Privacy Policy
Visibility Group Limited · Version 1.0
1. Who we are
Acclaimedly (acclaimedly.com) is run by Visibility Group Limited ("we", "us"), a company incorporated in Hong Kong [TBC: company number], of Unit 2904, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong. We decide how and why your personal information is used, so we are its controller (in Hong Kong, its "data user").
| Contact | |
|---|---|
| Privacy questions and requests | [privacy@acclaimedly.com TBC], or Account › Privacy |
| Data protection officer | [TBC: name or firm, and contact] |
| EU representative (GDPR Art. 27) | [TBC] |
| UK representative (UK GDPR Art. 27) | [TBC] |
2. The short version
- A profile on Acclaimedly is meant to be public and quotable: that is what it is for. Everything that is not the profile is treated the other way round.
- No advertising. Nothing about you is sold, or shared with anyone for advertising.
- No analytics or advertising cookies, and no third-party tracking script on any page.
- We do not record which pages you read. Profile visits are counted as a number per profile per day.
- If you choose the face check to verify your identity, a face template is kept under a separate notice and consent: the Biometric Information Notice.
3. What we collect, why, and our legal basis
"Legal basis" applies under GDPR, UK GDPR and laws modelled on them. The bases are:
- Contract: needed to provide the service you signed up for (Art. 6(1)(b)).
- Legitimate interests: ours or someone else's, balanced against yours (Art. 6(1)(f)). You may object (section 10).
- Consent: you may withdraw it at any time (Art. 6(1)(a), and Art. 9(2)(a) for biometrics).
- Legal obligation (Art. 6(1)(c)).
3.1 If you have an account
| What | Details | Why | Legal basis |
|---|---|---|---|
| Account | Name, email address and profile picture, as given to us by Google when you sign in; when you last signed in; your email preferences. We never see a password. | To run your account and contact you about it | Contract |
| Identity verification: face check | A face template held by Amazon Web Services for us; a reference number linking it to your account; a record of your consent | Confirm you are a real person, and keep each person to one account | Explicit consent. See the Biometric Information Notice |
| Identity verification: photo ID | The result of the check, the document type, issuing country and expiry date, and a one-way code made from the document number. The document image is deleted after the check | Same as above | Legitimate interests (keeping the platform free of fake and duplicate accounts). |
| Your profiles | Whatever you enter: name, headline, description, job title, location, services, products, opening hours, staff, languages, social profiles, website, and phone and email if you choose to show them | To publish your profile | Contract |
| Images | Portraits, logos, banners and photos you upload. Each is reviewed by a person before it is shown | To publish your profile | Contract |
| Credentials and proof | Credentials you list, and the documents you upload as proof. Proof documents are stored privately and never published | To verify the credential before it shows | Contract |
| Recommendations you write | What you wrote, who it is about, your relationship to them, and when. Published under your name, with your profile picture | To publish it. A named recommendation is the point of the service | Contract |
| Recommendation requests | The name and email of the people you ask, and your message to them | To send your request | Contract (yours); legitimate interests (theirs, see 3.2) |
| Contact messages | Messages you send or receive through a profile's contact form: your name and email, the message and when it was sent | To pass the message on, and to deal with misuse | Contract; legitimate interests (safety) |
| Reports and moderation | Reports you make, and our decisions about content or accounts | To enforce our rules and meet our legal duties | Legitimate interests; legal obligation |
| Payments | Which plan you have, and the Stripe customer and subscription references. Card details go directly to Stripe and are never seen or stored by us | To bill you | Contract; legal obligation (tax records) |
| Award orders | The name and delivery address for a physical award | To deliver it | Contract |
| Account activity | A record of significant actions on your account, such as plan changes, profile publication and claims | Security, support and resolving disputes | Legitimate interests |
| Fraud prevention | When you sign in, write a recommendation or accept an invitation: the country you connect from and a one-way, salted fingerprint of your network address (never the address itself) | Spotting fake recommendations and abuse of referral rewards; a person reviews anything it suggests, and it is never used to decide anything about you automatically | Legitimate interests |
