Privacy policy
- We collect what Galli needs to work: your email to sign you in, your name, and your area so we can show you what is near you.
- We never sell your data, show you third-party adverts, or track you across other apps and websites.
- Your home address, personal phone number and email are never shown to other members or to businesses.
- You can delete your account, and everything in it, from the You tab at any time. It takes effect immediately.
- Our website only uses analytics cookies if you say yes. See Our website and cookies.
Who we are
Galli is operated by Plentiful CBD Ltd, a company registered in England and Wales (company number 12995725), registered office 78 Chorley New Road, Carlyle House, Bolton, Greater Manchester, BL1 4BY, United Kingdom. Plentiful CBD Ltd is the data controller for the personal data described here.
For anything about your data, email hello@ourgalli.co.uk. We aim to reply within a week and will always reply within one month, as the law requires.
What we collect, and why
When you join
| Data | Why we need it | Legal basis |
|---|---|---|
| Email address | To send your sign-in code. Galli has no passwords. | Contract |
| Name | Shown next to reviews you write, so members know a real person wrote them. | Contract |
| Address, town and postcode | To work out your area and show what is close to you. Never shown to anyone. | Contract |
| Mobile number (optional) | Account recovery only. Never shown to anyone. | Contract |
| Invite code you joined with | To give you and the person who invited you your referral points. | Contract |
| Email and location-offer preferences | To respect what you have told us you want. | Consent |
While you use Galli
| Data | Why we need it | Legal basis |
|---|---|---|
| Your device's location | Only when you allow it on your phone, to show businesses near you. Used on your device to sort the list; not stored against your account. | Consent |
| Reviews and vouches | Published on the business's page with your first name. That is the point of them. Each review is checked automatically before it appears (see Automated checks). | Contract |
| Check-ins | So a review you leave after visiting can show as a verified visit. | Contract |
| Reports you make about reviews | So we can look into them. The person you reported is never told who you are. | Legitimate interests (keeping Galli safe) |
| Notifications you are sent | So your in-app inbox shows them on any device you sign in on. | Contract |
| Push notification address, and your location when you turned notifications on | Only if you turn notifications on. The address lets us reach your device; the location lets us tell you about offers nearby. Turn notifications off and we stop. | Consent |
If you list a business
| Data | Why we need it | Legal basis |
|---|---|---|
| Business name, description, category, opening hours, offers, dietary options, booking link, website | Published on your listing. | Contract |
| Business address and map position | Published, so members can find you. If your listing covers a wide area rather than premises members visit, your street address is never published: members see only your postcode district, and your map pin is placed within about a kilometre rather than at your door. | Contract |
| Business phone | Published only if you choose to show it. | Contract |
| Personal phone | So we can reach you about your listing. Never published. | Contract |
| Photos | Published on your listing. Location and camera data are stripped out on your phone before a photo is ever uploaded. | Contract |
| Companies House number, food hygiene rating, trade registration | To check your business is real before it goes live. | Legitimate interests (a directory members can trust) |
What we count, without knowing who you are
We count how many times each listing is opened and how many times people tap to call, book or get directions, so businesses can see whether Galli is working for them. These are daily totals per listing. They do not record who you are, and a business cannot see which members looked at them.
Automated checks and writing help
We use an AI model from Anthropic for a few small jobs. It only ever receives the text described below, never your name, email address, phone number, home address or location, and Anthropic processes it on our behalf to send back a result. An automated check never makes a final decision against you on its own: where it has a doubt, a person at Galli decides.
- Checking reviews before they appear. When you post or edit a review, its text, its star rating and the business's name are checked for things that are never allowed, such as abuse, someone's personal details, adverts, or a review written in exchange for a reward. Most reviews appear straight away. If the check has a doubt, the review waits for a person at Galli to look at it; until then only you can see it. Honest criticism is always allowed.
- Suggesting what to write about. When you write a review, we may suggest topics to mention, based only on the business's own name, category and description. The words you post are your own.
- Reading new business listings. When a business applies, the listing's text is read to point out anything our team should look at before approving it. A person approves or declines every listing.
- Tidying a business description. Only when a business owner taps "Tidy this up": their draft description is sent to be polished, and they choose whether to use the result.
- Monthly summaries for businesses. Once a month, a business with enough reviews gets a short private summary of what customers said. It is written from the text and ratings of that month's published reviews, without reviewers' names, and only the business owner can see it.
If you think an automated check got something wrong, email hello@ourgalli.co.uk and a person will look at it.
What we never do
- Sell or rent your data to anyone.
