Draft for legal review. This text is a working draft and becomes final only after review by counsel. Bracketed items are filled in before launch.

Last updated [Month DD, YYYY]

Privacy policy

How RaveRobin handles the information businesses send us and the customers we contact on their behalf.

The short version

We use customer details only to send the review request the business asked for.
We never sell personal data and never use it for advertising.
Anyone can opt out from any message, and we stop for good.

1. Who we are

RaveRobin is operated by [RaveRobin legal entity] (“RaveRobin”, “we”). For business accounts we are the controller of account data. For the customers of a business, the business is the controller and we process their data on its behalf under our Data processing addendum.

2. Information we collect

From businesses: account details (name, email, password hash), business name, address, time zone, the Google listing’s place ID, booking emails they forward and booking data sent by API or CSV.
From their customers: name, email or phone, the service and time of the visit, and anything they choose to submit on the review page (rating, review text, website-sharing choice, private feedback).
Technical data: IP addresses used briefly for security and rate limiting, and essential cookies (see Cookies).

3. How we use it

To schedule and send review requests and one reminder, show reviews customers agreed to share, send the business its reports and alerts, keep the service secure, and bill businesses. We do not write reviews for anyone, and we never use customer data for advertising or profiling.

4. Google Maps Platform

RaveRobin uses Google Maps Platform (the Places API) to let a business find its Google listing and to show its current Google rating. We store only the listing’s place ID. By using these features you are also bound by Google Maps/Google Earth Additional Terms of Service and the Google Privacy Policy. Posting a review on Google happens on Google’s own site under Google’s terms.

6. If a business sent us your details

You get at most one request and one reminder per visit, never more than once in 90 days, and every email has a one-click “Don’t ask me again” link. Your review appears on the business’s website only if you tick the box, and only with your first name and last initial. Private feedback goes only to the business.

7. How long we keep it

Raw booking emails: deleted after 30 days.
Review links stop working after 30 days.
Booking, customer and review data: kept while the business’s account is active and deleted [N] days after it closes, or earlier when the business deletes a customer.
Opt-outs and bounced addresses: kept so we never contact that address again.

8. Your choices and rights

You can ask to access, correct or delete your information, or ask us to stop contacting you. If a business sent us your details, we will pass your request to that business and help it respond. Residents of California, Canada and other places may have additional rights under local law.

9. Security

Encryption in transit and at rest, hashed review and unsubscribe tokens, least-privilege access, and logs that exclude personal data.

10. Changes to this policy

We will email business owners before material changes take effect and update the date above.

Questions? Write to [email protected] or [postal address].