1. Information We Collect

ReviewMagnet is used by two different kinds of people, and we collect different information from each.

From shop owners, who create an account to use our dashboard:

• Account Information: Name, email address, phone number, and business details
• Business Data: Business name, category, Google Place ID, and location information
• Usage Data: Smart Standee scan timestamps, review generation events, and analytics data
• Legal Consent: Timestamps and IP addresses for terms acceptance

From customers of a participating shop, who scan a shop's QR code and choose to join that shop's Loyalty or Scratch & Win program:

• Phone number: used only to recognize repeat visits for that one shop's rewards program. We never store the number as typed - only a one-way, secured fingerprint of it (an HMAC hash) that can't be reversed back into the original number, even by us.
• Email address: asked for once, the very first time a customer joins either program at a shop, and never asked again on later visits. It exists for exactly one purpose: verifying a future request from that customer to delete their data (see Section 7 below). It is never used for marketing and never shared with the shop.

Joining a Loyalty or Scratch & Win program is always optional - a customer can leave a public review without providing either.

2. How We Use Your Information

We use the collected information to:

• Provide and maintain our AI-powered review generation service
• Generate and manage QR codes and Smart Standee card functionality
• Operate the Loyalty and Scratch & Win programs a customer chooses to join, and recognize them across repeat visits to that shop
• Track analytics and performance metrics for your business
• Send service-related communications and support
• Comply with legal obligations and maintain audit trails

3. Data Security

We implement appropriate security measures to protect your personal information:

• Encryption of data in transit and at rest
• Secure authentication for admin access
• Regular security audits and updates
• Restricted access to sensitive data
• Customer phone numbers are never stored in readable form - only a secured, one-way fingerprint

4. Data Sharing & Service Providers

We do not sell your personal information. We share data only with the service providers ("sub-processors") that help us run ReviewMagnet, each limited to what it needs to do its job:

• Google Maps & Places API - competitor benchmarking, address lookup, and map display
• Google Gemini API - AI-generated review drafts, menu descriptions, smart replies, and Menu Scan photo processing
• Brevo - delivery of transactional emails (OTP codes, address confirmations, shipping updates, data-deletion confirmations)
• Sentry - error monitoring, so we can find and fix bugs
• MongoDB Atlas - database hosting
• Render - application hosting

We may also share data with legal authorities when required by law, or with business partners with your explicit consent.

5. Your Rights

You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your account and data
• Opt-out of marketing communications
• Export your data for portability

6. Data Retention

We retain your data for as long as necessary to provide our services and comply with legal requirements. You may request deletion of your data at any time.

7. Customer Data Deletion (Loyalty & Scratch & Win)

A customer who joined a shop's Loyalty or Scratch & Win program can permanently delete their own data for that shop at any time - directly, without needing to go through the shop. From the same QR page used to join, a customer can request deletion by entering their phone number and the email they gave when they joined; we send a one-time verification code to that email to confirm the request is genuinely theirs, and once confirmed, their visit history, rewards progress, and contact details for that shop are permanently deleted, with a confirmation sent by email.

This is deliberately independent of the shop itself - shop owners and staff have no ability to trigger a customer's deletion, so a customer's data can never be removed to deny them an earned reward.

For anyone who joined before this self-service option existed and has no email on file, or who would rather not use the self-service flow, you can reach us at the email below and we'll handle the request directly.

8. Children's Privacy

Our service is not intended for children under 13. We do not knowingly collect personal information from children.

9. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by email or prominent notice on our website.

11. Contact Us

If you have questions about this privacy policy, please contact us at:

Email: support@reviewmagnet.cloud

← Back to Home