ReviowlSign in

Privacy Policy

Last updated 2026-07-28

This policy explains how Reviowl ("we") handles personal data for the Reviowl service. We act as a processor for the customer contact data our business users upload, and as a controller for their own account data.

1. Data we process

Account data of business users (name, email, business details, billing identifiers). Contact data uploaded by business users (their customers' names, phone numbers, emails, visit dates) — used only to send that business's messages.

Prospect data about businesses we contact ourselves: publicly listed details (name, address, website, generic contact address) and, if we emailed you, whether the personalised preview page we linked was opened and when. That last part is a timestamp and a counter on the business record, so we can tell whether our outreach is worth continuing. We use no cookies, tracking pixels or third-party analytics for it, and it is never linked to an individual person.

2. How we use it

To provide the Service: sending review requests and win-back messages, enforcing opt-outs, billing, and support. We do not sell personal data. AI providers process message text solely to generate that message and do not train on it.

3. Opt-outs & suppression

Every message includes a one-click unsubscribe. Opt-outs are recorded on a global suppression list and checked immediately before every send, so an unsubscribe still holds if the same address is uploaded again later, by anyone.

4. Sub-processors

We use the following sub-processors. Each handles data only as needed to run the Service, and we name them here so you can assess them yourself.

  • Supabase — database and authentication. Hosted in the EU (Frankfurt).
  • Resend — delivery of review requests and win-backs. Hosted in the EU (Ireland).
  • Vercel — application hosting. Our functions run in the EU (Frankfurt).
  • Cloudflare — our domain, DNS, and the mail routing that forwards messages sent to our support address.
  • Zoho Mail — our own business mailbox, used for our outreach and your replies to us. Hosted in the United States.
  • Anthropic — generates message wording. Receives the business name, category, and language, and never your customer list.
  • Google — Places, used to find businesses to contact; and Gmail, as a fallback route for our own outreach mail. Neither is used on your customer data.
  • Stripe — payments, once billing is enabled. We never see or store card details.
  • Twilio — SMS delivery. Not in use yet; SMS is not currently offered.

5. Where your data is stored

Customer contact data is stored in the EU (Frankfurt), processed by application code running in the EU (Frankfurt), and sent through an EU email provider (Ireland). Our own mailbox and our support-mail forwarding sit in the United States, so if you email us directly that correspondence is processed there under the provider's standard safeguards.

6. Retention

Contact data is kept while the account that uploaded it is active. You can close your account from your Settings page at any time, which deletes your business, contacts, campaigns and message history immediately; if we ever have to do it by hand instead, it happens within 30 days. Suppression records (unsubscribes) are kept indefinitely on purpose: they are how we guarantee an opt-out is never overridden by a later upload, and they hold only the address and the fact of the opt-out. Businesses we contacted but who never became customers are removed within 12 months.

7. Your rights

You can request access, correction, erasure, portability, or object to processing. If a business messaged you using the Service, they are the controller of that data and are the fastest route, but you may contact us at the address below and we will act on it either way. You also have the right to complain to the Autoriteit Persoonsgegevens.

8. Contact

Privacy questions: support@reviowl.com. Reviowl, the Netherlands.