Privacy policy

1. Data controller

ReviewTactic LLC
447 Sutter St, Ste 506-1210
San Francisco, CA 94108, United States
Email: hello@reviewtactic.com

2. What data we collect

When you use ReviewTactic, we collect and process the following data:

• Google account information: email address, name (via Google OAuth)
• Google Business Profile data: reviews, your replies, star ratings, business name, address, and performance metrics (impressions, clicks, direction requests)
• Usage data: pages visited, features used, session duration
• AI interaction logs: review text sent to AI models for reply generation, generated replies
• Payment information: processed by Stripe; we do not store card numbers

3. How we use your data

• Generating AI-powered review replies
• Providing competitor benchmarks and analytics
• Publishing replies to your Google Business Profile on your behalf
• Sending transactional emails (account, billing, feature updates)
• Improving the service through anonymized analytics

4. Legal basis (GDPR)

• Contract performance: processing your reviews and generating replies
• Consent: optional analytics cookies
• Legitimate interest: service improvement, security

5. Google OAuth scope

We request the business.manage scope to read and reply to your Google Business Profile reviews. We do not access your Gmail, Google Drive, or any other Google service.

6. Third-party processors

7. AI and data processing

ReviewTactic uses third-party AI models (Anthropic Claude, Google Gemini) via their commercial APIs to generate review replies, analytics insights, and intelligence reports. Your data is handled as follows:

• No model training: Your review data is never used to train AI models. Both Anthropic and Google contractually guarantee that data sent through their commercial APIs is not used for model training or improvement.
• Publicly available data only: The review text we process is already publicly visible on Google Maps. No private or personal customer data is transmitted to AI providers.
• Processing, not storage: AI providers process your data in real time and do not retain it beyond the duration of the API request, except for brief abuse-monitoring windows as specified in their data processing agreements (typically up to 30 days).
• No shared context: Each AI request is independent. Your business data is never mixed with, or made available to, other ReviewTactic users or any third party.

For details on each provider's data handling, see Anthropic's privacy policy and Google's Gemini API terms.

8. International data transfers

Some of our third-party processors are located in the United States (see section 6). When your data is transferred outside the European Economic Area (EEA), we rely on the following safeguards:

• Standard Contractual Clauses (SCCs): Our US-based processors (Anthropic, Google, Stripe, Resend, Netlify) operate under EU-approved Standard Contractual Clauses or equivalent transfer mechanisms.
• Data Processing Agreements: We maintain signed DPAs with each processor that include GDPR-compliant data protection obligations.
• Encryption: All data transfers are encrypted in transit using TLS 1.2 or higher.

9. Data retention

We retain your data for as long as your account is active. If you delete your account, all associated data is permanently removed within 30 days. Inactive accounts (no login for 2 years) are subject to automatic deletion after a 30-day notification period.

10. Data deletion

You can delete your account and all associated data at any time from Settings → Delete Account in the app. This action is immediate and irreversible.

11. Your rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access: request a copy of your personal data
• Rectification: correct inaccurate personal data
• Erasure: request deletion of your personal data
• Restriction: restrict processing of your personal data
• Portability: receive your data in a machine-readable format
• Objection: object to processing based on legitimate interest
• Complaint: lodge a complaint with your local data protection supervisory authority

To exercise any of these rights, email hello@reviewtactic.com. We will respond within 30 days.

12. Your rights (CCPA)

If you are a California resident, you have the right under the California Consumer Privacy Act (CCPA/CPRA) to:

• Know what personal information we collect and how it is used
• Request deletion of your personal information
• Request correction of inaccurate personal information
• Opt out of the sale or sharing of your personal information
• Limit use of sensitive personal information
• Not be discriminated against for exercising your privacy rights

We do not sell or share personal information as defined under the CCPA/CPRA. We do not share personal data with third parties for their own marketing purposes or for cross-context behavioral advertising.

Categories of personal information collected (past 12 months)

How to submit a request

You may submit a CCPA request through either of the following methods:

• Email hello@reviewtactic.com with the subject line “CCPA Request”
• Use the contact form on our website

We will respond to verifiable consumer requests within 45 calendar days of receipt. If we need additional time, we will notify you of the extension (up to an additional 45 days) and explain the reason.

13. Automated decision-making

ReviewTactic uses AI models to generate review reply suggestions and analytics insights. This processing is not fully automated decision-making with legal effects:

• AI-generated replies are suggestions only — you review and approve every reply before it is published.
• No decisions with legal or similarly significant effects are made solely by automated processing.
• Analytics and scoring are informational tools to help you understand your review performance.

You have the right to request human review of any AI-generated output by contacting us at hello@reviewtactic.com.

14. Data breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms:

• We will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33.
• If the breach is likely to result in a high risk to your rights, we will notify affected individuals without undue delay via email.
• We maintain internal breach response procedures and will document all breaches regardless of whether notification is required.

15. Children’s privacy

Our Service is intended for business professionals and is not directed at individuals under 18 years of age. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA). If we become aware that we have collected personal information from a child, we will take steps to delete it promptly. If you believe a child has provided us with personal information, please contact us at hello@reviewtactic.com.

16. Cookies

• Essential cookies: Supabase authentication session (required for the app to work)
• Analytics cookies: PostHog (opt-out available; see Cookie policy)

17. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or an in-app notice. Continued use of the service after changes constitutes acceptance.

18. Contact

For privacy-related inquiries:
hello@reviewtactic.com
ReviewTactic LLC, 447 Sutter St, Ste 506-1210, San Francisco, CA 94108, United States