Privacy Policy
Last updated: May 6, 2026
1. Who we are
ReviewTreats is a product of ReviewTreats (referred to as “we”, “us” or “ReviewTreats”). We provide local businesses with a web app to analyze public Google reviews with AI, see action items, and manage review replies from one dashboard.
For questions about this privacy policy, please contact us at: [email protected]
2. What data do we collect?
2.1 Account holders (businesses / owners)
- Email address (account creation, sign-in)
- Google account ID and display name when you use Google Sign-In
- Organization name and location details
- Payment data via Stripe (we do not store card numbers ourselves)
- Google Maps URL, Google Place ID, and Google Business Profile details you connect
- OAuth access tokens and refresh tokens when you connect Google for one-click replies
2.2 Google review data
- Public review text, rating, review date, and reviewer display name
- Review IDs, location IDs, and owner reply status
- AI insights, reports, and reply drafts generated from reviews
2.3 Customers leaving direct feedback
- Star rating (1–5 stars)
- Text feedback
- Name (optional)
- Photos (optional, up to 4)
- Answers to custom questions (optional)
- Email address — only when the customer explicitly opts in (“I agree to receive messages”)
2.4 Technical data
- IP addresses (temporary, for spam and abuse protection)
- Session cookies (see section 7)
- Server logs (errors, diagnostics)
3. Why do we use your data?
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and manage account | Performance of contract (art. 6(1)(b)) |
| Authenticate with Google Sign-In and secure sessions | Performance of contract (art. 6(1)(b)) |
| Process payments and subscriptions | Performance of contract (art. 6(1)(b)) |
| Fetch, display, and analyze Google reviews with AI | Performance of contract (art. 6(1)(b)) |
| Post review replies to Google when you approve them | Performance of contract (art. 6(1)(b)) |
| Send messages to the customer (only with consent) | Consent (art. 6(1)(a)) |
| Security: rate limiting, fraud prevention | Legitimate interest (art. 6(1)(f)) |
| Compliance with legal obligations | Legal obligation (art. 6(1)(c)) |
4. How long do we keep your data?
- Account data: as long as the account is active. After cancellation, data is removed within 90 days unless a legal retention obligation applies.
- Google review data: kept as long as the organization has an active account or until the Google connection is removed.
- Customer feedback: kept as long as the organization has an active account. The owner can delete individual feedback items.
- Customer email addresses: kept until consent is withdrawn or the account is closed.
- IP addresses (rate limiting): in working memory for at most 24 hours; not persisted.
- Server logs: at most 30 days.
- Payment data: in line with Stripe's retention and the statutory tax retention period (7 years).
5. Who do we share your data with?
We share personal data only with processors that are necessary for our service. Data processing agreements are in place with each processor.
| Processor | Purpose | Location |
|---|---|---|
| Google Firebase | Authentication (Google Sign-In, sign-in, sessions) | EEA / US (SCCs) |
| Google APIs | Connect Google Business Profiles and post review replies you choose to send | EEA / US (SCCs) |
| MongoDB Atlas | Database (reviews, account, and organization storage) | EEA (EU region) |
| Outscraper | Fetch public Google reviews from a Google Maps URL or Place ID | EU / US (SCCs where needed) |
| Stripe | Payment processing, subscriptions | US (SCCs + Adequacy) |
We never sell your data to third parties. We only share data when legally required (e.g. court order).
6. International transfers
Some processors (Firebase, Google APIs, Outscraper, Stripe) handle data outside the European Economic Area (EEA). We ensure such transfers are based on Standard Contractual Clauses (SCCs) approved by the European Commission, or on adequacy decisions.
7. Cookies and storage
We use the following cookies and local storage:
| Name | Type | Purpose | Retention |
|---|---|---|---|
rt_session | httpOnly cookie | Stay signed in (session) | 30 days (remember me) / session |
rt.theme | localStorage | Remember dark/light mode | Until you clear it |
We do not use tracking cookies, advertising cookies, or third-party analytics services (such as Google Analytics).
We do not request access to Gmail, Google Drive, Google Calendar, Google Contacts, or private files.
8. Your rights
Under the General Data Protection Regulation (GDPR) you have the following rights:
- Right of access — request which data we hold about you
- Right to rectification — have inaccurate data corrected
- Right to erasure — “the right to be forgotten”
- Right to restriction — temporarily halt processing
- Right to data portability — receive your data in a readable format
- Right to object — object to processing based on legitimate interest
- Right to withdraw consent — when processing is based on consent, you can withdraw it at any time without giving a reason
Send a request to [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority.
9. Security
We take appropriate technical and organizational measures to protect your data, including:
- Encrypted connections (HTTPS/TLS) for all communication
- httpOnly, Secure, and SameSite session cookies
- Access restrictions: staff only access data necessary for their role
- Rate limiting to prevent abuse and spam
- Input validation to prevent injection attacks
10. Changes to this policy
We may update this privacy policy from time to time. For material changes we will notify account holders by email. The most recent version is always available on this page. The date at the top indicates when the policy was last updated.
11. Contact
Do you have questions, comments, or requests about this privacy policy? Get in touch:
ReviewTreats
Email: [email protected]