Privacy policy

What we collect

Merchant account details. The mobile number or email you register and sign in with, your password (stored only as a one-way hash, so we cannot read it), the name you give us, and the IP address you signed up from.

Location details. Whatever you type in: business name, phone, description, photo, the Google share link, and the location identifier worked out from it.

Contact form content. The name, email, phone and message you send through the contact page.

Promoter payout details. When a promoter requests a payout, the payee name, payout account (Zelle or PayPal) and contact phone number they enter. These are used only to send the payment and for tax reporting.

On the customer side. When somebody scans your code they are not asked to log in. We do not collect their name and never touch their Google account. The options they tick are used only to build that one draft.

What we do not collect

• Your Google account or password
• Any identifying detail about your customers
• Any link between a published Google entry and a particular person
• Nothing is sold to third parties, ever

Where it lives

Account and location data sit in a private directory on our server, outside the public website folder, so no visitor can read it directly. Everything travels over HTTPS. Passwords are stored as one-way hashes, so even a data breach would not reveal them.

Third parties involved

Google. When a customer taps through they leave our site for Google Maps, and Google privacy terms apply from that point. We also make one request to Google using the share link you provide, to determine your business identifier. When you use the Business Profile audit or the competitor comparison we also use those identifiers to ask Google once for what your profile shows publicly - trading status, rating, review count, category, and whether a phone number, website, opening hours and photos are present - and we cache that result per business for a day to avoid repeat lookups. We do not store the link you paste.

The text generation service. The options a customer ticks, together with your business description, are sent to the text service we use to produce the review draft. Nothing identifying the customer is included.

Cloudflare. Our site runs behind Cloudflare for speed and protection, which handles access logs under its own policy.

Twilio. Verification texts for sign-up, password resets and adding a phone are sent through Twilio. It receives your mobile number only to deliver that text to you.

Square. Top-up payments are processed by Square, which receives and handles your card details. We do not store your card number.

How long we keep it

Account and location data stay for as long as the account exists. Deleting a location removes its details and its photo from our data. Asking us to close your account removes the account and every location under it. Credit history, top-up and refund records, and referral reward and payout records are kept as accounting and tax rules require, but are no longer linked to your name or contact details.

Your rights

You can view and edit your own data at any time by signing in. To export or delete it, write to [email protected] and include the mobile number or email you registered with, so we can confirm it is you.

Cookies

We use only these cookies: the session cookie needed to keep you signed in; a small signed-in flag that only switches the header button to your merchant centre and is deleted when you sign out; one that remembers your language choice; and, when a customer scans your code and opens the review page, a random visitor ID kept for one year. That ID is used only to tell whether it is the same customer within 24 hours, so you are not charged credits twice for the same customer. It is not used for tracking or advertising, and there is no advertising or tracking code.

So that you are not charged twice for the same customer and to keep billing accurate, when a customer generates a review we also use information the browser already provides (device model, screen size, language, time zone and network) to tell whether it is the same device. It is used for nothing else - not for tracking or advertising - and is not linked to anyone’s identity.

Children

This service is for business operators. It is not directed at children under 13 and we do not knowingly collect their information.

Changes

Updates appear on this page with a new date. Anything significant is also announced in your merchant centre inbox.