Privacy Policy

This Privacy Policy explains how ReviewGetter ("we", "us", "our") collects, uses, discloses, and protects personal information in connection with our review automation service available at reviewgetter.com.au.

ReviewGetter is operated as a sole trader business in New South Wales, Australia. We are committed to protecting your privacy in accordance with the Australian Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the Privacy and Other Legislation Amendment Act 2024.

This policy covers two distinct groups of individuals:

Business owner customers — Small business owners who create accounts on ReviewGetter to send review requests to their own customers.

End recipients — The customers of business owners, whose mobile numbers and names are provided by the business owner in order to receive review requests and (in some cases) provide private feedback.

We handle personal information for both groups, and this policy explains how.

• Full name and email address
• Password (stored as a cryptographic hash — we never see or store your password in readable form)
• Business name and business type
• Google Maps URL and Google Place ID for your business
• Australian mobile number (only if you opt in to alerts)
• Payment details (handled entirely by Stripe — we do not see or store your card number)
• Usage data — credits used, review requests sent, click-through rates, and Google review count changes
• Technical data — IP address, browser type, device identifiers, and session information
• Rating threshold and other service preferences you configure (such as SMS delay, follow-up, and link-tracking settings)
• Affiliate program data (only if you join as an affiliate) — your referral code, referral activity, and commission records

• First name (provided by the business owner, either entered individually or uploaded in a CSV/XLSX file)
• Australian mobile number (provided by the business owner, either entered individually or uploaded in a CSV/XLSX file)
• Rating submitted on our rating page (a number between 0 and 5)
• Private feedback text (only if submitted through the private feedback form after a low rating)
• Click timestamp and IP address when tapping a tracking link

End recipients do not directly create accounts with ReviewGetter. Their information is provided to us by the business owner as part of that business's use of our service. Where a business owner uploads a CSV or XLSX file to send requests in bulk, the file itself is read and processed in the business owner's own browser — only the extracted names and mobile numbers needed to send the requests are transmitted to our servers.

We collect business owner information to create and manage accounts, send review requests on behalf of the business (whether entered individually or uploaded in bulk), track usage and billing, send transactional emails and account notifications, poll public Google review counts to display statistics, operate the optional affiliate program for business owners who choose to join it, and improve the service.

We collect end recipient information only to fulfil the business owner's specific requests. We send review requests to the number the business owner provides, track whether the link was tapped, route the recipient to Google or to a private feedback form based on the rating they give and the threshold the business owner has set, capture private feedback if the recipient submits it, and notify the business owner of that feedback. We do not use end recipient information for our own marketing purposes or share it with any third party for their marketing purposes.

We disclose personal information to the following third-party service providers, all of whom are contractually required to handle information in accordance with privacy standards equivalent to the Australian Privacy Principles.

• Supabase (United States) — hosts our database and handles authentication
• Twilio (United States) — sends messages to end recipients and manages messaging infrastructure
• Cellcast (Australia) — sends messages to end recipients as an alternative Australian messaging provider
• Stripe (United States and Australia) — processes subscription payments for business owners
• Resend (United States) — sends transactional emails to business owners
• Vercel (United States) — hosts the ReviewGetter application
• Google (United States) — we use the Google Places API to retrieve review counts and construct review URLs
• Inngest (United States) — processes background jobs such as delayed sends and nightly review count polling

At any given time, end recipient messages are sent through only one of Twilio or Cellcast, depending on which provider is active for the Service — not both.

We do not sell, rent, or trade personal information to any third party under any circumstances.

We may disclose personal information if required by Australian law, in response to a valid legal request, or to protect our rights, property, or safety, or that of others.

Most of the third-party service providers listed above are based outside Australia, primarily in the United States. By using ReviewGetter, you acknowledge and consent to your personal information being transferred, stored, and processed outside Australia. We have taken reasonable steps to ensure that these overseas recipients handle personal information in a manner consistent with the Australian Privacy Principles, including through contractual protections and by selecting providers who publicly commit to equivalent standards.

Cellcast is based in Australia. When Cellcast is the active messaging provider, message content and recipient mobile numbers are processed by an Australian-based provider rather than transferred overseas for that step of processing.

• Active business accounts — For as long as the account is active
• Read-only expired trial accounts — Retained indefinitely so business owners can return and access historical data
• Cancelled paid accounts — Retained for 90 days after cancellation in case of return, then deleted (except billing records)
• End recipient information — Retained for 12 months after the review request was sent, then deleted, except for opt-out records
• Opt-out records — Retained permanently to comply with our obligations under the Spam Act 2003
• Billing and tax records — Retained for 7 years to comply with Australian Taxation Office record-keeping requirements
• Server logs and technical data — Retained for 30 days for security and debugging purposes

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure. These measures include encryption of all data in transit using HTTPS and TLS, encryption of all data at rest by our database provider, secure hashing of all passwords, restricted access to production systems, and continuous monitoring for suspicious activity.

Payment card information is never seen or stored by ReviewGetter — it is handled entirely by Stripe, which is PCI-DSS Level 1 certified.

Despite our best efforts, no method of transmission or storage is 100% secure. In the event of a data breach likely to result in serious harm to individuals, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

Under the Australian Privacy Principles, you have the right to request access to the personal information we hold about you, request correction of any personal information that is inaccurate or out of date, request deletion of your personal information (subject to legal retention requirements), opt out of marketing communications at any time, and lodge a complaint about how we have handled your personal information.

To exercise any of these rights, contact us at support@reviewgetter.com.au. We will respond to reasonable requests within a reasonable time and generally within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.

We use computer systems to make some decisions about how our service behaves. These include routing customers who give a rating at or above the business's chosen threshold (a whole number from 0 to 5, defaulting to 4) to the business's Google review page, routing customers who rate below that threshold to a private feedback form, sending automated follow-up messages if a tracking link is not clicked within 48 hours, and suppressing delivery to any phone number that has replied STOP.

These automated processes use only the information described in this policy and do not make decisions that significantly affect any individual's legal rights or interests.

If you have received a message from ReviewGetter on behalf of a business, you can opt out at any time by replying STOP to the message. Your number will be added to a permanent suppression list, and no further messages will be sent to you through the ReviewGetter platform.

If you would like your personal information deleted from our records entirely, contact us at support@reviewgetter.com.au and we will action your request within 5 business days.

We use only strictly necessary cookies to keep you logged in and maintain session state while using the service. We do not use third-party advertising cookies, and we do not track users across other websites.

ReviewGetter is not directed to, and we do not knowingly collect personal information from, individuals under 18 years of age. If you believe we have collected information from a person under 18, please contact us at support@reviewgetter.com.au and we will delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices, our service, or in the law. The "Last updated" date at the top of this policy indicates when it was last revised. Material changes will be communicated to business owner customers by email.

If you have any questions about this Privacy Policy or how we handle personal information, please contact:

ReviewGetter
Attn: Privacy Officer
support@reviewgetter.com.au