Privacy Policy

1. Introduction

ReviewLM ("we," "our," or "us"), operated by Masteret Labs, provides an AI-powered review generation platform for local businesses. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at reviewlm.com and related services (collectively, the "Service"). By using the Service, you consent to the practices described in this policy.

2. Information We Collect

2.1 Information You Provide Directly

• Account Registration: Name, email address, and password. If you sign up via Google OAuth, we receive your Google profile name, email, and profile picture.
• Business Profile: Business name, category, physical address, city, country, phone number, and Google Place ID.
• Branding Assets: Business logo, brand colors, tagline, and custom prompts you configure for the review experience.
• Billing Information: Payment details are collected and processed by our payment provider, Paddle. We do not store your credit card number, CVV, or full card details on our servers.
• Support Communications: Any messages, emails, or information you provide when contacting our support team.

2.2 Information Collected Automatically

• Usage Analytics: QR code scan counts, review generation events, copy-to-clipboard events, page views, session duration, and feature usage, collected via PostHog.
• Device Information: Browser type, operating system, screen resolution, and device type (mobile/desktop).
• Log Data: IP address (hashed and anonymized), access timestamps, referring URLs, and pages visited.
• Cookies: Essential authentication cookies (Supabase session) and analytics cookies (PostHog). See Section 8 for details.

2.3 End-User Data (Customers Who Scan QR Codes)

When an end-user scans a ReviewLM QR code, we collect: device type, browser type, a one-way hashed IP address (for abuse prevention), the prompts they select, and the AI-generated review text. We do not collect the end-user's name, email, phone number, or any personally identifiable information. End-users are not required to create an account.

3. How We Use Your Information

• Provide the Service: Generate AI reviews, display analytics, manage QR codes, and process business branding.
• Process Payments: Manage subscriptions, billing, invoices, and free trial periods via Paddle.
• Prevent Abuse: Detect and prevent bot activity, spam, and fraudulent review generation using Cloudflare Turnstile and IP hashing.
• Improve the Service: Analyze usage patterns, conduct A/B testing (via PostHog feature flags), and optimize user experience.
• Communicate: Send transactional emails (account confirmation, password resets, billing receipts), product updates, and support responses.
• Legal Compliance: Comply with applicable laws, regulations, and legal requests.

4. AI-Generated Content and Data

The AI reviews generated by our Service are created using Google's Gemini language model. We send the following data to the AI model: star rating, selected micro-prompts, business name, business category, and city. We do not send any personally identifiable information about end-users to the AI model.

Generated review text is stored in our database for analytics purposes and to allow businesses to view their review activity. Reviews are associated with a QR code and location, not with any individual end-user.

5. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data to third parties for marketing purposes. We share data only with the following service providers, each of whom processes data on our behalf under their respective privacy policies:

• Supabase: Database hosting, authentication, and row-level security. Data stored in US-based infrastructure.
• Google Cloud (Gemini AI): AI review generation. Only non-personal data (prompts, business info) is sent.
• Paddle: Payment processing, subscription management, and invoicing. Paddle is PCI-DSS compliant.
• Vercel: Website hosting and serverless function execution.
• Cloudflare: Turnstile bot protection and DDoS mitigation.
• PostHog: Product analytics, session recordings, and feature flags. Data is anonymized where possible.
• Printify: Physical standee fulfillment (Pro plan). Shipping address is shared for order delivery only.

6. Data Security

• All data is transmitted over TLS/SSL encrypted connections.
• Passwords are hashed using bcrypt via Supabase Auth. We never store plaintext passwords.
• Row-Level Security (RLS) policies ensure users can only access their own business data.
• API keys and secrets are stored as environment variables, never in client-side code.
• IP addresses from end-users are one-way hashed before storage (irreversible).
• We conduct regular dependency audits and security reviews.

Despite these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your data using industry-standard practices.

7. Data Retention

• Active Accounts: Data is retained for the duration of your active subscription.
• Cancelled Accounts: Data is retained for 30 days after cancellation to allow reactivation, then permanently deleted.
• Review Events: Anonymized analytics data (scan counts, generation counts) may be retained indefinitely for aggregate reporting.
• Support Communications: Retained for up to 2 years for quality assurance and legal purposes.
• Legal Hold: Data may be retained longer if required by law, court order, or regulatory obligation.

8. Cookies and Tracking

We use the following types of cookies:

• Essential Cookies: Supabase authentication session cookies. Required for the Service to function. Cannot be disabled.
• Analytics Cookies: PostHog cookies for usage analytics and A/B testing. These help us understand how customers use our product.
• Security Cookies: Cloudflare Turnstile cookies for bot detection and abuse prevention.

We do not use advertising cookies or share cookie data with advertising networks. You can manage cookie preferences via your browser settings, though disabling essential cookies may prevent the Service from functioning.

9. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of all personal data we hold about you.
• Correction: Update or correct inaccurate personal data via your dashboard or by contacting us.
• Deletion: Request complete account and data deletion. We will process deletion requests within 30 days.
• Data Portability: Request your data in a structured, machine-readable format (JSON or CSV).
• Opt-Out of Analytics: Disable PostHog tracking by contacting us or using browser-based tracking prevention.
• Withdraw Consent: Where processing is based on consent, you may withdraw at any time.

To exercise any of these rights, email us at hello@reviewlm.com.

10. International Data Transfers

Our Service is hosted in the United States via Supabase and Vercel. If you access the Service from outside the United States, your data will be transferred to and processed in the United States. By using the Service, you consent to this transfer. We ensure all transfers comply with applicable data protection laws.

11. Children's Privacy

Our Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 16, we will promptly delete it. If you believe a child has provided us with personal data, please contact us.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by posting a notice on our website and, where appropriate, via email. Your continued use of the Service after changes take effect constitutes your acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: