Privacy Policy

ReviewSpace (“we”, “us”, or “our”) operates reviewspace.co.nz and its associated products. This Privacy Policy explains how we collect, use, store, and protect your information when you use our platform and services. ReviewSpace is a New Zealand company. This policy is governed by the New Zealand Privacy Act 2020. Where you are located in another jurisdiction, we also respect applicable local privacy laws.

By using any ReviewSpace product or service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of our services.

Google API Services

What Google data we access

ReviewSpace connects to your Google Business Profile via Google OAuth 2.0 using the business.manage scope. This grants us access to:

• Your Google Business Profile account information (business name, address, phone number, category)
• Customer reviews posted on your Google Business Profile
• Review reply content you create and post through ReviewSpace
• Business listing data including opening hours and location details
• Notifications and updates related to your business profile

How we use Google data

We use Google Business Profile data exclusively to provide the ReviewSpace service to you. Specifically, we use this data to:

• Display your Google reviews within the ReviewSpace dashboard
• Generate AI-assisted draft replies to your reviews
• Post replies to reviews on your behalf, only with your explicit approval
• Display your review statistics and ratings
• Embed your reviews on your website via the ReviewSpace widget
• Send you notifications about new reviews

Limited Use restrictions

In compliance with the Google API Services User Data Policy Limited Use requirements, we commit that:

• We do not sell your Google data to any third party
• We do not use your Google data to serve you advertisements of any kind
• We do not use your Google data for any purpose other than providing ReviewSpace features you have chosen to use
• We do not allow human employees to read your Google Business Profile data except where necessary to provide support you have requested, to investigate security incidents, or as required by law
• We do not transfer your Google data to third parties except as strictly necessary to operate ReviewSpace (e.g. our hosting provider)
• We do not use your Google data to train AI or machine learning models

Data retention for Google data

In accordance with Google Business Profile API policies, we refresh your Google data regularly and do not retain cached Google data for longer than 30 calendar days without a refresh from the source. When you delete your ReviewSpace account, all stored Google data and OAuth tokens are permanently deleted.

OAuth tokens and credentials

When you authorise ReviewSpace via Google OAuth, we store your OAuth access token and refresh token securely in our database (Supabase, hosted on AWS infrastructure). These tokens are encrypted at rest and used solely to retrieve your business data and post replies on your behalf. You may revoke this access at any time by visiting your Google Account permissions page or by deleting your ReviewSpace account.

Information We Collect

Account information

When you create a ReviewSpace account, we collect your name, email address, and profile picture from your Google account. We use this to identify you, send you product notifications, and provide account support.

Usage data

We collect information about how you use our products, including pages visited, features used, actions taken (such as approving a review reply), and timestamps. This helps us improve our products and diagnose technical issues.

How you found us

When you first sign in (or the first time we are able to record it) we record the campaign or link that brought you (the utm_ values in the web address), the website that linked to us (domain only) and the page you arrived on. We use this only to understand which of our own channels bring people to ReviewSpace. It is recorded once, never changed afterwards, included in your data export, and deleted with your account.

Free tools

What you paste or type into the free tools on this website, such as a link, a Place ID or the business name on a poster, stays in your browser and is never sent to us. The one exception is the business finder: the business name and location you type there are sent to Google’s Places API, through our server, so we can find your listing; neither what you typed nor the listing details that come back are stored by us. We keep anonymous daily counts of how the tools are used: which tool, which action, and what kind of input it was. Those counts include no IP address, no identifier and no business details, and nothing is stored on your device.

Customer review request data

When you use ReviewSpace to send review requests, you provide us with your customers’ names and contact details (phone numbers or email addresses). We use this data to send the review request on your behalf, and to let you follow up with — or request a further review from — a customer you have already contacted. We do not contact your customers for any other purpose, we do not use their details for our own marketing, and we do not sell or share them with any third party.

We keep these details for as long as your ReviewSpace account is active, and delete them when your account is closed. An account that nobody has signed in to for 18 months and that has no paid subscription is no longer active for this purpose, so we email the account owner, wait 30 days, and then delete these details, unless someone signs in during that time. Where a customer’s details reached us through a connected platform, we also delete them when that platform sends us a deletion request or the store is disconnected. The split matters: details that arrive through a connected platform such as Shopify are governed by that platform’s deletion rules, including when you uninstall our app, while details collected directly through ReviewSpace are kept for as long as your account is active, for the purpose described above. Contact details a customer enters themselves on a review form are deleted about 30 days after we collect them, once the reminder we told them about can no longer be sent.

Payment information

Payment processing is handled by Stripe. We do not store your credit card details. Stripe collects your billing information (name, email, payment method) and processes payments in your local currency (USD, NZD, or AUD). Stripe’s privacy policy governs how they handle your payment data.

Technical data

We automatically collect technical data including your IP address, browser type, device type, and operating system. This is used for security monitoring and improving platform performance.

How We Store Your Data

Your data is stored in Supabase (a managed PostgreSQL database hosted on AWS infrastructure). Our application is hosted on Vercel. Both providers maintain high security standards and data is encrypted in transit (TLS) and at rest.

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or tax obligations.

Third-Party Services

We use the following third-party services to operate our platform. Each has their own privacy policy governing how they handle data:

We do not sell your data to any third party. We do not share your data with advertising networks, data brokers, or any party for marketing or profiling purposes. SMS is not yet a live channel, so no SMS provider appears above; one will be added before the first text message is sent. If you store your own customers’ information with us, our Data Processing Addendum sets out how we process it on your behalf.

Your Rights

Under the New Zealand Privacy Act 2020, and applicable privacy laws in your jurisdiction, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — request that we correct inaccurate personal information
• Deletion — request deletion of your account and personal data
• Portability — request an export of your data in a common format
• Revoke Google access — disconnect your Google account from ReviewSpace at any time
• Withdraw consent — stop using our services and request data deletion at any time

To exercise any of these rights, contact us. We will respond within 20 working days as required by the Privacy Act 2020.

Security

We take the security of your data seriously. We implement industry-standard measures including:

• TLS encryption for all data in transit
• Encryption at rest for all stored data
• Row-level security (RLS) in our database so users can only access their own data
• OAuth 2.0 for authentication (we never store your Google password)
• Regular security reviews of our infrastructure

If we become aware of a data breach that affects your personal information, we will notify you and the relevant authorities (including the New Zealand Privacy Commissioner) as required by applicable law.

Cookies

We use cookies and similar technologies to maintain your session (keep you logged in), remember your preferences, and understand how our platform is used. We do not use third-party advertising cookies. You can disable cookies in your browser settings, but this may affect your ability to use our products. Our Cookie Notice lists every cookie we set and what each one is for.

Children’s Privacy

Our services are not directed at children under 16 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the “Last updated” date at the top of this page. If you use Google API-connected features (such as ReviewSpace), we will seek your re-consent before using your Google data in any new way not previously disclosed. Continued use of our services after changes are posted constitutes your acceptance of the updated policy.

Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

If you are not satisfied with our response, you may contact the Office of the New Zealand Privacy Commissioner.