DRAFT for review. Not legal advice. Items in [brackets] are to be filled in before launch.

Privacy Policy

Last updated: [date]

This policy explains what personal data [Company legal name] ("RateEasily", "we") handles, why, and your choices. It covers two groups: businesses that use RateEasily and their panel users, and customers of those businesses who open a review page.

1. Businesses and panel users

What we collect: business name, contact name, email and phone; panel users' email logins and display names (passwords are stored only as secure hashes); billing country and tax ID; your settings, branches, staff names and review statistics; log-in records (time, IP address) for security.

Payments: handled by Stripe. We receive the payment status, plan and the last digits of the card, never the full card number.

Why: to provide the service, bill you, keep accounts secure, send service emails (welcome, password reset, payment and subscription notices) and support you.

2. Customers who open a review page

We don't ask customers for their name, email or phone. When the page is opened we record:

• which business, branch and staff link it came from, and whether by NFC or QR;
• the time, the device type, operating system, browser and language;
• an approximate area derived from the IP address (we don't store the full IP address);
• whether the suggested text was copied and the Google button pressed;
• an anonymous random ID in a cookie, so one phone gets one review per branch per day and the business can count returning visits;
• a private message, if the customer chooses to send one to the business.

We use Cloudflare Turnstile to stop automated abuse; Cloudflare processes technical data for that check.

Google: we read public data from Google (ratings and public reviews of the business) through a data provider, to show the business which suggested reviews were posted. We never post anything to Google.

3. Who else handles data

Only service providers that help us run RateEasily: our hosting provider, Stripe (payments), Cloudflare (bot protection), our email provider, and our Google data provider ([SerpApi]). We don't sell personal data and don't use it for advertising.

4. How long we keep it

We keep account and statistics data while the account exists and after it ends, so a business can come back and find everything as it was. A business can ask us to delete its account and data at any time; we then delete it, except what we must keep by law (such as invoices).

5. Your rights

You can ask to see, correct, export or delete your personal data, or object to how we use it, by emailing [email protected]. A customer of a business can ask the same about data from the review page.

6. Security

Data is sent over encrypted connections, passwords are hashed, access to panels is protected against repeated failed log-ins, and backups are kept.

7. Changes

We'll post changes here and email businesses about important ones.

8. Contact

[Company legal name], [address]. Email: [email protected].