Privacy policy

1. Data controller

ReviewTactic LLC
447 Sutter St, Ste 506-1210
San Francisco, CA 94108, United States
Email: hello@reviewtactic.com

We are the controller of your account, billing and website data. For data we process on our customers' behalf, such as reviews and reviewer names from a connected business profile, the customer is the controller and we act as their processor under our Data processing agreement.

2. What data we collect

When you use ReviewTactic, we collect and process the following data:

• Google account information: email address, name (via Google OAuth)
• Google Business Profile data: reviews, your replies, star ratings, business name, address, and performance metrics (impressions, clicks, direction requests)
• Usage data: pages visited, features used, session duration
• AI interaction logs: review text sent to AI models for reply generation, generated replies
• Payment information: processed by Stripe; we do not store card numbers
• Review removal data: if you use our Review Removal Service, we store case details (violation category, case strength, appeal status), your approval decisions, comments you provide, and any supporting documents you upload (images, PDFs)
• Chrome extension checks: the Google Maps listing you check, your IP address and, if you type it, your email address (see section 19)

3. How we use your data

• Generating AI-powered review replies
• Providing competitor benchmarks and analytics
• Publishing replies to your Google Business Profile on your behalf
• Sending transactional emails (account, billing, feature updates)
• Improving the service through anonymized analytics
• Analyzing reviews for policy violations and filing removal reports and appeals on your behalf (Review Removal Service)
• Checking a Google Maps listing you open in our Chrome extension for reviews that may break Google's rules, and following up with that business about the result (section 19)
• Preparing and logging journalist data requests made through our Data Desk: the form submission is stored by our hosting provider, Netlify (section 6), and emailed to our team; the request details are used only to prepare the data and log the case, are deleted with the case 12 months after delivery, and are never added to marketing lists; the aggregates we deliver contain no reviewer-level data

4. Legal basis (GDPR)

• Contract performance: processing your reviews and generating replies
• Consent: analytics cookies and website session recordings for visitors in Europe; the checks you run in our Chrome extension
• Legitimate interest: service improvement, website session recordings outside Europe, error monitoring, security, the daily limit on free checks and following up with a business about its check result

5. Google OAuth scope

We request the business.manage scope to read and reply to your Google Business Profile reviews. We do not access your Gmail, Google Drive, or any other Google service.

6. Third-party processors

These providers process personal data for us. We will announce a new provider on this page and on our trust page at least 30 days before it receives customer data.

7. AI and data processing

ReviewTactic uses third-party AI models (Anthropic Claude, Google Gemini, and OpenAI for text embeddings) via their commercial APIs to generate review replies, analytics insights, and intelligence reports. Your data is handled as follows:

• No model training: Your review data is never used to train AI models. Anthropic, Google and OpenAI each commit contractually that data sent through their commercial APIs is not used for model training or improvement.
• What is sent: review text and reviewer names that are already public on Google Maps or the review site, the business context you set (menu, FAQ, policies, tone), and the questions you type into the insight chat. We do not send payment details or passwords to AI providers.
• Processing, not storage: AI providers process your data in real time and do not retain it beyond the duration of the API request, except for brief abuse-monitoring windows as specified in their data processing agreements (typically up to 30 days).
• No shared context: Each AI request is independent. Your business data is never mixed with, or made available to, other ReviewTactic users or any third party.

For details on each provider's data handling, see Anthropic's privacy policy and Google's Gemini API terms.

8. Review Removal Service data

If you use our Review Removal Service, we collect and process the following additional data:

• Case data: violation category, case strength assessment, confidence scores, appeal status, and removal outcomes. This data is derived from analyzing your publicly visible Google reviews.
• Your decisions: which cases you approve or decline for submission, your comments and notes on each case, and your acceptance of terms.
• Supporting documents: images and PDFs you upload as evidence for your cases. These files are stored securely in encrypted cloud storage (Supabase Storage, London region) and are only accessible to you and our operations team. Files are retained for the duration of the case and deleted within 90 days after case resolution.
• How documents are used: your uploaded evidence is included in removal reports and appeals filed with Google on your behalf. Documents are never shared with any other party, used for marketing, or used for AI model training.

9. International data transfers

Our main database is hosted in London, United Kingdom, which the European Commission recognises as providing adequate protection. Several processors are located outside the European Economic Area and the UK, mostly in the United States (see section 6). For these transfers we rely on the following safeguards:

• Transfer mechanisms: the EU-US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses (with the UK Addendum for UK data) included in the provider's data processing agreement.
• Data Processing Agreements: We have accepted the data processing agreement of each processor listed in section 6.
• Encryption: All data transfers are encrypted in transit using TLS 1.2 or higher.

10. Data retention

We retain your data for as long as your account is active. If you delete your account, all associated data is permanently removed within 30 days. Inactive accounts (no login for 2 years) are subject to automatic deletion after a 30-day notification period.

11. Data deletion

You can delete your account and all associated data at any time from Settings → Delete Account in the app. This action is immediate and irreversible.

