Privacy Policy

1. Our two roles

For business account holders, we are the controller of your personal information and use it to provide and manage your account, as described below. Team members invited by a business owner to help manage their account are also business account holders for purposes of this policy.

For reviewer information collected through a business's collection page, we act as a processor on that business's behalf. The business decides what to collect and how reviews are displayed, and is the controller of that information. We process it under our agreement with the business and on its instructions. If you are a reviewer with questions about how a particular business uses your information, contact that business directly; we can also help you reach them.

2. Information we collect

From business account holders

• Account and profile information — your name, email address, business name, and the business profile you set up (phone, address, website and social links, logo, header image, and your Google Place ID).
• Billing information — your subscription plan and billing history. Card payments are processed by Stripe; we do not store your full card number. See "Payment processing" below.
• Communications — messages you send us for support or other inquiries.
• Notification preferences — if you opt into SMS or Telegram notifications, your phone number or Telegram chat ID.

From reviewers (on behalf of a business)

• Review content — the rating, review text, and any photo a reviewer submits.
• Reviewer name — submitted with the review and shown only if the business approves the review for display.
• Reviewer email address — collected if provided, stored for the business's records, and never displayed publicly.
• Technical submission data — to prevent spam and abuse, we store a hashed form of the submitter's IP address rather than the raw address.

Photos submitted by reviewers are processed to strip embedded EXIF metadata, including GPS location, before storage.

Collected automatically

• Log and usage data — such as pages requested, timestamps, browser and device type, and similar diagnostic information.
• Cookies and similar technologies — see Section 4.
• Attribution and analytics data — for businesses using our analytics features, we record how visitors arrive at a business's collection page or widget (e.g., referral source) to build the traffic reports shown to that business.

3. How we use information

• To provide, operate, secure, and maintain the Service and your account.
• To collect, store, and display reviews and feedback according to the business's settings and approvals.
• To process subscriptions and payments.
• To send transactional messages, such as new-review notifications and the private feedback that goes to a business owner.
• To send you SMS or Telegram notifications about review activity, billing, and your account, if you opt in to those channels.
• To provide businesses with analytics about how their collection pages and widgets are performing.
• To prevent fraud, spam, and abuse, and to protect the security and integrity of the Service.
• To respond to support requests and communicate with you about the Service.
• To comply with legal obligations and enforce our terms.
• To improve the Service, using aggregated or de-identified data where possible.

Where required by law, we rely on a lawful basis for processing — typically performance of our contract with you, our legitimate interests in running and securing the Service, your consent (for example, certain cookies), or compliance with a legal obligation.

4. Cookies and similar technologies

We use cookies and similar technologies that are necessary to run the Service — for example, to keep business account holders signed in and to keep the Service secure. We do not use cookies to build advertising profiles, and we do not sell personal information.

Our site loads fonts directly from Google's servers (Google Fonts), which involves sending your IP address to Google as part of that request. This is a resource load, not a cookie, so it is not affected by your cookie or browser settings.

You can control cookies through your browser settings. Disabling necessary cookies may prevent parts of the Service from working.

5. The embeddable review widget

Businesses can embed a widget on their own websites to display approved reviews. The widget is designed to be self-contained and to show only the reviews a business has approved for public display. It does not display reviewer email addresses. The reviews it shows are public information the business has chosen to publish. Each business is responsible for its own website, including any privacy notice that site provides to its visitors.

6. How we share information

We do not sell personal information. No mobile information will be sold or shared with third parties for promotional or marketing purposes. We share it only as follows:

• Service providers — vendors who process data on our behalf to run the Service, under contracts that limit their use. These include our payment processor (Stripe), our transactional email provider, our SMS delivery providers (Twilio and SendDM), our Telegram bot platform (Telegram), and our hosting and content-delivery providers.
• Google — when a reviewer chooses to post a review on Google, our Service opens a standard Google review link for the business; the reviewer interacts with Google directly, subject to Google's own policies. If a business connects its Google Business Profile, we use Google's API to retrieve the business's Google reviews, and — when a manager replies to a review from the dashboard — to transmit that reply to Google. We do not use this connection to transmit reviewer information to Google beyond what is already public on the business's Google listing.
• The relevant business — reviewer information is shared with the business whose collection page was used, since that business is the controller of it.
• Webhooks you configure — if a business configures webhooks, review event data is sent to the endpoint the business specifies.
• Your own API access — businesses may generate an API key to access their own account and review data programmatically.
• Legal and safety — when we believe in good faith that disclosure is required by law or necessary to protect rights, safety, or the integrity of the Service.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

Payment processing. Card payments are handled by Stripe. Stripe collects and processes your payment details under its own privacy policy and applicable PCI-DSS standards. We receive limited billing information (such as confirmation of payment and the last digits and type of card), not your full card number.

7. Data retention

We keep personal information for as long as needed to provide the Service and for legitimate business and legal purposes. Account and review data is retained while the account is active. When an account is closed, we delete or de-identify the associated data within a reasonable period, except for information we must retain to comply with law, resolve disputes, or enforce our agreements. Backups are retained for a commercially reasonable period before being overwritten. Businesses may delete individual reviews from their account, and reviewers may ask the relevant business to remove their content.

8. Security

We use reasonable technical and organizational measures to protect personal information, including encryption of data in transit, storing submission IP addresses only in hashed form, stripping EXIF and GPS metadata from uploaded photos, and keeping card data with Stripe rather than on our systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise a right, contact us at [email protected]. If your request concerns reviewer information held on behalf of a business, we will direct it to, or coordinate with, that business as the controller. We will not discriminate against you for exercising your rights.

If you are in the European Economic Area or the United Kingdom (GDPR)

Where the GDPR or UK GDPR applies, the rights above are provided under those laws, and you have the right to lodge a complaint with your local supervisory authority. We process personal data on the lawful bases described in Section 3. Businesses that need a data processing agreement should contact us at [email protected].

If you are a California resident (CCPA/CPRA)

California residents may request the categories and specific pieces of personal information we have collected, request deletion or correction, and opt out of any "sale" or "sharing" of personal information as those terms are defined under California law. We do not sell or share personal information in that sense. To make a request, contact us at [email protected]. You may use an authorized agent, and we will verify requests as the law requires.

10. International data transfers

We operate from the United States, and our service providers may process information in the United States and other countries. If you access the Service from outside these countries, you understand your information may be transferred to and processed in locations with different data-protection laws. Where required, we use appropriate safeguards for such transfers.

11. Children's privacy

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

12. Third-party sites and services

The Service links to and integrates with third-party services such as Google (including reCAPTCHA for spam prevention) and Stripe. We are not responsible for the privacy practices of those services. We encourage you to review their privacy policies.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where reasonable, notify you. Your continued use of the Service after the changes take effect means you accept the updated policy.

14. Contact us

For questions or requests about this Privacy Policy or your personal information, contact us at [email protected], SATE LLC, 1117 Scanlon Dr., Wheeling, IL 60090.