Privacy Notice — ReviewTrust

This Privacy Notice explains how ReviewTrust ("ReviewTrust", "we", "us") collects, uses, shares, and protects personal data when you use our website and services (the "Service").

1. Who we are

ReviewTrust is the seller of the Service and acts as the data controller for personal data processed in connection with your account and use of the Service. If you have questions about this notice or your data, contact us at support@reviewtrust.app.

2. Personal data we collect

Account data: name, email address, password (hashed), and login credentials.
Business profile data: business name, business type, Google review link, logos and content you upload.
Support data: messages you send to us and related metadata.
Usage and telemetry data: pages viewed, features used, QR scans, timestamps, device and browser identifiers, IP address.
Billing-related data: subscription status and plan. Card and payment details are collected and processed by our payment provider (see Section 5); we do not store full card numbers.

3. Why we use your data and legal basis

To provide the Service — account creation, generating QR codes, customer-facing review pages (legal basis: performance of a contract).
Security and fraud prevention — abuse detection, rate limiting, audit logs (legal basis: legitimate interests).
Product improvement and analytics — understanding feature usage to improve the Service (legal basis: legitimate interests).
Customer support — responding to your requests (legal basis: performance of a contract / legitimate interests).
Legal and compliance — meeting tax, accounting, and regulatory obligations (legal basis: legal obligation).
Marketing — only where you have consented or where permitted by law (legal basis: consent / legitimate interests).

4. How long we keep data

We keep personal data only for as long as needed for the purposes set out above. Account and business data is retained while your account is active and for a reasonable period afterwards to handle disputes, comply with legal obligations, and maintain backups. When data is no longer needed, it is deleted or anonymised.

5. Who we share data with

Service providers and subprocessors — hosting, database, email delivery, analytics and customer support tooling, acting on our instructions.
Payment provider (Merchant of Record) — Paddle.com Market Limited processes all orders, subscriptions, payments, tax compliance, invoicing, and refunds on our behalf. See Paddle's Privacy Policy.
Professional advisers — legal, accounting and similar advisers where necessary.
Authorities — where required by applicable law, court order, or to protect our rights.

6. International transfers

Personal data may be transferred to and processed in countries outside your own, including outside the UK/EEA. Where this happens we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

7. Your rights

Depending on where you live, you may have the right to:

access the personal data we hold about you;
request correction or deletion of your data;
request restriction of, or object to, certain processing;
data portability;
withdraw consent at any time where processing is based on consent; and
lodge a complaint with your local data protection supervisory authority.

To exercise these rights, email support@reviewtrust.app. We will respond within the timeframe required by applicable law (typically one month under GDPR).

8. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and row-level security on our database. No system is perfectly secure, but we work to keep your data safe.

9. Cookies

We use a small number of essential cookies and similar technologies to keep you signed in, remember preferences, and measure how the Service is used. You can manage cookies through your browser settings; disabling essential cookies may break parts of the Service.

10. Changes to this notice

We may update this Privacy Notice from time to time. Material changes will be communicated through the Service or by email where appropriate.