Privacy Policy

1. Who we are

RevReviews (“RevReviews”, “we”, “us”) is a service for managing Google Business Profile reviews. It is operated by [company legal name], [registration number], of [registered address] (the “company”). The company is responsible for the personal data described in this policy, except where it acts for a business that uses RevReviews (see section 11).

You can contact us about privacy at [privacy contact email]. Our contact person for personal data matters is [name or title].

2. What this policy covers

This policy applies to our website at revreviews.io, the RevReviews application, and the early access programme. It explains what personal data we collect, why we collect it, who we share it with, how long we keep it and what choices you have.

3. Information we collect

Early access requests

When you use our early access form we collect your name, email address, business or agency name, whether you are a business or an agency, and your consent to be contacted.

Your account

When you are invited to or create an account we collect your name, email address, password (stored only in hashed form), role, the workspaces you belong to, and sign-in records such as time and IP address.

Google Business Profile data

When you choose “Connect Google” and approve access, we receive information about the business locations you manage, the reviews on them (including the reviewer’s public display name, star rating, comment and date), replies already posted, and basic performance figures that Google provides. We also receive the access tokens that let us act on your behalf. We ask only for the Business Profile permission, business.manage.

Customer contact details you give us

If you use features that send review requests, such as WhatsApp messages, you may give us the name or phone number of your customers. We process those details only on your instructions (see section 11).

Technical information

We keep server logs and security records, including IP address, browser type, pages requested and error details. We use only cookies that are needed to sign you in and keep the service secure [and a privacy-friendly analytics tool — confirm]. We do not use advertising cookies.

Payments

[If paid plans are introduced: payments are handled by a payment provider and we do not store card numbers.]

4. How we use information

• To provide the service: show your reviews, draft replies, run the approval queue, post approved replies and produce reports.
• To manage accounts, invitations, workspaces and permissions.
• To keep the service secure, prevent abuse and keep an audit log of sign-ins, changes and approvals.
• To reply to your enquiries and, with your consent, tell you about early access and product updates.
• To meet legal duties and to establish or defend legal claims.

We do not sell personal data and we do not use it for advertising.

5. Google user data

RevReviews’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice this means:

• We use Google user data only to provide and improve the user-facing features you see in RevReviews, such as showing reviews, drafting and posting replies, and producing reports.
• We do not sell Google user data and we do not use it for advertising, including retargeting or interest-based advertising.
• We do not transfer Google user data to others except to provide or improve these features, to comply with law, for security or abuse investigation, or as part of a merger or sale where you are told first.
• We do not allow people to read Google user data unless you give clear consent for specific items, it is needed for security or abuse investigation, the law requires it, or the data is aggregated and anonymised for internal operations.
• We do not use Google user data to develop, improve or train general artificial intelligence or machine learning models.

You can disconnect Google from RevReviews at any time inside the app, and you can also remove our access from your Google Account at myaccount.google.com/permissions. When you disconnect, we stop reading your profile and delete the stored access tokens.

6. AI-drafted replies

To write a draft reply, the text of a review and basic details such as the business name and star rating are sent to an artificial intelligence service provider that works for us. The provider may use this information only to produce the draft for us. [Confirm: our provider settings do not allow your data to be used to train their models.] Drafts are suggestions only. A person approves each reply before it is posted, except where a workspace has chosen automatic posting for 4 and 5 star reviews. Reviews flagged for escalation never receive an automatic reply.

7. Who we share information with

• Google, when you connect your profile and when a reply is posted on your behalf.
• Service providers that host the service, deliver email, provide AI drafting and, if you use it, send WhatsApp messages: [list providers and their regions].
• Your workspace. People you invite to a workspace can see that workspace’s reviews and drafts according to their role. Agencies can see the workspaces of their clients.
• Professional advisers and authorities where we are required or permitted by law.

We require service providers to protect personal data and to use it only for the services they perform for us.

8. Storage and transfers outside your country

Our systems are hosted in [hosting country or region]. Your data may therefore be processed outside Malaysia or Singapore. Where that happens we take steps to make sure it receives a standard of protection comparable to the Malaysian and Singaporean data protection laws.

9. How long we keep information

We keep personal data for as long as your account or workspace is active. After a workspace is closed we delete or anonymise its data within [90 days], except for records we must keep by law or to settle a dispute. Early access requests are kept for up to [12 months] if you are not invited. Audit log entries are kept for [period] so that we can show who did what.

10. Security

We use technical and organisational measures that are suitable for the data we hold. These include keeping every client’s workspace separate, giving each person only the access their role needs, keeping an audit log, and using private report links that expire. No online service is completely secure. If a data breach is likely to cause you significant harm, we will notify you and the authorities as the law requires.

11. Reviewers and customers of our clients

When a business or agency uses RevReviews, it decides what is done with the reviews and customer details in its workspace. For that data the business is responsible for the data and we act as its service provider, processing it on its instructions. If you wrote a review or received a review request from a business that uses RevReviews, please contact that business first about your data. You can also contact us and we will help you reach the right party.

12. Your rights

Under the Malaysia Personal Data Protection Act 2010 and the Singapore Personal Data Protection Act 2012 you may:

• ask for access to the personal data we hold about you;
• ask us to correct personal data that is wrong or out of date;
• withdraw your consent to our use of your data, or ask us to limit it (this may mean we can no longer provide some or all of the service);
• ask us to stop sending you marketing messages.

To use these rights, write to [privacy contact email]. We may need to confirm who you are first. We will reply within the time the law allows, which is generally 21 days in Malaysia and 30 days in Singapore. We may charge a reasonable fee for an access request where the law permits. If you are unhappy with our answer, you can complain to the Personal Data Protection Commissioner in Malaysia or the Personal Data Protection Commission in Singapore.

13. Cookies

We use only cookies that are strictly needed to sign you in and protect the service. [If analytics is added, describe it here and add a consent choice.] You can block cookies in your browser, but you may not be able to sign in.

14. Children

RevReviews is for businesses and their staff. It is not meant for anyone under 18 and we do not knowingly collect data from children.

15. Changes to this policy

We may update this policy as the service changes. We will change the date above and, if the change is important, tell account holders by email or inside the app.

16. Contact

[Company legal name]
[Registered address]
[Privacy contact email]

A Bahasa Malaysia version of this notice is [available at this link — to be added before launch].