| Messages with our team | Support and concierge conversations | To help you | Contract |
3.2 If you do not have an account
| What | Details | Why | Legal basis |
|---|---|---|---|
| You were invited by a member, to write a recommendation, join a business's staff list or join an agency | Your name and email, as given by the member, and whether you opened or declined | To send the invitation, and to stop us sending another if you decline | Legitimate interests of the member and of us. Each invitation tells you who gave us your address and how to stop further emails |
| You were named in a recommendation or on a profile | Whatever the member wrote | Hosting the member's content | Legitimate interests (the member's freedom of expression). You can ask for removal (section 10) |
| You contacted us through a press, investor or general enquiry form | Your name, email, organisation and message | To reply | Legitimate interests |
| You asked us to stop emailing you | Your email address, kept on a do-not-send list | To make sure we never email you again | Legal obligation; legitimate interests |
| You visited the site | See 3.3 |
3.3 Everyone who visits
| What | Details | Kept |
|---|---|---|
| Visit counts | A count per profile per day. Not who, not from where | As a daily count |
| Searches | The words typed, the filters used and the number of results, with no link to an account, address or session | Unattributed |
| Rate limiting | A truncated, salted one-way hash of your network address, to stop anyone flooding a form. The address itself is never stored | 1 day |
| Errors | When a page fails: the fault, the address and technical detail. Personal information can occasionally appear in this | Until the fault is dealt with |
| Hosting logs | Our host, Vercel, processes your network address and browser details to serve the page and protect it from attack | Per Vercel's own retention |
| Cookies | Only those needed for sign-in and features you use. See the Cookie Policy |
We do not collect:
- information about your race, religion, health, politics or sex life (the face template in 3.1 is our only special-category data)
- your precise location
- your contacts, from Google or anywhere else
4. Where it comes from
- From you: what you enter or upload.
- From Google: your name, email and picture, when you sign in.
- From AWS: the result of a face check, and a face template.
- From [ID provider TBC]: the result of a photo ID check.
- From other members: recommendations about you, invitations, staff listings.
- From public sources: follower counts for social accounts you link to your profile, read from the platform's public data (through SociaVault for Instagram, TikTok and YouTube, and directly for Bluesky); whether your website links are flagged as unsafe (Google Web Risk and Cloudflare's security DNS).
5. What is public
These are shown to anyone:
- your published profile
- recommendations you have written and received
- your approved images
They may also be read by search engines and AI answer engines, quoted elsewhere, and served through our public API and structured data. Once something has been public, we cannot recall copies others have already made. That is why each profile field tells you whether it will be public before you save it.
6. Who we share it with
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
We share it only:
- with service providers who process it for us, under contract, and only to provide their service. The full list is in the Sub-processor Disclosure. The main ones are:
- Supabase (database and file storage, on AWS in the United States)
- Vercel (hosting)
- Amazon Web Services (face check)
- Resend (email)
- Stripe (payments)
- Google (sign-in, and checking links)
- [ID provider TBC]
- with other members where the service requires it. For example, when you send a contact message, the recipient receives your name, email address and message so they can reply. A business sees the staff it has invited.
- with professional advisers, auditors and insurers, under confidentiality.
- where the law requires it, or to establish, exercise or defend legal claims. We give a poster's identity only to a court order, a regulator with power to require it, or with the poster's consent (see the Notice and Takedown Procedure).
- to a buyer or successor of Acclaimedly. This policy would continue to apply, and we would tell you first.
7. How long we keep it
In summary:
- Your profiles, recommendations and account: until you delete them or close your account. Closure is offered with a 30-day pause, or done at once if you choose.
- The text of contact messages: erased after 90 days.
- Face templates: as set out in the Biometric Information Notice. Never more than 24 months after your last interaction.
- Billing records: 7 years, because Hong Kong tax law requires it.