12. Your rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access: request a copy of your personal data
• Rectification: correct inaccurate personal data
• Erasure: request deletion of your personal data
• Restriction: restrict processing of your personal data
• Portability: receive your data in a machine-readable format
• Objection: object to processing based on legitimate interest
• Complaint: lodge a complaint with your local data protection supervisory authority

To exercise any of these rights, email hello@reviewtactic.com. We will respond within 30 days.

13. Your rights (CCPA)

If you are a California resident, you have the right under the California Consumer Privacy Act (CCPA/CPRA) to:

• Know what personal information we collect and how it is used
• Request deletion of your personal information
• Request correction of inaccurate personal information
• Opt out of the sale or sharing of your personal information
• Limit use of sensitive personal information
• Not be discriminated against for exercising your privacy rights

We do not sell or share personal information as defined under the CCPA/CPRA. We do not share personal data with third parties for their own marketing purposes or for cross-context behavioral advertising.

Categories of personal information collected (past 12 months)

How to submit a request

You may submit a CCPA request through either of the following methods:

• Email hello@reviewtactic.com with the subject line “CCPA Request”
• Use the contact form on our website

We will respond to verifiable consumer requests within 45 calendar days of receipt. If we need additional time, we will notify you of the extension (up to an additional 45 days) and explain the reason.

14. Automated decision-making

ReviewTactic uses AI models to generate review reply suggestions and analytics insights. This processing is not fully automated decision-making with legal effects:

• ReviewTactic drafts replies with AI. You control how they are published: manual approval for every reply (one by one or in bulk), automatic publishing for chosen star ratings, or full automatic publishing. You can change this at any time. You remain responsible for replies published from your account.
• No decisions with legal or similarly significant effects are made solely by automated processing.
• Analytics and scoring are informational tools to help you understand your review performance.

You have the right to request human review of any AI-generated output by contacting us at hello@reviewtactic.com.

15. Data breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms:

• We will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33.
• If the breach is likely to result in a high risk to your rights, we will notify affected individuals without undue delay via email.
• We maintain internal breach response procedures and will document all breaches regardless of whether notification is required.

16. Children’s privacy

Our Service is intended for business professionals and is not directed at individuals under 18 years of age. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA). If we become aware that we have collected personal information from a child, we will take steps to delete it promptly. If you believe a child has provided us with personal information, please contact us at hello@reviewtactic.com.

17. Cookies

• Essential cookies: Supabase authentication session (required for the app to work)
• Analytics cookies: PostHog product analytics, set only if you accept
• Session recording: Microsoft Clarity on our website. Visitors in Europe are asked first; elsewhere it runs from the first visit. You can reject it at any time, and Do Not Track or Global Privacy Control stops it. See the Cookie policy.

18. Text messages (SMS)

If you call, text or leave a voicemail on our US number, +1 (650) 457-6214, we may reply by text message about your request. If you tick “Text me account alerts” in your account settings or when you sign up, we also text the mobile number you give us about your account, including removed reviews, new low reviews, overdue invoices and messages from our team about your account. We use your mobile number and your messages only to answer your requests and to send those alerts, and we keep a record of when and where you turned alerts on. Our texts are sent through Twilio, which processes them for us.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are never shared with any third party.

Reply STOP to stop our texts at any time, or HELP for help. See the Terms of service for the full text message terms.

19. Chrome extension (Review Removal Tool for Google Maps™)

Our Chrome extension checks the Google Maps business listing you have open for negative reviews that may break Google's rules. It asks for your agreement before the first check and sends nothing until you agree.

What the extension sends us. Only when you click its icon on a Google Maps business listing, it sends the address (URL) of that Maps page. Our server also receives your IP address with the request. If you type your email address to get the full report, it sends that too. The extension reads no other pages, tabs or browsing history, adds no code to the pages you visit, and has no analytics or tracking. On your computer it keeps your agreement until you remove the extension, and the last results for 30 minutes, so reopening it does not check again.

What we do with it. Our server collects the listing's public Google reviews through the review data providers in section 6, analyzes the negative ones with Google's Gemini API and sends back the reviews that may break Google's rules. We keep the listing, the result and your IP address with the check. We use your IP address to allow a limited number of free checks per day and to stop abuse. Our team sees which listings were checked and their results, and may email the business about its result and our Review Removal Service. If you type your email address, we send the report to it. If you later ask us to file reviews, our team reads them to prepare each case (section 8).

What we never do. We do not sell this data, use it for advertising or credit decisions, share it with anyone other than the processors in section 6, or use it for any purpose other than the check and the follow-up described here.

ReviewTactic's use of information received from the Chrome extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

To have a check and its data deleted, email hello@reviewtactic.com. You can remove the extension at any time from Chrome's Extensions page; that also deletes what it stored on your computer. The extension is not affiliated with or endorsed by Google. Google Maps is a trademark of Google LLC.

20. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or an in-app notice. Continued use of the service after changes constitutes acceptance.

21. Contact

For privacy-related inquiries:
hello@reviewtactic.com
ReviewTactic LLC, 447 Sutter St, Ste 506-1210, San Francisco, CA 94108, United States