Privacy Policy

Last Updated: June 19, 2026

ReviewLead ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

1. Information We Collect

Business Account Information

When you create a ReviewLead account, we collect:

• Business name
• Email address
• Phone number
• Password (hashed and encrypted at rest)
• Google Review URL (optional)

Customer Feedback Information

When end customers provide feedback through your ReviewLead QR code, we collect:

• Rating (1-5 stars)
• Name (optional)
• Phone number (optional)
• Email address (optional)
• Feedback text (for ratings of 3 stars or below)
• Timestamp

Automatically Collected Information

• IP address
• Browser type
• Device information
• Usage data
• Device fingerprint (a non-identifiable hash generated from browser characteristics including user agent, screen resolution, language, and timezone — used solely to prevent duplicate review submissions)
• Local storage and session storage data (used to track review submission status on your device)

2. How We Use Your Information

We use the information we collect to:

• Provide and maintain our service
• Process customer reviews and feedback
• Send email notifications about new reviews
• Improve our service and user experience
• Respond to customer support requests
• Detect and prevent fraud or abuse
• Comply with legal obligations

3. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA) or UK, our legal basis for processing your personal data is:

• Consent: You have given clear consent for us to process your personal data
• Contract: Processing is necessary to fulfill our service agreement with you
• Legitimate Interest: Processing is in our legitimate interest (e.g., fraud prevention)
• Legal Obligation: Processing is necessary to comply with the law

4. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share your information only in these circumstances:

• With your consent: When you explicitly authorize us to share
• Service providers: Third parties who help us operate our service (Firebase/Google Cloud)
• Legal requirements: When required by law, court order, or government request
• Business transfers: In connection with a merger, sale, or acquisition

5. Data Retention

We retain your information for as long as your account is active or as needed to provide services. Specifically:

• Business account data: Until you delete your account
• Customer feedback data: Until you delete it or request deletion
• Anonymous analytics: Up to 26 months

6. Your Rights

All Users

• Access your personal data
• Update or correct your data
• Delete your account and data
• Export your data
• Opt-out of marketing emails

GDPR Rights (EU/UK Users)

• Right to be forgotten (data deletion)
• Right to data portability
• Right to restrict processing
• Right to object to processing
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

CCPA Rights (California Users)

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to say no to the sale of personal information
• Right to access personal information
• Right to equal service and price

End Customer Rights (Customers who submitted feedback)

If you are an end customer who submitted a rating or feedback through a business's ReviewLead QR code, you have the right to:

• Request access to your submitted data
• Request correction of inaccurate data
• Request deletion of your personal data

To exercise these rights, email support.reviewleads@gmail.com with:

• Subject line: "Data Deletion Request"
• The business name where you submitted your feedback
• Approximate date of submission
• Your name or email used during submission

We will process your request within 30 days.

7. Data Security

We implement appropriate security measures to protect your data:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest (Firebase/Google Cloud)
• Password hashing
• Regular security updates
• Access controls and authentication
• Firebase App Check with reCAPTCHA Enterprise — verifies all requests come from our legitimate application, blocking unauthorized access and bot submissions
• Firestore security rules — strict field validation on all database writes
• Duplicate submission prevention — device fingerprinting to prevent spam ratings

8. Cookies and Tracking

We use cookies and similar technologies for:

• Authentication (keeping you logged in)
• Analytics (Google Analytics)
• Preferences (saving your settings)
• localStorage — stores your review submission status to prevent duplicate ratings on the same device
• sessionStorage — temporarily stores feedback submission status within your current browser session to prevent accidental double submissions

You can control cookies through your browser settings.

9. International Data Transfers

All ReviewLead data is stored on Google Cloud infrastructure in Montreal, Canada (northamerica-northeast1). This region was specifically chosen to support our Canadian customers and align with PIPEDA data residency expectations.

Google Cloud maintains the following certifications which provide adequate protection for all users regardless of location:

• SOC 2 Type II
• ISO 27001
• EU-US Data Privacy Framework
• Standard Contractual Clauses (SCCs)

For Indian customers: storing your data in Canada does not violate India's Digital Personal Data Protection Act (DPDP) 2023, as Canada provides adequate data protection standards.

10. Google Account Integration (OAuth)

ReviewLead allows business owners to connect their Google Business Profile account to our service. When you choose to connect your Google account, we:

• Request access only to your Google Business Profile data (reviews and business information)
• Store encrypted OAuth access tokens and refresh tokens in our secure database
• Use these tokens solely to fetch your Google reviews and post review replies on your behalf
• Never access your Gmail, Google Drive, or any other Google services
• Encrypt all OAuth tokens using AES-256 encryption before storage
• Log all OAuth actions for audit purposes (PIPEDA compliance)

You can revoke ReviewLead's access to your Google account at any time through your Google Account permissions page.

11. Children's Privacy

Our service is not intended for children under 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date
• Sending an email notification (for material changes)

13. Contact Us

14. State-Specific Rights

California Residents (CCPA/CPRA)

To exercise your CCPA rights, email support.reviewleads@gmail.com with "California Privacy Request" in the subject line.

Canadian Residents (PIPEDA)

As a Canadian-focused service, we take PIPEDA compliance seriously. Canadian residents have the right to:

• Know what personal information we hold about you
• Challenge the accuracy of your information
• Request deletion of your personal information
• Withdraw consent for data processing
• Be informed of any data breaches that may affect you

Your data is stored in Montreal, Canada — no cross-border transfer required for Canadian customers.

To exercise your PIPEDA rights, email support.reviewleads@gmail.com with "Canadian Privacy Request" in the subject line. We will respond within 30 days.

You may file a complaint with the Privacy Commissioner of Canada if you believe your privacy rights have been violated.

EU/UK Residents (GDPR)

You have the right to lodge a complaint with your local Data Protection Authority.

---

← Back to Home | Terms of Service