Privacy Policy

Business Owners: If you create an account, you provide business and contact information so we can provide the Service.

End Users: When someone scans a business’s QR code and submits feedback, that feedback is processed to deliver it to the relevant business owner.

Controller/Processor: In many cases, the business owner is the “controller” of End User feedback data, and ReviewRelay acts as a “processor” providing the Service. This can vary by law and context.

Account and business profile data: such as your name, business name, email address, phone number, and service settings (e.g., custom messaging and links).

Billing data: Stripe processes payment information. We may store billing-related identifiers (such as Stripe customer/subscription IDs) and billing status.

Customer feedback: star rating, feedback text, and optional contact details (e.g., name and phone) if an End User chooses to provide them.

Usage and device data: such as timestamps, pages viewed, feature usage, and basic device/browser information used for security and analytics of core product usage.

We use information for purposes including:

• Providing and maintaining the Service (authentication, dashboard, QR generation, feedback delivery).
• Sending operational communications (e.g., feedback notifications, account updates, billing alerts).
• Customer support and troubleshooting.
• Security, abuse prevention, and fraud detection.
• Improving features and performance.
• Complying with legal obligations and enforcing our Terms.

Depending on your location, data protection laws may require a lawful basis for processing. Where applicable, we rely on bases such as:

• Contract: to provide the Service you request.
• Legitimate interests: to secure, maintain, and improve the Service.
• Consent: where required for certain communications or choices (for example, End Users choosing to provide contact info).
• Legal obligation: to comply with applicable laws.

We do not sell personal information.

We may share information with:

• Service providers (subprocessors): such as Supabase (database/auth), Stripe (billing), Resend (email delivery), and Vercel (hosting/infrastructure).
• Legal and safety: if required to comply with law, respond to valid legal requests, protect rights and safety, investigate fraud, or enforce our Terms.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.

We retain information only as long as necessary for the purposes described in this policy, including to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.

Customer feedback retention: Feedback may be automatically deleted after a set retention period (for example, 90 days) depending on your configuration and product policies.

Backups: Residual copies may persist for a limited time in backup systems for security and disaster recovery purposes.

We use reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, loss, misuse, or alteration.

No method of transmission or storage is 100% secure. You are responsible for protecting your credentials and using strong passwords.

We use essential cookies and similar technologies to keep you signed in and enable core Service functionality.

We do not run third-party advertising cookies on the Service. If we introduce additional analytics or tracking technologies in the future, we will update this policy and, where required, provide choices.

Our service providers may process data in different countries. Where required, we take steps designed to provide appropriate safeguards for cross-border transfers.

Depending on your location, you may have rights such as access, correction, deletion, portability, and objection/restriction to certain processing.

To exercise rights, contact us using the details below. We may verify your identity before responding.

End Users: If you are an End User, your request may need to be directed to the business that displayed the QR code, since they control how feedback is used.

The Service is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided information through the Service, contact us so we can take appropriate steps.

We may update this Privacy Policy from time to time. If we make material changes, we may notify you through the Service, by email, or by updating the “Last updated” date above.

Your continued use of the Service after the effective date of changes constitutes acceptance of the updated policy.

For questions about this Privacy Policy or to exercise your rights, contact us at support@reviewrelay.io.