Who this policy covers
This policy applies to revieer account owners, Agency clients whose websites are managed through an owner account, reviewers who submit feedback, visitors to public review pages and people who contact us. A business using revieer remains responsible for its own customer relationship and for telling reviewers how it uses published feedback.
Account and workspace information
When an account is created or managed, revieer processes the account email address, password hash, business or workspace name, website domain, plan and subscription status, public-key version, domain-verification state, saved widget style, email preferences and timestamps associated with account actions. Optional logos are uploaded, resized and stored for display.
For Agency accounts, revieer also processes the names, domains, credentials, branding, settings and status of client workspaces. Those workspaces are controlled by the Agency account owner and do not receive separate dashboard credentials unless the service explicitly adds that feature.
Reviewer information
A review can contain the reviewer's name, email address, rating, review text, creation date and the page associated with the submission. Temporary verification information is stored while the email code is valid and is removed after successful verification. Failed verification attempts and review status are processed to prevent abuse and control publication.
The reviewer's email address and verification secrets are not displayed publicly. Once published, the author name, rating, review text, date, verified status and optional page association may appear in the embedded widget and on a public review page.
How information is used
Information is used to create and authenticate accounts, provide workspaces, verify domain ownership, receive and verify reviews, support moderation or automatic publication, render widgets, save branding and styling, enforce plan limits, process subscriptions, deliver requested emails, prevent abuse, troubleshoot failures and protect the service.
Email and communication choices
Reviewer email addresses are used to deliver verification codes and relevant status messages. Account emails are used for sign-in recovery, password-change warnings, account setup and enabled workspace notifications. Essential security and verification messages cannot be disabled when the associated feature is used.
Account owners can use Email preferences to control new-review notices, review-limit alerts, website updates and the newsletter. Preference changes are stored on the owner account and apply to Agency client-workspace notifications. Stripe may separately send receipts, invoices and subscription notices.
Cookies and security signals
revieer uses a first-party session cookie to keep an account signed in and to protect authenticated actions. In production it is HTTP-only, HTTPS-only and SameSite-protected. The cookie banner stores whether optional analytics were accepted or declined; analytics are not loaded through that banner before consent. Request addresses and anti-abuse signals may be processed temporarily for rate limiting, domain checks, fraud prevention and Cloudflare Turnstile verification. We do not use the session cookie as third-party advertising tracking.
Cookie categories, retention and browser controls are explained in the Cookies Policy.
Service providers and external storage
Production account data, reviews, settings and sessions are stored in Firebase/Firestore, a managed external database service. Stripe processes checkout, payment methods, subscriptions and invoice data. The configured email provider transmits transactional messages, and Cloudflare Turnstile processes anti-abuse checks. Hosting providers serve the application and uploaded assets.
When an account owner connects Google Business Profile, Google Play or Apple App Store, revieer processes provider review data and the credentials required for continued synchronization. OAuth refresh tokens and App Store Connect private keys are encrypted before storage and are not included in public pages or widget responses. Disconnecting a source removes its stored connection and imported reviews from the relevant workspace.
These providers process information only to perform their relevant service, subject to their own security terms and privacy documentation. Payment-card details are entered into Stripe's checkout and are not stored as complete card numbers by revieer.
Security
revieer uses password hashing, expiring single-use password resets, session controls, CSRF protection, domain verification, signed and revocable public keys, request limits, bot checks, HTTPS security headers and output restrictions. Widget review content is treated as text and rendered inside an isolated Shadow DOM. No online service can promise absolute security.
More detail is available in the Security model. Please report suspected unauthorized access to contact@revieer.com.
Retention and deletion
Account and review information is retained while needed to provide the service, maintain subscriptions, keep published reviews available, investigate abuse, resolve disputes and meet legal or accounting obligations. Expired verification and reset credentials are no longer accepted, and successful verification or password reset removes the corresponding secret from active records.
Because the current dashboard does not provide complete account deletion, requests to access, correct, export or delete personal information should be sent to contact@revieer.com. We may need to verify identity and retain limited information where required for security, billing or legal reasons.
Your choices and rights
Account owners can edit workspace names and logos, moderate reviews, rotate public widget keys, change email preferences and manage subscriptions from the dashboard. Reviewers and account owners may contact us about access, correction, objection, restriction, portability or deletion requests available under applicable law. A reviewer can also contact the business that requested or displays the review.
International processing and children
Service providers may process information in countries other than the user's own, subject to the safeguards offered by those providers and applicable law. revieer is a business website service and is not intended for children to create accounts or submit personal information without appropriate authorization.
Changes and contact
This notice may be updated as the service, providers or legal requirements evolve. The current revision date is shown above. Questions and privacy requests can be sent to contact@revieer.com.