Skip to content
Reviewcrest

Legal

Privacy policy

Last updated [date]

Draft document. This text is a starting template and must be reviewed and adapted by a qualified legal professional before launch. Bracketed items like [Company name] need to be completed.

This policy explains how [Your company legal name] ("we") handles personal data when you use Reviewcrest. It is written with India's Digital Personal Data Protection Act, 2023 in mind and should be adapted for every market you serve (for example GDPR for EU visitors).

1. Data we collect

Account holders (businesses and agencies)

  • Account data: name, email address, a securely hashed password.
  • Organization and business data you enter: business names, logos, categories, addresses, Google review links, social links and brand settings.
  • Billing data: subscription status and identifiers from our payment provider, Razorpay. We do not receive or store full card or bank details.
  • Technical data: session cookies required to keep you signed in, and server logs (IP address, browser type) for security.

Visitors to a business's review page

  • We don't ask review-page visitors to sign in or give their name or contact details.
  • When a visitor requests suggestions, we record the business, chosen star rating, language and time, for usage limits and reporting. We use the IP address transiently for rate limiting and abuse prevention.
  • Text a visitor types into the edit box stays in their browser; we do not receive it.
  • Reviews are posted by the visitor directly on Google, under Google's own terms and privacy policy.

2. How we use data

  • To provide the service: hosting review pages, generating QR codes and suggestions, and showing usage.
  • To manage subscriptions and verify payments.
  • To secure the service, prevent abuse and enforce limits.
  • To contact you about your account, and — only with your consent — about product news.

3. Processors we use

  • Hosting and database provider: [provider and region].
  • AI provider for wording suggestions: [Google (Gemini API) / Anthropic — list the one you use]. We send the business name, category, description, star rating and language — no visitor personal data.
  • Payments: Razorpay.
  • Email delivery: [provider, e.g. Resend].
  • Analytics (only if enabled): [Plausible / Google Analytics]. Google Analytics loads only after you accept analytics cookies.

4. Cookies

We use an essential, http-only session cookie to keep you signed in. Optional analytics cookies are only set with your consent, and you can change your choice by clearing site data.

5. Retention

  • Account and business data: kept while your account is active and deleted within [30] days of account closure, except where law requires longer retention.
  • Usage events: kept for [24] months for reporting, then deleted or aggregated.
  • Billing and webhook records: kept for [8] years where required by tax and accounting law.
  • Password reset tokens expire after one hour.

6. Your rights

You may request access to, correction of, or erasure of your personal data, withdraw consent, and nominate another person to exercise your rights. Contact us at support@example.com. You may also complain to the Data Protection Board of India or your local authority.

7. Security

Passwords are hashed with bcrypt, sessions are stored server-side as hashed tokens, organization data is isolated per account, and secrets are never exposed to browsers.

8. Contact / Grievance officer

[Name], [address], support@example.com