Privacy Policy

1. Information We Collect

We collect information you provide directly, information generated through your use of our Services, and information from third-party sources you connect to ReviewForge. The types of information we collect depend on how you interact with our platform.

• Registration information — name, email address, phone number, job title, and password when you create an account.
• Payment information — billing address and payment method details processed through our PCI-compliant payment processor. We do not store full card numbers.
• Profile information — business name, industry, number of locations, and organizational structure.
• Communications — messages you send to our support team, demo request forms, and any feedback you submit.

2. Business & Account Information

When you set up your ReviewForge account, we collect information about your business structure to power the platform's multi-location features:

• Business names, addresses, phone numbers, and website URLs for each managed location.
• Organizational hierarchy data (regions, districts, managers) that you configure in the platform.
• Google Business Profile connection tokens, Yelp API credentials, and Facebook Page access tokens provided when you authorize integrations.
• Twilio or SMS gateway credentials provided when you enable review request messaging.
• Team member names, email addresses, and assigned roles within your organization.

3. Review & Customer Data

A core function of ReviewForge is collecting, displaying, and helping you respond to reviews from third-party platforms. This involves handling data about your customers:

• Review data — reviewer names, star ratings, review text, and platform source (Google, Yelp, Facebook) pulled from connected integrations.
• Review request contacts — customer names, phone numbers, and/or email addresses that you upload or enter to send review request messages. You are responsible for having appropriate consent before providing this data to ReviewForge.
• QR code scan data — anonymized scan counts and timestamps associated with ReviewForge-generated QR codes.
• Internal reviews — feedback collected through ReviewForge's internal review request flow before it is routed to a third-party platform.

You are the data controller for customer personal data you provide to ReviewForge. ReviewForge acts as a data processor on your behalf for this data.

4. Usage & Analytics Data

We automatically collect information about how you use our Services to improve reliability, performance, and features:

• IP addresses, browser type, operating system, device identifiers, and referring URLs.
• Pages visited, features used, time spent, and navigation paths within the application.
• API request logs, error reports, and performance metrics.
• Session identifiers and authentication event logs.

5. How We Use Information

We use the information we collect for the following purposes:

• Providing the Services — operating the platform, powering dashboards, processing review data, sending review requests, and generating reports.
• Customer support — responding to inquiries, troubleshooting issues, and onboarding assistance.
• Billing & account management — processing payments, sending invoices, and managing subscription status.
• Platform improvement — analyzing usage patterns to fix bugs, improve features, and build new functionality.
• Security & fraud prevention — detecting unauthorized access, suspicious activity, and abuse of the platform.
• Communications — sending product updates, policy changes, and (with your opt-in) marketing communications.
• Legal compliance — meeting our obligations under applicable laws and responding to lawful requests from authorities.

6. AI-Generated Content & Summaries

ReviewForge uses artificial intelligence to generate features including AI response drafts, executive summaries, priority scores, and task recommendations. Here is how we handle data in this context:

• Review text and business context data may be sent to third-party AI providers (such as OpenAI or similar) to generate response drafts and summaries. This data is processed under our data processing agreements with those providers.
• AI-generated content is returned and stored within your ReviewForge account. You are responsible for reviewing AI-generated responses before publishing them.
• We do not use your customer review data to train public AI models or share it with third parties for their commercial benefit.
• AI-generated summaries and priority scores are derived from your account data and are visible only to authorized users in your organization.

7. Integrations & Third-Party Services

ReviewForge integrates with third-party platforms. When you authorize these connections, data flows between ReviewForge and those services:

• Google Business Profile — we access your listing data, reviews, and ratings via the Google My Business API. Google's Privacy Policy governs data held on their platform.
• Yelp & Facebook — similar to Google, we access reviews and listing information through their respective APIs under their own privacy terms.
• Twilio / SMS gateways — review request messages are transmitted through third-party messaging providers. Phone numbers you provide are shared with these providers for message delivery.
• Zapier — if you enable the Zapier integration, data you configure to send through Zaps is governed by Zapier's terms and privacy policy.
• Payment processing — payment information is handled by our PCI-compliant payment processor. ReviewForge does not receive or store full card numbers.

We encourage you to review the privacy policies of all third-party services you connect to ReviewForge.

8. Cookies & Tracking

We use cookies and similar tracking technologies to operate and improve the Services:

• Strictly necessary cookies — session tokens and authentication cookies required to keep you logged in and secure.
• Functional cookies — user preference cookies that remember your settings such as notification preferences and table filters.
• Analytics cookies — we use analytics tools to understand how users navigate the platform. This data is aggregated and not linked to individuals.

You can control cookie settings through your browser. Disabling strictly necessary cookies may impair your ability to log in or use core features.

9. Data Security

We implement industry-standard security measures to protect your data:

• All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
• Passwords are hashed using strong cryptographic algorithms and are never stored in plaintext.
• Access to production systems is restricted to authorized personnel with multi-factor authentication.
• We perform regular security assessments and vulnerability testing.
• Our infrastructure is hosted on SOC 2-compliant cloud providers with physical and logical access controls.

No method of transmission over the Internet is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify you as required by applicable law.

10. Data Retention

We retain your data for as long as necessary to provide the Services and comply with our legal obligations:

• Account and business data is retained for the duration of your subscription and for up to 90 days after account termination to facilitate potential reactivation.
• Review data and historical analytics are retained for up to 3 years to power trend analysis features.
• Customer contact data used for review requests is retained until you delete it or request its removal.
• Billing records and invoices are retained for 7 years as required by financial regulations.
• Server logs and analytics data are retained for up to 12 months.

11. User Choices & Deletion Requests

You have choices about how your information is used:

• Access & export — you can export your review data, location data, and reports from within the platform at any time.
• Correction — you can update your account information at any time through the Settings page.
• Deletion — you may request deletion of your account and associated data by contacting us at support@getreviewforge.com. We will process deletion requests within 30 days, subject to legal retention requirements.
• Marketing opt-out — you can unsubscribe from marketing emails at any time using the unsubscribe link in those messages or by contacting us.
• Data portability — upon request, we can provide your data in a machine-readable format.

If you are located in the EU/EEA, UK, or California, you may have additional rights under GDPR, UK GDPR, or the CCPA respectively. Please contact us to exercise those rights.

12. Children's Privacy

ReviewForge is a business-to-business platform designed for adults operating businesses. Our Services are not directed to children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (to the address on your account) and update the "Last updated" date at the top of this page. Your continued use of the Services after the effective date of any changes constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.

14. Contact Information

If you have questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us: