Privacy Policy

1. Introduction & Who We Are

Reviio (“Reviio,” “we,” “us,” or “our”) is a cloud-based software-as-a-service (SaaS) platform that helps business owners manage and respond to their Google Maps / Google Business Profile reviews using artificial intelligence. We are committed to protecting your privacy and handling your data transparently and securely.

This Privacy Policy describes how Reviio collects, uses, stores, shares, and protects personal information when you use our website (reviio.com), web application, mobile application (collectively, the “Service”), and any related services.

2. Scope of This Policy

This Privacy Policy applies to all users of the Reviio Service, including Account Owners, Administrators, Responders, and visitors to our website. It covers data collected through our website, web admin console, mobile application, APIs, and any interactions with our support team.

3. Information We Collect

3.1 Account Information (Provided by You)

When you register for an account, we collect:

• Personal identifiers: full name, email address, password (stored as a cryptographic hash — we never store plaintext passwords).
• Business information: business legal name, billing address, billing country, VAT/Tax ID (if provided).
• Subscription and plan selections.

3.2 Google Account Data (Obtained via OAuth)

When you connect your Google Business Profile to Reviio, you authorize us to access your Google data through OAuth 2.0 with the scopehttps://www.googleapis.com/auth/business.manage. Through this authorization, we access:

• Google Business Profile accounts and locations: account resource names, location names, addresses, and Place IDs associated with your Google account.
• Reviews: review IDs, reviewer display names, star ratings, review comment text, review language, and timestamps for each connected location.
• Reply publishing capability: the ability to create, update, and delete owner replies to reviews on your behalf.
• OAuth tokens: refresh tokens required to maintain the connection and make authorized API calls. These tokens are encrypted at rest using Google Cloud Secret Manager / KMS.

3.3 Payment Information

Payment card data is collected and processed exclusively by our payment processor, Cybersource (a Visa company). Card numbers (PANs) are captured client-side using Cybersource Flex Microform tokenization andnever reach or are stored on our servers. We maintain only:

• A Cybersource payment instrument token (a reference to the card stored by Cybersource).
• The last four digits of the card number (for display purposes).
• Card type (e.g., Visa, Mastercard) and expiration date.
• Transaction records: amounts, dates, statuses, and invoice references.

3.4 User-Uploaded Content

You may upload business context files (PDFs, images) to help the AI generate better, more grounded replies. We store:

• The uploaded files themselves in Google Cloud Storage.
• Extracted text content from PDFs and OCR/vision-derived descriptions from images.

3.5 AI-Generated Content

We store:

• AI-generated reply suggestions (3 per review).
• Regeneration instructions provided by users (e.g., “mention we fixed the AC”).
• The final text of published replies.
• Model version and prompt metadata (for versioning and quality control).

3.6 Usage and Analytics Data

• Credit consumption and usage ledger records.
• Reply activity metrics (review volume, response rate, response times).
• Audit log entries (actions taken, timestamps, actor identification).

3.7 Technical and Device Data

• IP address, browser type and version, operating system.
• Device identifiers (for mobile push notifications via Firebase Cloud Messaging).
• Pages visited, click patterns, and session duration (for service improvement).
• Error logs and crash reports.

3.8 Reviewer Data (Third-Party)

When we ingest reviews from Google, we receive and store the following information about the reviewer (a third party who isnot our user):

• Reviewer display name (as shown publicly on Google Maps).
• Star rating and review comment text.
• Detected language of the review.

This information is publicly available on Google Maps. We store it only to provide the core review management functionality. We do not attempt to identify reviewers beyond the display name provided by Google, and we do not use this data for profiling, marketing, or advertising.

4. How We Use Your Information

We use the information we collect for the following purposes:

We do not use your data for advertising, sell your data to third parties, or use your data to build profiles for marketing to you or to third-party reviewers.

5. Google API Services — Limited Use Disclosure

Specifically, Reviio commits to the following with respect to data received from Google APIs:

1. Limited purpose: We only use Google API data to provide and improve the user-facing features of Reviio (review management, reply generation, location management) that are prominent in our application’s interface.
2. No selling: We do not sell Google user data to third parties.
3. No advertising: We do not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.
4. No AI/ML training: We do not use Google user data to develop, improve, or train generalized (non-personalized) artificial intelligence or machine learning models. Review text is sent to the LLM solely for real-time reply generation on behalf of the specific user and is not used for model training.
5. Limited human access: We do not allow humans to read Google user data unless: (a) we have the user’s affirmative agreement, (b) it is necessary for security purposes (e.g., investigating abuse), (c) it is necessary to comply with applicable law, or (d) the data is aggregated and anonymized for internal operations.
6. No unauthorized transfer: We do not transfer Google user data to third parties except as necessary to provide the Service (e.g., sending review text to the LLM for reply generation), with user consent, or as required by law.

6. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or a jurisdiction with similar data protection laws, we process your personal data under the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): Processing necessary to provide the Service you have subscribed to — account creation, review management, reply generation, billing.
• Legitimate interests (Art. 6(1)(f) GDPR): Service improvement, fraud prevention, security monitoring, and analytics. We balance these interests against your rights and freedoms.
• Consent (Art. 6(1)(a) GDPR): Where you explicitly opt in — for example, connecting your Google account via OAuth, enabling optional cookies, or opting into marketing communications.
• Legal obligation (Art. 6(1)(c) GDPR): Processing required to comply with applicable laws (e.g., tax record retention, law enforcement requests).

You may withdraw consent at any time by disconnecting your Google account from our Service or adjusting your settings. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

7. Data Sharing & Third-Party Services

We share your data only with the following categories of third parties, and only as necessary to provide the Service:

We do not sell, rent, or trade your personal information with third parties for their marketing purposes. We do not share data with advertising networks, data brokers, or analytics companies for profiling or ad-targeting purposes.

8. International Data Transfers

Reviio is hosted on Google Cloud Platform. Your data may be processed and stored in data center regions operated by Google Cloud. Where data is transferred outside the EEA/UK, we rely on:

• Google Cloud’s adherence to Standard Contractual Clauses (SCCs) approved by the European Commission.
• Cybersource’s compliance with applicable data transfer mechanisms as a Visa company.

9. Data Retention & Deletion

Account Deletion

You may request deletion of your account and all associated data at any time by contacting us atadmin@reviio.app or through the account settings page. Upon receiving a verified deletion request:

1. We disconnect all Google connections and revoke OAuth tokens.
2. We delete your account, user records, reviews, suggestions, uploaded files, and settings within 30 days.
3. We retain only data required by law (e.g., payment records for tax compliance) in an anonymized or minimized form.
4. We confirm deletion completion via email.

10. Data Security

We implement industry-standard technical and organizational security measures to protect your data:

• Encryption in transit: All data is transmitted over HTTPS/TLS 1.2+.
• Encryption at rest: All data stored in Google Cloud (Cloud SQL, Cloud Storage) is encrypted at rest using Google-managed or customer-managed encryption keys.
• OAuth token security: Google OAuth refresh tokens are encrypted and stored in Google Cloud Secret Manager, not in the application database.
• PCI compliance: We target PCI DSS SAQ-A compliance. Credit card data never reaches our servers — it is captured client-side by Cybersource’s Flex Microform and tokenized before any transmission.
• Password security: User passwords are cryptographically hashed using industry-standard algorithms (bcrypt). We never store plaintext passwords.
• Access control: Role-based access control (RBAC) enforced at the API level. JWT authentication with short-lived access tokens and secure refresh token rotation.
• API rate limiting: Protection against brute-force attacks and abuse.
• Input validation: All user inputs and API request payloads are validated and sanitized server-side.
• Infrastructure security: Hosted on Google Cloud Platform with SOC 2, ISO 27001, and other compliance certifications.
• Monitoring and alerting: Real-time monitoring for security events, failed authentications, and anomalous access patterns.

11. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”): Request deletion of your data (see Section 9).
• Right to restrict processing: Request that we limit how we use your data.
• Right to data portability: Request your data in a structured, commonly used format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent at any time (e.g., disconnect Google account).
• Right to lodge a complaint: File a complaint with your local data protection authority.

To exercise any of these rights, contact us atadmin@reviio.app. We will respond within 30 days (or sooner as required by applicable law).

Google Account Permissions

You may revoke Reviio’s access to your Google account at any time through your Google Account Permissions page or by disconnecting the Google connection within Reviio’s settings. Revoking access will immediately stop all review ingestion and reply publishing for the associated locations.

12. Children’s Privacy

Reviio is a B2B service designed for business owners and is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child under 18, we will take steps to delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated policy on our website with a new “Last Updated” date.
• Sending an email notification to account owners for material changes.
• Displaying an in-app notification on your next login.

We encourage you to review this policy periodically. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: admin@reviio.app
• General support: support@reviio.app
• Website: https://reviio.com

For GDPR-related inquiries, you may also contact our Data Protection Officer (DPO) atadmin@reviio.app.