Privacy Policy

Last updated: July 26, 2026

ReviewForge ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use ReviewForge ("the Service").

1. Information We Collect

We collect the following types of information:

• Account information: Business name, email address, and password when you create an account.
• Business data: Your business name, location, Google review link, and brand voice preferences you configure.
• Review data: Reviews and metadata retrieved from the review platforms you connect. ReviewForge currently ingests Google Business Profile reviews via the official Google Business Profile API; review text, author name, star rating, and timestamp. We do not scrape reviews.
• Customer contact data: Customer names and email addresses you upload for review request campaigns.
• Usage data: Log data, browser type, IP address, and pages visited to improve our Service.
• Payment information: Billing details processed securely by Stripe. We do not store card numbers.

2. How We Store and Process Data

Account, business, review, and AI-response records are stored in a managed PostgreSQL database hosted on Neon, running inside our Render deployment. Data is transmitted over HTTPS in transit, and access controls limit exposure to the account owner and ReviewForge operators. AI response drafts (the ai_responses table) are generated by OpenAI's gpt-4o-mini model and stored alongside the source review.

3. Sharing Your Information

We do not sell your personal information. We share data only with the following third parties, each receiving only what they need to perform their role:

• Billing: Subscription payments are processed by Stripe through our hosting platform's Stripe Connect integration (POLSIA_API_URL/api/company-payments/verify). ReviewForge does not store credit card numbers; only Stripe session IDs, plan tier, and customer email are persisted (see subscribers and users.subscription_status in our database).
• Outbound email: Transactional email (welcome, onboarding, weekly reputation digests, review-request campaigns) is delivered through our hosting platform's email proxy, with Postmark and Resend as fallback providers (services/email.js). The proxy and providers receive recipient address, subject, and the rendered email body; they do not receive your account password.
• AI generation: Review content is sent to OpenAI to draft response suggestions. Only the review text and your brand-voice preferences are sent; OpenAI retains data per its own privacy policy.
• Legal requirements: When required by law, court order, or to protect our legal rights.

4. Data Retention

We retain your account, business, review, response, and analytics data as long as your account is active. If you close your account, we will delete this data within 30 days, except where retention is required by law.

5. Your Rights / Deletion Path

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict processing of your data
• Data portability — receive your data in a machine-readable format

To exercise these rights — including account and data deletion — email privacy@reviewforge.ai and we will action your request within 30 days.

6. Cookies

We use essential cookies to maintain your login session. We may also use analytics cookies to understand how the Service is used. You can disable cookies in your browser settings, though this may limit some functionality.

7. Security

We implement industry-standard security measures including HTTPS encryption, secure data storage, and access controls. However, no method of transmission over the internet is 100% secure.

8. Third-Party Review Platforms

ReviewForge integrates with third-party platforms; the currently supported source is Google Business Profile, accessed via Google's official Business Profile API. Your use of Google Business Profile is subject to Google's own privacy policy. We access only the review data necessary to provide the Service (review text, author name, star rating, and timestamp) — we do not post on your behalf and we do not scrape review pages.

9. Children's Privacy

ReviewForge is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on our website. Your continued use of the Service after changes constitutes acceptance of the updated policy.