Privacy Policy

Revloop serves two groups. Business owners create an account to collect reviews. Their guests interact with a review flow when they scan a QR code or tap a link. This policy covers both, and calls out where the two differ.

From business owners: your name, business name, email address, password (stored only as a salted hash, never in plain text), the locations you add, and your billing details, which are processed by our payments partner and never stored in full on our servers.

From guests: the rating and any written or spoken feedback they choose to submit, plus basic technical data such as a device identifier used to prevent abuse and duplicate submissions. Guests do not create an account with us and are never asked for more than they volunteer.

When you connect a Google Business Profile, we store the identifiers and access tokens needed to verify the listing is yours and to route public reviews to it. Tokens are encrypted at rest.

To run the service: create your review pages, deliver alerts about new reviews and complaints, show your dashboard, and route public reviews to your verified Google listing.

To keep it safe: rate limiting, fraud and abuse prevention, and debugging.

To bill you, if you are on a paid plan, and to send you receipts and account notices.

We do not sell your data, and we do not use guest feedback to train third-party models without a clear, separate choice.

We send transactional email through Postmark (verification codes, review and complaint alerts, and billing receipts). These are service messages tied to your account and are not marketing. You can adjust which alerts you receive from your dashboard.

We share data only with the processors that make the product work: our hosting and database provider, our cache and queue provider, our email provider (Postmark), our payments partner, and Google, when you connect a Business Profile. Each processes data on our behalf under contract. We may also disclose data if the law requires it.

Data is encrypted in transit (TLS) and at rest. Access is limited to what each part of the system needs. We keep your data for as long as your account is active, and delete or anonymise it on request or a reasonable period after you close your account, except where we must keep records for legal or accounting reasons.

You can export or delete your data at any time from your dashboard, or by emailing support@revloop.in. Depending on where you live, you may have rights to access, correct, or restrict processing of your personal data. We honour these regardless of region and aim to respond within 30 days. We offer regional data residency and a Data Processing Addendum on request.

We will update this policy as the product evolves and note the date at the top. For any privacy question or request, email support@revloop.in.