- Show third-party adverts, or use advertising cookies. The app uses no analytics cookies; our website uses Google Analytics only if you accept it (see Our website and cookies).
- Track you across other apps or websites.
- Pay or reward anyone for writing reviews. Points come only from inviting people.
- Write reviews for anyone, or publish a review that a person has not written.
- Tell a business which members viewed or contacted them.
Who helps us run Galli
We use a small number of providers who process data on our behalf, under contracts that allow them to use it only to provide their service to us.
| Provider | What they do | What they receive | Where |
|---|---|---|---|
| Supabase | Our database, sign-in and photo storage | Everything stored in your account | Ireland (EU) |
| Netlify | Hosts the app and runs our server code | Your IP address and the requests your device makes | United States |
| Resend | Sends your sign-in codes | Your email address | United States |
| MapTiler and Esri | The map, and turning a business address into a map position | Your IP address, the area of map you are viewing, and addresses businesses enter | Switzerland; United States |
| postcodes.io | Looking up a postcode you type | The postcode | United Kingdom |
| Google Fonts and Fontshare | Typefaces used in the app | Your IP address | United States |
| Anthropic | The automated checks and writing help described above | The text of reviews and their star rating; business listing text; draft descriptions a business asks to tidy. Never your name, contact details or location | United States |
| Cloudflare | Hosts our website, yourgalli.co.uk | Your IP address and the requests your browser makes | Global network (United States company) |
| Google Analytics | Website analytics, only if you accept (see Our website and cookies) | How you use the website, your device and browser, and your approximate location. Your IP address is used to estimate the location and is not stored | United States; European Union |
| Companies House and the Food Standards Agency | Public registers we check businesses against | The business name or number searched | United Kingdom |
Where data goes outside the UK, we rely on the safeguards UK law provides for it, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework. If you use the iPhone app, Apple's own privacy policy also applies to the App Store and to notifications delivered through Apple's servers.
How long we keep it
- Your account and everything in it — until you delete your account.
- When you delete your account — your account, reviews, vouches, check-ins, notifications, and any business listings with their photos are removed immediately. If you joined through someone's invite, their record of the points they earned from it is kept, with your identity removed from it.
- Backups — deleted data can remain in our providers' routine backups for up to 30 days before those backups are overwritten.
- Server logs, which include IP addresses, are kept by our hosting providers for a short period for security and fault-finding.
- View and tap totals contain no personal data and are kept.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of the personal data we hold about you
- correct anything that is wrong — most of it you can change yourself in the app
- delete your data — you can do this yourself from the You tab, straight away
- restrict or object to how we use it
- give you your data in a format you can take elsewhere
- stop using your data where we rely on your consent — for email, turn it off in the app; for location and notifications, turn them off in your phone's settings
Email hello@ourgalli.co.uk. We may ask you to confirm it is really you before acting, so we never hand your data to someone else.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first.
Children
Galli is for people aged 13 and over. We do not knowingly collect data from anyone younger. If you believe a child under 13 has joined, email us and we will delete the account.
Your device
Galli stores a small amount of information on your device so that you stay signed in and your settings, such as your chosen area, are remembered. This is essential to how the app works and is not used for tracking. Signing out removes it.
Our website and cookies
This section covers our website, yourgalli.co.uk. The rest of this policy covers the Galli app.
| What | Why | Legal basis |
|---|---|---|
Google Analytics cookies (_ga and _ga_2RVKMD7XJ9), only if you accept | To see how people find and use the website: pages viewed, your device and browser, roughly where you are (town or city), how you found us, and which buttons you tap, such as "Open the app" or a category. They last up to two years, and we keep the data for no longer than 14 months. If you reject or ignore the banner, none of this happens. | Consent |
Your cookie choice (galli_consent, stored in your browser) | So we remember whether you accepted or rejected, and don't ask on every visit. Not used for tracking. | Essential |
| Your IP address and the requests your browser makes | Cloudflare needs these to deliver the website and protect it from attack. | Legitimate interests (running a secure website) |
You can change your mind at any time: open cookie settings, or use Cookie settings at the bottom of the homepage. If you withdraw consent, we stop using Google Analytics for you and remove its cookies from your browser.
Keeping your data safe
Data is encrypted in transit and at rest. Access to member data is enforced by the database itself, so one member's private details cannot be read by another, and the keys that bypass those rules are held only on our servers. No system is perfectly secure; if we ever discover a breach that puts you at risk, we will tell you and the ICO as the law requires.
Changes
If we change this policy we will update the date at the top. If a change affects how we use data you have already given us, we will tell you in the app before it takes effect.