Privacy policy

Who we are

ReviewLoop is a New Zealand service that sends Google review requests on behalf of businesses when their customers' invoices are paid. In this policy, "ReviewLoop", "we" and "us" mean the company that runs ReviewLoop.

We follow the Privacy Act 2020. This policy explains what personal information we collect, why we collect it, who we share it with, and what you can do about it.

Whose information we hold

Businesses that use ReviewLoop

When a business signs up, we hold information about the people who run the account: the owner, and any staff they add.

Their customers

When a business connects its invoicing system to ReviewLoop, we receive some details about that business's customers so we can send review requests for them. We handle this information on the business's behalf, and we only use it to provide ReviewLoop to that business. The business decides who its customers are and is responsible for having a lawful reason to contact them.

What we collect and why

We collect the minimum we need to run the service.

From businesses

Your name, business name, email address and phone number, so we can set up and run your account and contact you about it.
Login details. Passwords are stored in a form we can't read.
Billing details. Card payments are handled by Stripe, and we don't store full card numbers.
Your settings and message wording, so requests go out the way you want.
Records of how the service is used, such as when messages were sent, to keep it working and help with support.

From connected invoicing systems

Each customer's name, mobile number and email address, so we can send them a review request.
The invoice or job reference and the date the invoice was paid, so we know when to send it.

We don't need invoice line items or amounts, and we don't keep them.

From customers who respond

Whether they opened the link and tapped through to Google.
Anything they choose to tell the business on the feedback page, including a private note.
Opt-out requests, so we never message them again for that business.

From Google

When a business connects its Google Business Profile, we receive information from Google. The Google user data section below explains exactly what and why.

From our website

What you send us through a contact or sign-up form.
Basic technical information such as IP address and browser type, which our servers log for security.

How we use it

To provide ReviewLoop: sending review requests and reminders, showing reviews and private notes in the dashboard, and drafting replies.
To alert a business when a customer sends a private note.
To bill businesses for their subscription.
To answer questions and give support.
To keep the service secure and working properly.
To improve ReviewLoop, using combined information that doesn't identify anyone.
To meet our legal obligations.

We never use a business's customer details to market our own services, and we never contact those customers for any reason other than the review request the business asked us to send.

We never sell personal information. We share it only with the services we need to run ReviewLoop:

SMS and email delivery providers, such as Twilio and SendGrid, to deliver review requests.
Stripe, to process subscription payments.
Google, when a business connects its Business Profile and approves a reply to a review.
The invoicing systems a business connects (Xero, MYOB, ServiceM8 or Fergus), on that business's instruction.
Our hosting provider, which stores the data that runs the service.

We may also share information if the law requires it, or if it's needed to prevent a serious threat to someone's safety.

Some of these providers store information outside New Zealand. When that happens we take reasonable steps to make sure the information is protected in a way that's comparable to the Privacy Act 2020.

Storage and security

We take reasonable steps to protect personal information from loss, misuse and unauthorised access. That includes encrypting information sent between your device and our servers, limiting who on our team can access data, and storing the access tokens for connected services securely.

No system is perfectly secure, but we'll always tell you straight if something goes wrong. See privacy breaches below.

How long we keep it

We keep a business's account information, and its customers' details, while the account is active.

When a business cancels, we delete its customers' details and the reviews data we hold for it within 90 days, unless the business asks us to delete it sooner. We keep billing records for seven years, because New Zealand tax law requires it.

If a customer opts out, we keep a record of their opt-out so we can make sure they're never messaged again for that business.

Opting out of review requests

If you've received a review request through ReviewLoop and don't want any more, reply STOP to the text. We'll stop all future texts from that business through ReviewLoop. Emails include an unsubscribe link that does the same. You can also contact the business directly, or email us at privacy@reviewloop.co.nz.

Your rights

Under the Privacy Act 2020 you can ask for a copy of the personal information we hold about you, and ask us to correct it if it's wrong. Email privacy@reviewloop.co.nz. We'll respond as soon as we reasonably can, and within 20 working days.

If you're a customer of a business that uses ReviewLoop, we may pass your request to that business, since we hold your information on its behalf. We'll tell you if we do.

If you're not happy with how we've handled your information, please tell us first so we can try to fix it. You can also complain to the Office of the Privacy Commissioner at privacy.org.nz.

Privacy breaches

If a privacy breach happens that has caused, or is likely to cause, serious harm, we'll notify the Office of the Privacy Commissioner and the people affected, as the Privacy Act 2020 requires. If the breach affects a business's customer information, we'll tell that business straight away too.

Cookies

Our website and dashboard only use the cookies needed to make them work, such as keeping you logged in and remembering your settings. We don't use advertising cookies or cookies that track you across other websites.

Google user data

When a business connects its Google Business Profile to ReviewLoop, it signs in with Google and chooses to give ReviewLoop access. With that access we use:

The Business Profile's name and location, so we can show the right profile and create the business's review link.
The profile's reviews and ratings, so we can show them in the dashboard and draft replies.
Permission to post replies to reviews, which we only do when the business approves a reply.

We don't use Google user data for advertising, we don't sell it, and we don't let people read it except where the business asks us to for support, where it's needed for security, or where the law requires it.

ReviewLoop's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

A business can disconnect its Google Business Profile at any time from the ReviewLoop dashboard, or by removing ReviewLoop's access in its Google Account settings.

Changes to this policy

We may update this policy as ReviewLoop changes. When we do, we'll change the date at the top of the page. If a change is significant, we'll email the businesses that use ReviewLoop before it takes effect.

Contact us

For anything about privacy, email our privacy officer at privacy@reviewloop.co.nz. For anything else, email hello@reviewloop.co.nz or use our contact page.