ReviowlSign in

Privacy Policy

Last updated 2026-07-11

This policy explains how Reviowl (sole proprietorship) ("we") handles personal data for the Reviowl service. We act as a processor for the customer contact data our business users upload, and as a controller for their own account data.

1. Data we process

Account data of business users (name, email, business details, billing identifiers). Contact data uploaded by business users (their customers' names, phone numbers, emails, visit dates) — used only to send that business's messages.

2. How we use it

To provide the Service: sending review requests and win-back messages, enforcing opt-outs, billing, and support. We do not sell personal data. AI providers process message text solely to generate that message and do not train on it.

3. Opt-outs & suppression

Every message includes a one-click unsubscribe (email) or STOP keyword (SMS). Opt-outs are recorded on a global suppression list and honored before every send.

4. Sub-processors

We use the following sub-processors. Each handles data only as needed to run the Service, and we name them here so you can assess them yourself.

  • Supabase — database and authentication. Hosted in the EU (Frankfurt).
  • Resend — delivery of review requests and win-backs. Hosted in the EU (Ireland).
  • Vercel — application hosting.
  • Zoho Mail — our own business mailbox, used for our outreach and your replies to us. Hosted in the United States.
  • Anthropic — generates message wording. Receives the business name, category, and language, and never your customer list.
  • Google (Places) — used to find businesses to contact. Not used on customer data.
  • Stripe — payments, once billing is enabled. We never see or store card details.
  • Twilio — SMS delivery, where a business enables it.

5. Where your data is stored

Customer contact data is stored in the EU and sent through an EU email provider. Our own mailbox sits in the United States, so if you email us directly that correspondence is processed there under the provider's standard safeguards.

6. Retention

Contact data is kept while the account that uploaded it is active, and deleted within 30 days of account closure. Suppression records (unsubscribes) are kept indefinitely on purpose: they are how we guarantee an opt-out is never overridden by a later upload. Businesses we contacted but who never became customers are removed within 12 months.

7. Your rights

You can request access, correction, erasure, portability, or object to processing. If a business messaged you using the Service, they are the controller of that data and are the fastest route, but you may contact us at the address below and we will act on it either way. You also have the right to complain to the Autoriteit Persoonsgegevens.

8. Contact

Privacy questions: support@reviowl.com. Reviowl (sole proprietorship), [your registered business address], the Netherlands.