Privacy Policy

ReviewLoop is a BizPilot.shop product built and operated by PS Automation Hub ("we", "us"). This policy explains what personal data we handle, why, and the choices you have. It covers two groups of people: customers who scan a business's QR code and leave feedback, and business owners who hold a ReviewLoop account.

1. Customers who scan a QR code

No account, name, email or phone number is needed to leave feedback. When you use a review page we collect only what is needed to make it work:

• your star rating, any aspects you tick, and any comment you type;
• basic interaction events (page opened, rating chosen, feedback submitted, draft requested, review button clicked);
• if the business has turned on discounts or coupons, the coupon or offer shown to you and when it expires.

Comments are free text, so please do not include sensitive personal details. The feedback belongs to the business whose QR code you scanned, which uses it to understand and improve its service. We do not sell it.

2. Business owners

We collect and hold:

• Account data: name, email, and a password (stored only as a salted hash by our authentication provider) or your Google sign-in identifier if you use Google.
• Business data: business and branch names, mobile number, address, Google review link, category, logo, brand colour and messages, discount settings.
• Billing data: chosen plan, currency, and invoices or quotations we issue. We do not currently store card details; payment is arranged manually.
• Security and usage data: sign-in sessions and devices, IP-derived country (used to choose INR or USD pricing), and error logs used to keep the service secure and working.

3. Why we use data, and our basis

• To provide the service you asked for: showing review pages, storing feedback, running your dashboard (performance of a contract).
• To create accounts, review signups, and send service emails such as signup received, activation and invoices (contract, and our legitimate interest in running the service).
• To secure the service, prevent abuse and rate-limit anonymous traffic (legitimate interests).
• To improve the product using aggregated, anonymised statistics.
• Where the law requires it, on the basis of your consent, which you can withdraw at any time.

4. AI processing

Most review drafts are generated by an offline template engine in your browser, with no data sent to an AI provider. Only when a customer types a free-text comment and the business's plan and quota allow it, the rating, selected aspects, business name and that comment are sent to our AI provider (Anthropic) solely to write a draft. The model is instructed to use only what the customer supplied. We do not use this data to train models. The customer decides whether to use, edit or discard the draft and whether to post it.

5. Who we share data with

We share data only with service providers who process it on our behalf, and only as needed:

• Supabase: database and authentication;
• Vercel: hosting and content delivery;
• Hostinger: email delivery for our transactional email;
• Anthropic: AI drafts, as described above;
• Google: when you choose Google sign-in, or a customer follows a review link to Google, which is then governed by Google's own privacy policy.

Some of these providers process data outside India. We do not sell personal data and do not share it for advertising. We may disclose data if required by law or to protect rights and safety.

6. Cookies and analytics

We use a small number of essential cookies to keep business owners signed in and the service secure. They are required for the service to work and are always on. Customers scanning a QR code are not tracked with advertising cookies.

We measure visits to our marketing website (pages viewed, referrers, device type) with privacy-friendly analytics that do not use advertising cookies and do not identify individual visitors. If we enable an additional analytics tool that sets cookies, it only loads after you choose "Accept" in the cookie banner. You can change your choice at any time by clearing this site's data in your browser.

7. Retention

We keep business data while the account is active. After an account is closed we delete or anonymise its data within a reasonable period (normally within 90 days), except records we must keep for tax, accounting or legal reasons, such as invoices. Customer feedback is kept for the business that owns it until that business deletes it or closes its account. Backups and logs roll off on a fixed schedule.

8. Security

Access to each business's data is enforced in the database so one business cannot read another's. Traffic is encrypted in transit, anonymous submissions are validated and rate-limited, and admin sessions are restricted. No system is perfectly secure; if a breach affecting your data occurs we will notify you and the relevant authorities as the law requires.

9. Your rights

Under India's Digital Personal Data Protection Act, 2023, and other laws that apply to you, you may ask to access, correct, or delete your personal data, withdraw consent, and raise a grievance. Business owners can edit most data in the dashboard. For anything else, or to have data removed, write to us at the address below. Customers who left feedback through a business's QR code can also ask that business to delete it. We respond within a reasonable time and normally within 30 days.

10. Children

The service is for businesses and is not directed at children under 18. We do not knowingly collect personal data from children. If you believe we have, contact us and we will delete it.

11. Changes

We may update this policy. The date at the top shows the latest version, and we will notify account holders of material changes by email or in the dashboard.

12. Contact and grievances

Privacy questions, requests and grievances: support@bizpilot.shop, or our contact page. Our Terms of Service also apply.