Last updated: November 2026 · Questions: hello@heyreviewflow.com
ReviewFlow (“Processor”) processes the customer contact records and CRM data supplied by the Client (“Controller”) solely to send review invitations, collect ratings and feedback, and (for Done-For-You clients) manage Google Business Profile replies on the Client’s behalf. Processing is limited to the Client’s documented instructions. The Client owns all of its data; the Processor acquires no rights in it.
The Processor treats all Client data, CRM credentials and access as strictly confidential. It will not sell, rent, trade, disclose or use that data for marketing or any purpose other than providing the service, and will not combine it with any other client’s data. Access is limited to personnel who need it and who are bound by confidentiality. These obligations survive termination.
Data is encrypted in transit (TLS) and at rest. Credentials and tokens are stored encrypted, passwords are hashed, access to production systems is restricted and logged, and each client’s data is logically isolated from others. The Processor will notify the Client without undue delay after becoming aware of a breach affecting its data.
The Client authorises these subprocessors: Turso (database hosting), Vercel (application hosting), Telnyx / Twilio (SMS delivery), Resend (transactional email) and Polar.sh / Paddle (Merchant of Record payment processing). Each is bound to data-protection terms no less protective than this agreement. The Processor will give notice of material changes to this list.
All end-customer contact records are permanently deleted within 30 days of subscription cancellation, or immediately upon written request from the Client. CRM access is revoked on termination. Limited billing records may be kept where the law requires.
The Client confirms it has obtained prior express consent (including under the TCPA and CAN-SPAM) from each customer whose details it provides, and will comply with the Terms of Service. See also the Privacy Policy.
Agreed by ReviewFlow
Authorized signature
Name & date
Client
Client business name
Authorized representative
Date