Privacy Policy
Last updated: 9 September 2026
Template, not legal advice. Everything in square brackets must be replaced with the operating company's own details, and the whole document should be reviewed by a lawyer in the jurisdiction the business operates in before it is relied on.
This policy explains what [COMPANY NAME] ("we") collects when you use ReviewNudge, why we collect it, and what you can ask us to do with it. Contact us at [CONTACT EMAIL].
Who the data belongs to
There are two kinds of person here, and they are treated differently. An account holder is a business owner who signs up. A customer is someone whose details an account holder adds so that a review request can be sent to them. We process customer data on the account holder's instructions — under the GDPR they are the controller and we are the processor.
What we collect
- Account holders: email address, a hashed password, business name, industry, time zone, Google Place ID, and postal address if provided.
- Customers added by account holders: name, email address, phone number if provided, and whether written consent to receive text messages is on file.
- Message activity: when a review request was scheduled, sent, and whether its link was clicked.
- Technical: IP address, used only to rate-limit sign-ups, log-ins and password resets.
We do not use analytics, advertising or tracking services, and we set no cookies other than the one that keeps you signed in.
Why we can process it
For account holders, to perform the contract you enter into by opening an account. For customers, the account holder is responsible for having a lawful basis — usually their own legitimate interest in asking for feedback after work they have carried out, or consent. Marketing text messages require prior written consent, which the account holder must obtain and record before sending.
Who we share it with
Only the services needed to run the product: Supabase (database hosting), Resend (sending email), Stripe (subscription billing), and Vercel (application hosting). Each processes data on our instructions. We do not sell personal data, and we do not share it for advertising.
How long we keep it
Account data is kept while the account is open and deleted within 30 days of closure. Customer records and message history are deleted when the account holder deletes them, or when the account is closed. Rate-limit records are short-lived.
Opting out
Every review request contains an unsubscribe link that works without an account and takes effect immediately. Once someone opts out, no further requests are sent to them, on any channel, and re-adding them does not undo it.
Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your data, to object to processing, and to complain to a supervisory authority. Write to [CONTACT EMAIL] and we will respond within the period the law allows. If you are a customer rather than an account holder, we will pass your request to the business that added you.
Where data is held
Data is stored by the providers named above, who operate in the United States and the European Union. Where data is transferred outside your country, those providers rely on standard contractual clauses.
Changes
If this policy changes materially we will say so on this page and update the date at the top.