Privacy Policy — ReviewFlow

Last updated: May 9, 2026

This Privacy Policy describes how ReviewFlow ("we", "us") collects, uses, and protects information when you use our Service.

Important: This is a starting template. Update it to reflect your actual data practices, your data controller details, and any jurisdiction-specific requirements (e.g. CCPA, LGPD).

What we collect

Account information: name, email address, password (hashed), workspace name.
Customer reviews: review text, ratings, reviewer names, and timestamps fetched from connected platforms.
Contact lists: names, email addresses, and phone numbers you upload for review-request campaigns.
Usage data: pages visited, features used, IP address, browser type, and approximate location.
Payment data: processed exclusively by Stripe — we never see or store your card number.

How we use it

To operate the Service: sync reviews, send campaigns, generate AI replies, render widgets.
To provide support and respond to your questions.
To send transactional email (account, billing, security).
To send product updates if you have opted in.
To improve the Service in aggregate, anonymized form.

We do not sell your personal data or your customers' data to third parties.

Data sharing

We share data only with the third-party services required to operate the Service (Google, Facebook, OpenAI, Stripe, your email provider, etc.) and only the minimum necessary to perform their function.

Data retention

We retain your account data for as long as your workspace is active and for 90 days after deletion to allow recovery. Anonymized usage data may be retained indefinitely.

Your rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data. See our GDPR Notice for details.

Security

We use industry-standard security practices: TLS in transit, AES-256 at rest for OAuth tokens, scoped database access, and regular backups. No system is perfectly secure.

Children

The Service is not intended for users under 16. We do not knowingly collect data from children.

Contact

To exercise your rights or raise concerns, contact the support email listed in your dashboard settings.