Privacy at ReviewList.

Information used to provide the service.

Accounts use an email address, public display name, role, and email-verification status. Passwords are stored as bcrypt hashes, never as readable passwords. We store session-token hashes, sign-in-token hashes, and expiry times. Review submissions include a rating, optional title, written feedback, and experience date. Your public name and published review are visible on the business profile.

Business accounts include ownership-verification records, profile details, team memberships, and subscription status. Claim verification uses a public DNS TXT record. Audit logs retain the actor, action, entity, time, and relevant operational details.

Service providers.

Neon PostgreSQL stores application records, and Cloudflare serves the website and runs scheduled maintenance. Password sign-in, reviews, business profiles, and website checks are available. Resend delivers sign-in links, customer invitations, and enabled merchant notifications. Google sign-in, paid billing, private file uploads, and AI analysis require their separate provider connections.

Resend receives the recipient address and the message needed for delivery. Signed delivery events update invitation status. Google sign-in shares account identity with ReviewList after you authorize Google. Stripe processes subscription payments when billing is connected; ReviewList stores billing identifiers and status, not full payment-card details. Redis may support background jobs when a separate queue worker is configured.

If AI analysis is configured, eligible review text and source identifiers are sent to the configured model provider. Public review data is treated as untrusted material. Purchase evidence is stored privately in the configured S3-compatible service and is intended only for verification.

Customer invitations.

Verified store owners can provide customer email addresses, optional names, and optional order references after confirming permission to request feedback. Contact details, invitation tokens, and message payloads are encrypted in the application database. Matching a signed-in recipient to an invitation does not independently verify a purchase.

Invitation emails include an unsubscribe link. Opt-outs, bounces, and complaints prevent further invitations from that store. A keyed email identifier is retained for suppression without displaying the customer's address publicly. Invitation links expire after 60 days; maintenance removes expired private contact and message content after 90 days. Published reviews and operational suppression records follow their separate retention rules.

Imported review data.

We retain source IDs, attribution links, dates, rating scales, permission references, and correction status. Review text, reviewer display names, and business responses are retained only within the recorded authorization. We do not publish additional reviewer personal information obtained from source APIs.

Cookies and measurement.

The application uses an HTTP-only session cookie and a short-lived OAuth state cookie for sign-in. These are necessary for account functionality. If enabled, referral measurement records the public page path and referrer host, without account identifiers or query strings. It distinguishes recognized AI referrer hosts; it does not prove citation visibility.

Storefront widgets record daily aggregate loads and profile clicks on the store's verified domain and its subdomains. Widget previews and iframe-only installations do not count. The measurement endpoint uses hashed rate-limit identifiers; the widget does not send session cookies or retain customer email addresses. Aggregate widget records are removed after 90 days. These events are not unique visitor counts or verified sales.

Retention and deletion.

Sign-in links expire after 15 minutes and sessions after 14 days. Background maintenance removes expired tokens and old rate-limit counters. Referral events are retained for 90 days. Imported content follows its authorization’s retention period; revoked content is hidden immediately. Raw source snapshots are not retained by default.

Purchase proofs have a 30-day expiry record. Actual object deletion requires the configured storage cleanup worker or bucket lifecycle rule. You can remove your first-party reviews or request account deletion in your account. Business ownership must be transferred before deleting an owner account. Operational audit and billing records may be retained where required to investigate abuse or meet applicable obligations.

Review corrections and requests.

Edit or remove your review from your account. Report a review from its public page or submit a moderation appeal if it was rejected. Businesses can request factual corrections or review disputes without paying for a subscription.

For privacy requests, account help, or factual corrections, contact lightlablimited@gmail.com. Include the relevant profile or review URL. Do not send passwords, payment card details, or unrelated personal documents.