data, and we do not give it to anyone for their own marketing. We use these service providers, who handle it only to provide their service to us:

We also receive information from Companies House and Google, as described in section 4. Companies House is a public register and is not a service provider. We may disclose data where the law requires it, for example to the ICO or a court.

8. Transfers outside the UK

Some of these providers are based in, or process data in, the United States or the European Economic Area; our database (Neon) runs in Virginia and our Vercel functions in Washington DC, both in the United States. Where data leaves the UK we rely on the UK's adequacy arrangements for the EEA, or on the provider's UK data transfer safeguards (the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement or Addendum), which are part of their standard terms; each provider listed above (Google, Vercel, Neon, Apify, Anthropic and Visian Systems) relies on one of these. You can ask us for more detail.

9. How long we keep it

• Business contact details, if you do not reply: deleted within 6 months of our last contact, unless we are in an active conversation.
• Tracking records (clicks): deleted at the same time as the business record, and in any case within 6 months of the email being sent.
• Backups: when a record is deleted as set out above, any backup copy of it is itself deleted within a further 30 days.
• If you reply or become a customer: kept for as long as the relationship continues, and for up to 6 years afterwards, for our records.
• If you ask us to stop, or an email to you bounces: we keep a minimal do-not-contact record, your email address or phone number and the date, on our suppression list, so we never contact you again. This is kept for as long as we do any marketing, because deleting it would defeat the purpose.

10. Your rights

Under UK data protection law you have the right to: be told what we do with your data (this notice); get a copy of it; have mistakes corrected; have it erased; restrict how we use it; object to how we use it; and, in some cases, take it with you (portability). These rights are not always absolute, but some are strong in this setting:

• You can object to direct marketing at any time and we must stop. We do not need a reason.
• You can object to our use of legitimate interests for other things. We will stop unless we have compelling grounds.

To opt out or object: reply to any of our emails with "unsubscribe" (or "stop"), or email jeremy@rivetbuilds.com. We will stop contacting you and add you to the suppression list. Please give us the address you were contacted on.

To use any other right, email jeremy@rivetbuilds.com. We will answer within one month.

11. How to complain

Please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:

• Website: https://ico.org.uk/make-a-complaint/
• Helpline: 0303 123 1113

12. Our website

Our website rivetbuilds.com uses Vercel Web Analytics to count page views. It sets no cookies and stores no IP address, and it cannot follow you to other websites: each visit is counted with an anonymous code that is discarded within 24 hours. Its hosting provider keeps ordinary technical logs (section 7).

12a. Google reviews shown in an image we prepare for your business

If we send you an image showing one of your business's real public Google reviews, the following applies.

• Whose data. The reviews were written by members of the public. A review can identify a person (their display name, profile photo, or what they wrote). These people are not our contacts and have not been told by us individually; this section is how we inform them.
• What we take and keep. The star rating, the date and the text of selected public reviews of your business, and the reviewer's initials only (for example "S. W.", or "S." for a single name), worked out from the display name Google shows next to the review. We do not store the reviewer's full name, profile photo, profile link or any other detail about them. The full name is turned into initials as soon as it reaches us and is not written down anywhere on our side. Where Google gives no usable name, the image says "Google review" instead.
• What the image shows. One review, with its text, its date and those initials. It does not show names or photos.
• Where from. Your business's public Google Maps listing, collected through Apify (section 7). Apify handles the full display name while the collection runs, as described in section 7.
• Why and lawful basis. To show a business, as a free sample, what a reviews widget on its own site would look like with its own reviews. Legitimate interests (Article 6(1)(f)). We keep to a short extract of a review that is already public, the image goes only to the business reviewed, and we show initials, not names.
• How long. The image, the review text and the initials kept for it are deleted with the business record (section 9).
• If you wrote a review and want it removed from our records, email jeremy@rivetbuilds.com with the business name and we will delete it. You can also edit or delete your review on Google, which does not remove a copy already held by us, so please tell us.

13. Changes to this notice

We will change this notice if what we do changes. The "last updated" date at the top says when. We will not make it say we do less than we do.