Privacy Policy

1. Who Is Responsible for Your Data

For the account, business, and billing data of businesses that use Honest Reviews and their team members, and for visitors to our website, the data controller is:

When a business uses Honest Reviews to collect feedback from its own customers through a review or survey page, that business is the controller of the feedback, and we process it on the business's behalf as a processor. If you submitted feedback to a business, you can also contact that business directly about your data.

2. Information We Collect

Account and Business Information

When you sign up with your Google account and use the Services, we collect:

• Your name, email address, and Google account email address
• Your phone number, if you provide it
• Your business name and location details from your Google Business Profile, such as location names, addresses, and Google location and Place IDs
• Settings you choose, such as your AI reply tone, signature, business overview, notification preferences, and logo
• Team information: the email address of people you invite, their access level (full or read-only), and the locations they can access

Data From Accounts You Connect

Google Business Profile. With your authorization, we access your business locations, your reviews (including each reviewer's public display name, rating, review text, and date), your replies, your posts, and performance insights such as the search keywords customers use to find you. We store the authorization tokens needed to keep this connection working.

Instagram. If you connect an Instagram business account, we access your username and posts so we can publish them to your Google Business Profile.

You can disconnect Instagram in the app at any time. You can revoke Honest Reviews' access to your Google account in your Google Account settings at any time, although the Services cannot work for your business without it.

Public Competitor Information

For competitor benchmarking, we retrieve publicly available information about nearby businesses from Google, such as business names, ratings, and review counts.

Feedback Submitted Through Review and Survey Pages

When you give feedback to a business through its QR code or link, we collect your star rating and, depending on the fields that business chooses, your comments or survey answers, your name, your email address or phone number, the date of your visit, and whether you would like to be contacted.

If you rate your experience 4 or 5 stars, you are taken to the business's Google review page. Anything you post there is public and subject to Google's privacy policy. Otherwise, your feedback is sent privately to the business, is visible only to the business and its team, and is not published. The feedback form also links to the business's Google review page if you would rather post publicly.

Payment Information

Subscriptions are paid on our website through Stripe. Stripe collects your card details directly, and we never see or store full card numbers. Stripe stores your billing name, billing address, and phone number (if provided), which we can view to manage your subscription, and we keep a record of your subscription plan and status.

Technical Information

When you use the Services, our hosting and infrastructure providers process technical data such as your IP address, browser or device type, and request logs. This is needed to deliver the Services and keep them secure.

We do not use analytics or advertising tools, and we do not track you across other apps or websites.

Communications

If you contact us, we keep your message and our reply so we can help you.

3. How We Use Your Information and Our Legal Bases

• Providing the Services: creating and managing your account, syncing and replying to reviews, AI insights, team access, review collection and surveys, and notifications. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• Payments and billing: processing subscriptions and keeping billing and tax records. Legal basis: contract, and our legal obligations (Art. 6(1)(b) and (c)).
• Service emails: review alerts, weekly and monthly summaries, and team invitations. Legal basis: contract. You can turn off email notifications in the app's Settings.
• Security and fraud prevention: protecting the Services and preventing abuse, for example stopping the same business location from repeatedly claiming a free trial. Legal basis: our legitimate interests (Art. 6(1)(f)).
• Maintaining and improving the Services, including fixing errors. Legal basis: our legitimate interests.
• News and tips about Honest Reviews: if we email you about our own similar services, we rely on our legitimate interests as your service provider, or your consent where the law requires it. You can unsubscribe at any time using the link in each email.
• Legal compliance: meeting our legal obligations and establishing, exercising, or defending legal claims. Legal basis: legal obligation and our legitimate interests.
• Feedback from a business's customers: we process it only on that business's instructions, as its processor.

Providing your account information is necessary to use the Services. Without it, we cannot create or run your account.

4. Artificial Intelligence

We use OpenAI's API to draft replies to reviews, generate insights and SWOT analyses, analyze survey responses, and suggest business descriptions. To do this, we send OpenAI the relevant text:

• Review text and ratings
• The reviewer's name, so a reply can address them by their first name
• Your business name and reply settings
• For analysis features, review, feedback, and survey content

OpenAI processes this data as our service provider. Under OpenAI's API terms, data sent through the API is not used to train OpenAI's models.