- Backups: up to 14 days after deletion from the live system.
The periods for biometric information, with how it is destroyed, are published in our Data Retention and Destruction Schedule. The schedule for every other category is available on request.
8. How we protect it
- Encryption in transit everywhere, and at rest in our database and file storage.
- Database row-level security, so each account can reach only its own private data.
- Private storage for proof documents.
- Staff access only through named accounts, with admin actions logged.
- Card data never on our systems.
- Face templates never in our database.
No system is perfectly secure. If a breach puts you at risk, we will tell you and the regulators as the law requires. Under GDPR and UK GDPR that means the regulator within 72 hours.
9. International transfers
We are based in Hong Kong. Our database, hosting and face check are in the United States. Some providers process data elsewhere (see the Sub-processor Disclosure).
Where the law of your country restricts transfers, we use:
- the EU Standard Contractual Clauses and the UK International Data Transfer Addendum in our providers' data processing agreements
- the EU–US Data Privacy Framework and UK Extension, where a provider is certified
- the Swiss–US DPF, for Switzerland
Ask us for a copy of the safeguards that apply to you.
10. Your rights
Wherever you live, and whether or not you have an account, you can ask us to:
- see the personal information we hold about you, and get a copy in a portable format
- correct it
- delete it
- object to our using it on the basis of legitimate interests, or restrict how we use it while a question is resolved
- withdraw consent where we rely on it, including for the face check, without affecting what we did before
- stop all emails from us. Every email has a link for this
Some of these rights are limited by law. For example, we may keep billing records we are required to keep. We may also keep content where removing it would override another member's freedom of expression and there is no overriding reason to remove it. In that case we tell you why.
If you never signed up: you have the same rights. Write to [privacy@acclaimedly.com TBC] with your email address or a link to the content that names you. We will search every place a non-member's details can be held (see the Data Subject Requests procedure) and tell you what we found.
How to ask:
- Account › Privacy (members), or [privacy@acclaimedly.com TBC] (anyone).
- We may need to confirm your identity, and will ask only for what we need to do so.
- We reply within one month, or 45 days where US state law applies. Where the law allows we may extend that, and if so we will tell you why.
- We do not charge, unless a request is clearly unfounded or excessive.
- Someone can make a request for you if they show they are authorised.
We will never treat you differently for using your rights.
Complaints: please tell us first. You can also complain to the privacy regulator where you live, work or think the problem happened. They are listed in the regional sections below.
11. Children
Acclaimedly is for adults. You must be 18 or over to have an account. We do not knowingly collect information from anyone under 18. If we learn we have, we delete it.
12. Hong Kong
- We comply with the Personal Data (Privacy) Ordinance (Cap. 486) and its six Data Protection Principles. This policy is our Personal Information Collection Statement and our privacy policy statement under DPP1 and DPP5.
- Supplying personal data is voluntary. Without the account information in section 3.1 we cannot provide an account.
- Direct marketing: we do not use your personal data for direct marketing, and we do not provide it to anyone for theirs. If that ever changes, we will first get your consent in the way Part VIA of the Ordinance requires.
- Access and correction requests: you may make one under sections 18 and 22. We may charge a fee that is not excessive for an access request. Write to our Data Protection Officer at the address in section 1.
- Regulator: Office of the Privacy Commissioner for Personal Data, pcpd.org.hk.
13. European Economic Area, United Kingdom and Switzerland
- Controller: Visibility Group Limited. Our EU representative and UK representative are listed in section 1. You can contact them instead of us.
- Our legal bases are given for each purpose in section 3.
- Automated decisions: we make none that have legal or similarly significant effects on you. A possible duplicate found by the face check is always decided by a person.
- Data portability: applies to what you gave us, which we process on the basis of contract or consent.
- Your regulator: the supervisory authority where you live. In the UK this is the Information Commissioner's Office (ico.org.uk), and in Switzerland the FDPIC.
- Swiss users: the revised Federal Act on Data Protection applies on the same terms.
