Privacy Policy

ReviewBoost is a review management platform for local businesses. It helps you ask customers for reviews, collect the reviews left on your Google Business Profile, reply to them, and track your rating over time.

The service is operated by ReviewBoost (Address pending — update before launch), who acts as the data controller for the account data described below. You can reach us at any time at privacy@reviewboost.com.

This policy explains what we collect, why we collect it, who we share it with, and the choices you have. It applies to our website, the web dashboard and the mobile apps.

Account information. Your name, email address and an encrypted password when you sign up. If you sign in with a third-party provider, we receive your name and email from that provider instead of a password.

Business information. The name, address, phone number and website of the business you manage, plus your plan and billing status.

Customer contacts you upload. The names, email addresses, phone numbers and tags of the customers you want to ask for reviews — whether typed in one by one or imported from a CSV file. See section 8 for how this data is treated.

Google Business Profile data. When you connect your Google account, we access the data described in section 3.

Review request activity. When a request was sent, over which channel, whether the recipient opened the link and whether they clicked through to the review form. We use this to show you delivery status and to stop chasing people who already responded.

Technical data. IP address, browser and device type, pages visited and timestamps, recorded in server logs for security, debugging and abuse prevention.

We do not collect payment card details. When paid plans launch, card data will be handled entirely by our payment processor and never touches our servers.

Connecting your Google Business Profile is optional, and you can disconnect it at any time from Settings. When you do connect it, you grant the following scopes:

We store the reviews imported from your locations (reviewer display name, star rating, review text, timestamps and any reply) together with the OAuth tokens needed to keep the connection alive. Tokens are encrypted at rest and are never exposed to the browser.

We use this data for exactly one purpose: to run the features you can see in the dashboard — showing your reviews, alerting you to new ones, suggesting a reply, and publishing the reply you approve.

One transfer you should know about. When you ask for an AI-suggested reply, the reviewer's first name, the star rating and the review text are sent to OpenAI to generate that suggestion. Nothing else is sent, the transfer only happens when you press the button, and it exists solely to power a feature that is visible in the dashboard. If you would rather nothing leaves our systems, simply don't use the suggestion button — you can always write replies yourself.

Disconnecting Google revokes our access immediately and deletes the stored tokens. Reviews already imported stay in your dashboard until you delete your account or ask us to remove them.

We use the data described above to:

• Create and secure your account, and keep you signed in.
• Send the review requests you compose, over the channel you pick.
• Import your Google reviews on a schedule and publish your replies.
• Notify you about new reviews, in the app and — if you leave the setting on — by email.
• Show you aggregate statistics such as average rating, response rate and requests sent.
• Enforce plan limits, prevent abuse, and investigate security incidents.
• Answer your support messages.

We do not sell your personal data, and we do not use it to build advertising profiles.

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR:

• Contract — processing your account, business and review data is necessary to provide the service you signed up for.
• Consent — connecting your Google account, and optional email notifications. You can withdraw consent at any time.
• Legitimate interests — security logging, abuse prevention and improving the product, balanced against your rights.
• Legal obligation — retaining records where the law requires it.

We share data only with the service providers needed to operate the product. Each one is bound by a data processing agreement and may only use the data to provide their service to us.

We may also disclose data if we are legally required to, or to protect the rights, safety and property of ReviewBoost, our users or the public. If the business is ever sold or merged, your data may transfer to the acquirer — we will tell you before that happens and you will be able to delete your account first.

• Account and business data — for as long as your account is open, then deleted within 30 days of closure.
• Contacts and review requests — until you delete them, or 30 days after account closure.
• Imported reviews — until you disconnect Google and ask us to remove them, or 30 days after account closure.
• OAuth tokens — deleted immediately when you disconnect the integration.
• Server logs — up to 90 days, then rotated out.
• Records we must keep by law (for example invoices) — for the period the applicable law requires.

For the contacts you upload, you are the data controller and ReviewBoost is a processor acting on your instructions. We only use those contacts to deliver the messages you ask us to send.

By uploading contacts you confirm that:

• You have a lawful basis to contact those people about your business.
• You will honour their requests to stop being contacted, and to have their data corrected or deleted.
• You will comply with the marketing and messaging rules that apply where you and your customers are located.

If one of your customers contacts us directly about their data, we will point them to you and help you respond.

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and withdraw consent you previously gave. Exercising these rights never costs you anything and never results in worse service.

Most of this you can do yourself from Settings. For anything else, email privacy@reviewboost.com and we will respond within 30 days. If you are in the EEA or UK and you think we have handled your data badly, you can also complain to your local data protection authority.

We do not sell or share personal information as those terms are defined under California law, so there is nothing to opt out of.

All traffic runs over TLS. Data is encrypted at rest by our hosting providers, and OAuth tokens are additionally encrypted before storage. Every database table enforces row-level security, so one account can never read another account's rows even if application code has a bug.

Access to production systems is limited to the people who need it and protected by multi-factor authentication. No system is perfectly secure, but if a breach ever affects your personal data we will notify you and the relevant authority as required by law.

We keep cookies to the minimum needed to run the product:

• Session cookies — keep you signed in. Without these the dashboard cannot work.
• Security cookies — a CSRF token that prevents other sites from acting on your behalf.
• Preference storage — your light or dark theme choice, stored locally in your browser.

We do not use advertising cookies or third-party tracking pixels. As all of the above is strictly necessary or stored on your own device, no consent banner is required.

Some of our providers process data in the United States. Where data leaves the EEA or UK, the transfer is covered by the European Commission's Standard Contractual Clauses or another approved safeguard, together with the technical measures described in section 10.

ReviewBoost is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy as the product evolves. The effective date at the top always reflects the current version. If a change materially affects how we use your data, we will tell you by email or with a notice in the dashboard before it takes effect.

Questions about this policy or about your data go to privacy@reviewboost.com, or through the contact form.

ReviewBoost
Address pending — update before launch