Privacy Policy

Two different kinds of people's data pass through ReviewEngine, and this policy covers both:

• Tenants — the business that signs up, pays for, and logs into ReviewEngine. If you're reading this as someone with a ReviewEngine account, you're a tenant.
• End-customers — the tenant's own customers, whose name/phone/email a tenant sends us so we can send them a review request on the tenant's behalf. An end-customer never creates a ReviewEngine account and never logs in.

For end-customer data, the tenant is the data controller (they decide whose data to send us and why) and ReviewEngine acts as a data processor on the tenant's behalf. See Your rights for what that means practically if you're an end-customer trying to exercise a right over your own data.

End-customer data

Name, phone number, and/or email address. Collected however a tenant chooses to add you:

• a CSV spreadsheet the tenant uploads,
• the tenant (or their team) typing you in one at a time after a job,
• a public "quick-add" link or QR code the tenant shares with staff, or
• an automated integration the tenant connects — our webhook API, or a Zapier/Make connector built on top of it.

We also record a consent timestamp at the moment you're added, and engagement state on the review-request messages we send you (whether a message was sent, whether you clicked the link, whether you left a review) — this exists purely so we don't message you twice for the same step.

We currently only ever message you by email. A phone number may be collected (a tenant might have it for their own records, or it may be required by their CRM export), but as of this writing ReviewEngine has no SMS sending capability — a phone-only contact with no email on file is never actually messaged.

Tenant data

• Business name.
• Team member accounts: name, email, a bcrypt-hashed password (we never see or store your plaintext password), role (owner or member), and permissions.
• Sender identity — the "from" email address your review requests send from.
• Billing status (plan, subscription status, trial dates, billing interval) — see Who we share it with for what we do and don't receive from our payment processor.
• If you connect a Google Business Profile: an OAuth access/refresh token (encrypted at rest), your GBP location ID, and the review link we use to build review requests.
• If you generate a webhook API key: we store only a hash of it, never the plaintext key itself, after the moment it's shown to you once.

End-customer data is used for exactly one purpose: sending you the review request(s) a tenant's campaign is configured to send, and knowing not to send you a step you've already been sent or already acted on. We do not use it for our own marketing, we do not sell it, and — this is a permanent product constraint, not a preference — there is no code path that sends you a different message or link based on how happy you are. Every end-customer of a given tenant gets the same review link.

Tenant data is used to operate the product for you: authenticate you, run your review campaigns, process billing, check your message templates for compliance with Google's review policies before they can be sent, provide support, and maintain security/audit logs of account activity.

We don't sell your data or anyone else's. We share data with a small set of sub-processors, each doing one specific job:

NEEDS LEGAL REVIEW — this table previously listed Lemon Squeezy as our payment sub-processor. That integration has been removed while we switch payment providers — no payment processor is currently live. Add the new processor's row back here (with an accurate purpose/data description for however it actually collects and stores payment info) before re-enabling paid subscriptions.

We may also disclose data if legally required to (a court order or valid legal process), or to protect the rights, property, or safety of ReviewEngine, our tenants, or the public.

Plainly, and matching what the product actually does today: we don't automatically delete data when a trial ends or a subscription lapses. If your 7-day trial expires (or a subscription is canceled), your account and all its data — contacts, templates, campaign history, reviews — stay fully visible to you. What changes is that you can't send new review requests until you subscribe; nothing already in your account is touched or removed.

Beyond that, we don't currently run any automatic, scheduled deletion of tenant or end-customer data. Data is kept for as long as your account exists, unless you ask us to delete specific data or close your account (see Your rights).

NEEDS LEGAL REVIEW — there is no self-service "delete my account" or automated data-retention/purge pipeline built into the product yet — today, a deletion request is fulfilled manually by us on request, not by clicking a button in Settings. That's an honest description of the current product, not a hypothetical gap. Before this policy is relied on, counsel should confirm whether a stated retention period and/or a self-service deletion flow is required for the jurisdictions you operate in (GDPR's right to erasure expects this to be actionable "without undue delay"), and a commitment should only be made here that the product can actually keep.

Depending on where you're located, you may have rights to access, correct, export, or delete your data, and to object to or restrict certain processing (this is standard under GDPR/UK GDPR for EU/UK residents, and under the CCPA/CPRA for California residents — see International transfer below).

If you're a tenant

You can update your business name and sender identity directly in Settings. For anything else — exporting your data, correcting something you can't edit yourself, or deleting your account and its data — email us (see Contact) and we'll act on it.

If you're an end-customer (you received a review request, but don't have a ReviewEngine account)

Because you never create an account with us, the fastest path is usually the business that sent you the request — they control what data about you gets sent to us and can ask us to correct or delete it. You're also welcome to email us directly at the address in Contact and we'll either act on it ourselves or route it to the relevant tenant, whichever gets it resolved faster.

We use exactly two cookies, both set only when you're logged in as a tenant:

• re_token — your session token, so you stay logged in.
• re_is_admin — a UI hint for whether to show admin navigation. It has no security function on its own.

Both are httpOnly, Secure, and SameSite=Strict — your session token is never readable by JavaScript and never stored in localStorage. We don't run any analytics, advertising, or third-party tracking cookies on this site.

ReviewEngine is built to serve tenants internationally, not just in one country — so this product expects EU, UK, and other international customers alongside US ones, meaning GDPR (and UK GDPR) applies to personal data from those tenants and their end-customers, and the CCPA/CPRA applies for California-based tenants and their end-customers.

NEEDS LEGAL REVIEW — this session doesn't have a verified answer for where ReviewEngine's infrastructure is physically hosted, where the company is legally domiciled, or what cross-border transfer mechanism (e.g. Standard Contractual Clauses) governs any transfer of EU/UK personal data outside the EEA/UK. Those are facts about your actual infrastructure and business entity, not something to infer from application code — they need to be supplied and reviewed by counsel before this section can make a concrete, accurate claim instead of this general statement.

We treat a breach of this data as an existential risk to the business, and build accordingly:

• Every tenant's data is isolated by two independent layers: application-level scoping and Postgres Row-Level Security enforced at the database itself, so even a bug in our application code can't leak one tenant's data into another's response.
• Google OAuth tokens are encrypted at rest.
• Passwords are hashed with bcrypt — we never store or log a plaintext password.
• All traffic runs over HTTPS with HSTS enabled.
• Every cross-tenant read by our own admin staff is logged in an audit trail.

No system is perfectly secure, and we can't guarantee absolute security — but this is the real, built architecture, not an aspiration.

ReviewEngine is a business-to-business product for local service businesses, and is not directed at or intended for use by children. We don't knowingly collect personal data from anyone under 16 (whether as a tenant's team member or an end-customer). If you believe a child's data has reached us, contact us and we'll delete it.

If we make a material change to this policy, we'll update the "Last updated" date above and, for significant changes, notify tenants by email.

Questions about this policy, or requests to access/correct/delete data, can be sent to support@reviewengine24.com.

NEEDS LEGAL REVIEW — consider whether GDPR requires naming a specific Data Protection Officer or EU/UK representative for your business.