Privacy Policy

1. What we collect

• Account data: your email address (for sign-in and email alerts).
• Google Business Profile data: an OAuth token (stored encrypted with AES-256-GCM), your business locations, and the public reviews of those locations (reviewer display name, star rating, review text, timestamps).
• Contact channels you configure: your Telegram chat ID and, if you enable SMS, your mobile number together with a timestamped record of your consent.
• Billing data: handled by Stripe; we never see or store full card numbers.

2. How we use it

Solely to provide the Service: detecting new reviews on the locations you connected and notifying you on the channels you chose (legal basis: performance of contract; for SMS, your explicit consent). We do not sell personal data, and we do not use your data for advertising.

3. Retention

• Review data: retained while your account is active, up to 90 days per review, then purged.
• OAuth tokens: deleted immediately when you disconnect Google or delete your account (we also revoke them with Google).
• SMS consent records: retained as long as required to demonstrate compliance.

4. Your rights (GDPR / CCPA)

You can access, correct, export or erase your data. Deleting your account from the dashboard removes all your data automatically — subscription cancelled, Google access revoked, database rows erased. For any other request, email support@businessreviewalerts.com; we respond within 30 days. We do not discriminate against users who exercise privacy rights.

5. Security

All traffic is encrypted in transit (TLS). Google tokens are encrypted at rest with AES-256-GCM. Database access is restricted with row-level security so each account can only read its own data.

6. Contact

Data controller: BusinessReviewAlerts · support@businessreviewalerts.com