14. United States
14.1 California and other state privacy laws
Notice at collection. In the past 12 months:
| CCPA category | Collected? | Examples | Disclosed for a business purpose to |
|---|---|---|---|
| Identifiers | Yes | Name, email, account ID, hashed network address | Service providers |
| Customer records (Cal. Civ. Code 1798.80) | Yes | Name, delivery address, phone (if you add it) | Service providers |
| Commercial information | Yes | Plan and purchase history | Stripe |
| Biometric information | Yes, if you choose the face check | Face template | AWS |
| Internet activity | Limited | Errors, rate-limit hashes. Not browsing history | Service providers |
| Professional or employment information | Yes | Job title, employer, credentials | Public, by your choice |
| Inferences | No | ||
| Precise geolocation | No | ||
| Sensitive personal information | Yes: account sign-in data; biometric data (face check); government ID information (photo ID result) | Used only to provide the service and verify identity (Cal. Code Regs. tit. 11 §7027(m)). So there is no "right to limit" link, because we never use it for anything else |
- Sold or shared: none. We do not sell or share personal information, including that of anyone under 16, and we have not done so in the past 12 months.
- Global Privacy Control: we honour GPC signals. Because we neither sell nor share, a GPC signal changes nothing about how we process your data, but we record it.
- Your rights: to know, delete, correct, and opt out of sale or sharing (which we do not do), and not to be discriminated against for using them. Use the methods in section 10. For a request to know, delete or correct, we will verify you by your account email, or for a non-member, by email confirmation to the address you give.
- Appeals: in Colorado, Connecticut, Virginia and other states that provide for them. If we refuse your request, reply to our decision to appeal. A different person will decide within 45 days (60 in Colorado). If you are still unhappy, you can contact your state Attorney General.
- Metrics: if we become subject to the CCPA's reporting duty, we will publish request statistics here.
14.2 Biometric information: Illinois, Texas, Washington, Colorado and elsewhere
See the Biometric Information Notice. It is our publicly available retention schedule and destruction policy under 740 ILCS 14/15(a), and our biometric policy under C.R.S. 6-1-1314.
14.3 Washington and Nevada consumer health data
See Part C of the Biometric Notice.
15. Australia
- We comply with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
- Overseas disclosure (APP 8): your information is held in the United States and processed by the providers in the Sub-processor Disclosure. We take reasonable steps to ensure they handle it consistently with the APPs.
- Anonymity (APP 2): you can read Acclaimedly without an account. You cannot write a recommendation anonymously, because that would defeat its purpose.
- Complaints: write to us first. We will respond within 30 days. If you are not satisfied, contact the Office of the Australian Information Commissioner (oaic.gov.au).
- Automated decisions: we do not use computer programs to make decisions that significantly affect your rights or interests. The disclosure required by APP 1.7–1.9 from December 2026 is satisfied by section 13's statement on automated decisions.
16. Canada
- We comply with PIPEDA and, for Quebec, Law 25. Quebec: the face check is not offered until we have notified the Commission d'accès à l'information; Quebec users verify with photo ID. Our person in charge of the protection of personal information is the DPO named in section 1.
- Regulator: the Office of the Privacy Commissioner of Canada, or the CAI in Quebec.
17. Other countries
Where your country's law gives you rights beyond those in section 10, you have them too. Contact us in the same way. This includes:
- Brazil (LGPD): regulator ANPD
- Japan (APPI): regulator PPC
- South Korea (PIPA): regulator PIPC
- Singapore (PDPA): regulator PDPC
- New Zealand (Privacy Act 2020): regulator the Privacy Commissioner
- Mainland China (PIPL).
- South Africa (POPIA): regulator the Information Regulator
- UAE, Saudi Arabia, Israel, Turkey and others
18. Changes
We will tell you by email and on this page before a material change takes effect. Previous versions are kept at [/legal/privacy/history TBC].
Version history: 1.0 — 18 October 2026.