Privacy Policy

1. Introduction and Scope

ReviewPro ("ReviewPro", "we", "us", "our") operates https://www.reviewpro.co.in — an AI-assisted review, catalogue, online-ordering and appointment-booking platform for local businesses.

This Privacy Policy explains what personal data and Google user data we collect, why we collect it, how we use and share it, how long we keep it, and the choices and rights you have. Please read it together with our Terms of Service.

This Policy applies to (a) business owners and their team members who create a ReviewPro account, and (b) end customers who interact with a business's QR code, standee, digital catalogue, ordering or appointment-booking pages. By using ReviewPro you agree to this Policy. If you do not agree, please do not use the service.

2. Information We Collect

We collect only the data needed to provide the service. The categories are:

• Account and profile information: your name, email address, phone number, profile photo and authentication identifiers created when you sign up or sign in (using Firebase Authentication and/or Google Sign-In).
• Business information: business name, category, address, Google Maps place ID, public review link, catalogue items and prices, opening hours and appointment settings.
• Google user data (only when you connect Google): with your explicit consent through Google OAuth 2.0 we access the data described in Section 4 so we can show it in your dashboard and act on your instructions.
• Customer-submitted information: ratings, suggested review text, private feedback messages, order details and booking details that your customers submit through your QR/standee, catalogue, ordering and booking pages — including the name, phone number, email address and any text they choose to provide.
• Payment information: when you buy a paid plan, our payment processor Razorpay collects and processes your payment details. We do not store full card numbers on our servers.
• Usage and technical data: IP address, device and browser type, pages viewed, timestamps, error logs and similar diagnostic data used to keep the service secure and working.
• Cookies and local storage: we use essential cookies and browser storage to keep you signed in and remember your preferences. We do not use Google user data for advertising or ad personalisation.

3. How We Use Your Information

• To create and operate your account, dashboards, QR codes/standees, catalogue, ordering and booking features.
• To retrieve and display your Google Business Profile reviews and to publish the replies you draft or approve.
• To create, update and delete Google Calendar events for appointments booked through your pages, and to send calendar invites to customers when you enable that option.
• To generate AI-assisted review and reply drafts using Google's Gemini models.
• To send transactional and notification emails (for example, new private feedback, a new order or a new booking) through our email provider.
• To process payments and manage your subscription.
• To maintain security, detect and prevent fraud and abuse, and comply with legal obligations.
• To improve, monitor and troubleshoot the service using aggregated and technical data.

4. Google API Services User Data Policy and Limited Use

We access Google user data only after you grant consent, and only for the scopes you approve:

ReviewPro's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Google Business Profile (scope: https://www.googleapis.com/auth/business.manage) — we read the list of locations you manage, their names and addresses, and the public reviews and ratings for those locations, so we can display them in your dashboard and publish the responses you write or approve.
• Google Calendar (scope: https://www.googleapis.com/auth/calendar.events) — we create, update and delete events on your primary calendar for appointments booked through your ReviewPro booking page, and we read your primary calendar's timezone so events are placed at the correct local time. Calendar access is read/write only for events on your primary calendar.
• Basic account data — your Google email address and profile name, used to identify the connected Google account.
• We do not sell Google user data. We do not use Google user data for advertising, ad personalisation, or to train generalised/foundation AI models.
• We do not allow humans to read your Google user data except (i) with your explicit consent for support, (ii) for security purposes such as investigating abuse or a security incident, or (iii) where required by applicable law.
• We do not transfer Google user data to third parties except to the service providers listed in Section 6 that help us run the service, to comply with law, or as part of a merger or acquisition with notice to you.

5. Legal Bases for Processing

Where required by law (for example, under the EU/UK GDPR or India's Digital Personal Data Protection Act, 2023), we process personal data on the following bases: to perform our contract with you; on your consent (for Google integrations and marketing messages); for our legitimate interests (security, fraud prevention and service improvement); and to comply with legal obligations.

6. How We Share Information

We never sell your personal data or your Google user data. We share data only as described below:

• Service providers (sub-processors): Google Cloud and Firebase (hosting, authentication and Firestore database), Google Gemini (AI drafting), the Google Business Profile and Google Calendar APIs, Resend (transactional email), Razorpay (payment processing) and Vercel (hosting and infrastructure). Each provider is bound to use the data only to deliver the service on our behalf.
• Business owners: when a customer submits feedback, an order or a booking to a business, that business's owner and team can see the data the customer submitted.
• Legal and safety: we may disclose data when required by law, or when necessary to protect the rights, safety and security of ReviewPro, our users or the public.
• Business transfers: if ReviewPro is involved in a merger, acquisition or sale of assets, data may be transferred as part of that transaction, with notice to you.

7. Data Retention

• Account and business data is kept for as long as your account is active.
• Google OAuth access and refresh tokens are kept only until you disconnect Google, after which they are deleted from our systems.
• Reviews, replies, orders, bookings and feedback are retained while the associated business account exists, or longer where required for legal, accounting or tax purposes.
• Server logs, webhook and audit records are retained for a limited period for security, debugging and billing-dispute purposes, and are then deleted.
• When you delete your account, we delete or anonymise your personal data and stored connection credentials within 30 days, except where we are legally required to keep certain records.

8. Data Security

We protect your data using industry-standard measures. All traffic is encrypted in transit using TLS. OAuth access and refresh tokens are stored server-side in Google Firestore with access restricted to our backend (Firebase Admin SDK), and Firestore security rules restrict client-side access. Passwords are handled by Firebase Authentication and are never stored in plain text. We apply the principle of least privilege to internal access, and our payment processing is handled by Razorpay so we never store full card numbers.

9. Your Rights and Choices

Depending on where you live, you may have the right to:

• Access the personal data we hold about you, and ask us to correct it if it is inaccurate.
• Delete your personal data (see Section 10 for the fastest ways to do this).
• Withdraw consent at any time — for example, by disconnecting your Google account, which stops our access to your Google data.
• Object to or request that we restrict certain processing.
• Receive a portable copy of your data.
• Lodge a complaint with your data protection authority (for example, India's Data Protection Board, or your EU/UK supervisory authority).

10. How to Delete Your Data and Revoke Google Access

• Disconnect Google in ReviewPro: open your dashboard's Google/Calendar settings and choose Disconnect. This immediately deletes the stored OAuth tokens and stops syncing (reviews and/or calendar).
• Revoke access at Google: visit https://myaccount.google.com/permissions, select ReviewPro and remove access. This stops all future access at Google's side.
• Delete your account: open Dashboard → Settings → Delete account, or email us. This deletes your account and the associated business data.
• Request deletion by email: contact support@reviewpro.co.in. We action verified deletion requests within 30 days.

11. International Data Transfers

We use Google Cloud/Firebase and Vercel infrastructure, which may store and process data in regions outside your country, including the United States. Where we transfer personal data across borders we rely on appropriate safeguards, such as standard contractual clauses or the security commitments of our infrastructure providers.

12. Children's Privacy

ReviewPro is a business tool and is not directed to children. We do not knowingly collect personal data from children under 13 (or under 18 where that is the applicable age of consent). If you believe a child has provided us data, contact us and we will delete it.

13. Third-Party Links and Services

Our service may contain links to third-party sites and services (such as Google Maps). We are not responsible for their privacy practices, and we encourage you to read their privacy policies.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, notify you in-app or by email before the change takes effect.

15. Contact Us

If you have questions about this Privacy Policy or want to exercise your rights, contact our team:

• ReviewPro
• Email: support@reviewpro.co.in
• Phone: +91 7031932380
• Website: https://www.reviewpro.co.in
• Country: India