AI replies are drafts written in your business's name. You choose whether they are posted automatically or only after your approval, and you can edit them. We do not make decisions about anyone based solely on automated processing that produce legal or similarly significant effects.

5. Data We Do Not Collect

Honest Reviews does not access:

• Your contacts or phonebook
• SMS or call logs
• Your precise device location (GPS)
• Your microphone

We only access your photos or camera when you choose to upload an image, such as your business logo.

6. Who We Share Information With

We share personal data with service providers that help us run the Services and are bound by data protection terms:

• Google (Firebase and Google Cloud): authentication, database, cloud functions, file storage, website hosting, and notifications, plus the Google Business Profile, Places, and Sign-In APIs
• OpenAI: AI features (see section 4)
• Stripe: payments and subscription billing
• Brevo: email delivery and our email contact list
• Meta (Instagram): only if you connect an Instagram account
• Supabase: database for the reputation reports we prepare for businesses
• goQR.me (api.qrserver.com): generating the QR code images for your review links

Within a business: if you are a team member, the business owner can see your name, email address, and access level. Feedback submitted through a business's review or survey pages is available to that business and its team.

We may also disclose data to authorities when the law requires it (see section 14).

We do not sell personal data or share it for advertising.

7. International Data Transfers

Some of our service providers, including Google, OpenAI, Stripe, and Meta, process data outside the European Economic Area, particularly in the United States. These transfers are covered by the EU–US Data Privacy Framework where the provider is certified under it, or by the European Commission's Standard Contractual Clauses. You can contact us for more information about these safeguards.

8. Cookies

Our website only uses cookies and similar storage that are strictly necessary for it to work, such as keeping you signed in and processing payments securely. See our Cookie Policy for details.

9. How Long We Keep Your Data

• Account and business data: for as long as your account exists. If your subscription ends, we keep your account so you can reactivate it, until you delete it.
• Customer feedback and survey responses: for as long as the business keeps its account, unless the business deletes them sooner.
• Billing records: for as long as tax and accounting laws require.
• Free-trial records: when an account is deleted, we keep the Google location identifiers that used its free trial, linked to an internal account ID, so the same location cannot claim another free trial.
• Email contact list: until you unsubscribe or ask us to remove you.
• Messages you send us: for as long as needed to handle your request.

10. Deleting Your Account

You can delete your account:

• In the mobile app, from the account options in the menu, or
• By following the steps on our account deletion page

When you delete your account, we cancel any active subscription and permanently delete your account, business locations, stored reviews, customer feedback and survey responses, team memberships, and invitations. The only exceptions are the limited records described in section 9 (billing records and free-trial records). To also be removed from our email list, use the unsubscribe link in any of our emails or contact us.

11. Your Data Protection Rights

Under the GDPR, you have the right to:

• Access your personal data and receive a copy of it
• Correct inaccurate data
• Have your data deleted
• Restrict how we process your data
• Receive your data in a portable format
• Object to processing based on our legitimate interests, and to direct marketing at any time
• Withdraw any consent you have given, at any time, without affecting processing that happened before

To exercise these rights, email support@honestreviews.app. We will respond within one month, and we may need to verify your identity first. If you submitted feedback to a business, you can contact that business, or contact us and we will pass your request on.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. In Cyprus, this is the Office of the Commissioner for Personal Data Protection (www.dataprotection.gov.cy).

12. Data Security

We implement appropriate technical and organizational measures to protect personal data, including:

• Encrypted communications (HTTPS/TLS)
• Secure cloud infrastructure
• Authentication and access controls
• Monitoring designed to detect unauthorized access or misuse

While we take reasonable measures to protect personal data, no system can guarantee complete security.

13. Children's Privacy

Honest Reviews is a service for businesses and is not directed at children under the age of 13 (or the minimum age required by applicable law). We do not knowingly collect personal data from children.

14. Legal Requests and Harm Prevention

We may access, preserve, and share your information in response to a legal request (like a search warrant, court order, or subpoena) if we have a good faith belief that the law requires us to do so. We will review the legality of such requests and adhere to data minimization principles.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in the law, our Services, or our providers. We will revise the "Last updated" date when we do and, for significant changes, let you know in the app or by email.

16. Contact

If you have questions about this Privacy Policy or our data practices, please contact: