Privacy Policy
Last updated: 5 October 2026
1. Who we are
BizRevVue (“BizRevVue”, “we”, “us”) provides a review management and reputation platform for multi-location businesses, operated from Maharashtra, India. BizRevVue is responsible for the personal information described in this policy. For any privacy question, contact hello@bizrevvue.com.
2. Scope
This policy covers:
- the marketing website at bizrevvue.com;
- the BizRevVue application used by our business customers and their team members; and
- the public review-collection pages that customers of our business customers may visit after scanning a QR code.
Where a business customer uses BizRevVue to process information, that customer is the controller and BizRevVue acts as a processor on their instructions. A separate Data Processing Addendum governs that relationship — request it at hello@bizrevvue.com.
3. Information we collect
3.1 Account and workspace data
- Account identity: first and last name, email address, hashed password, avatar image (optional), and multi-factor authentication status.
- Workspace and organisation: workspace name, description, logo, timezone, currency, date format, language, business hours, and plan.
- Membership: role assignment, location scope, team membership, invitation status.
3.2 Session and security data
- Sessions: device, browser, operating system, approximate location derived from IP address, IP address, and session timestamps.
- Login events: success/failure result, device, approximate location, IP address, and timestamp.
- Audit logs: an immutable record of significant workspace actions, including the acting member, the action, the target and a category.
3.3 Review and business content
- Imported reviews from connected Google Business Profiles: author name as shown publicly, rating, review text, language, photos flag, source identifiers and timestamps.
- Replies your team drafts and publishes, including edit history.
- AI-derived metadata: sentiment, topics, category and keywords generated from review text; workspace-level insights and recommendations.
- Locations, competitors and listings you configure.
3.4 Review-collection (public QR flow)
The public review-collection flow is designed to collect no personal information and no login. It creates an anonymous, PII-free session token and records only the customer's in-flow selections (service, rating, experience attributes, optional free-text input used to generate a draft, chosen platform, language) and funnel events (scan, service selected, rating given, draft generated, redirected). Any personal detail a visitor types into a free-text field is processed to generate a draft review and is subject to the retention rules in section 8.
3.5 Integration credentials
When you connect Google Business Profile or another provider, we store OAuth tokens and the granted scopes needed to read locations and reviews and to post replies on your behalf. Tokens are stored encrypted and are used only for the connected workspace.
3.6 Website and product usage data
- Technical data: IP address, user-agent, pages viewed, referring URL, and a per-request identifier returned in the
X-Request-IDresponse header for support and debugging. - Diagnostics: structured application logs, distributed traces and aggregate metrics used to operate and secure the service.
- AI generation logs: for each AI call we record the model, provider, token counts, latency, estimated cost, status and the workspace/user it was made for.
4. Cookies
The application uses a single HTTP-only, Secure, SameSite=Lax session cookie to keep you signed in, plus a short-lived refresh mechanism. It does not store authentication tokens in browser storage. The marketing website uses only the cookies strictly necessary to serve the page and load web fonts from Google Fonts. We do not use analytics or advertising cookies.
5. How we use information
- Provide, secure and maintain the platform and website.
- Authenticate users, enforce roles and per-location scoping, and prevent abuse (rate limiting, lockout, idempotency).
- Import reviews, generate AI drafts and metadata, publish replies, run collection campaigns and produce analytics.
- Send transactional email (verification, password reset, invitations) and, where permitted, product and marketing communications you can opt out of.
- Provide support, investigate incidents and meet legal obligations.
6. Legal bases (where GDPR/UK GDPR applies)
- Contract: providing the service to account holders.
- Legitimate interests: securing the service, preventing fraud/abuse, product improvement, and B2B marketing to business contacts.
- Consent: non-essential cookies and certain marketing, where required.
- Legal obligation: tax, accounting and lawful requests.
7. How we share information
- Google: via your connected Google Business Profile, to read reviews and post replies you author.
- Sub-processors: infrastructure hosting, email delivery and the AI model provider used to generate drafts and metadata. A current list is available on request.
- Your configured recipients: Slack channels and webhook endpoints you set up.
- Professional advisers, acquirers and authorities where lawful and necessary.
We do not sell personal information.
8. Google user data
When you sign in with Google, we receive your Google account's name, email address and profile photo, and use them only to create and sign in to your BizRevVue account. When you connect a Google Business Profile, with your permission we access the Business Profile accounts, locations and reviews you manage, and post the review replies you choose to publish. We use this data only to provide BizRevVue's features to you. We do not sell it, use it for advertising, or share it except as described in this policy. You can disconnect Google at any time from your workspace settings, or revoke access from your Google Account's security settings.
BizRevVue's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
9. Retention
Account, workspace and review data are retained for as long as your account is active and then deleted or anonymised within a reasonable period after account closure, except where a longer period is required by law. Login history, audit logs, anonymous review-collection sessions and AI generation logs are kept only as long as needed to operate, secure and improve the Service. You can ask us to delete your data at any time.
10. International transfers
Data is processed in India and in other countries where our service providers (such as hosting, email and AI providers) operate. Where required, we use appropriate safeguards for these transfers.
11. Your rights
Depending on your location you may have rights to access, correct, delete, port or restrict processing of your personal information, and to object to certain processing. If your data is held by a BizRevVue business customer, we will refer your request to that customer. To exercise a right, contact hello@bizrevvue.com. You may also complain to your supervisory authority.
12. Security
We use least-privilege access controls, per-tenant isolation enforced with database row-level security, encrypted storage of third-party access tokens, secure HTTP-only session cookies and continuous monitoring. No method of transmission or storage is completely secure; we work to protect your information but cannot guarantee absolute security.
13. Children
The platform is a business tool and is not directed to children under 16. We do not knowingly collect their data.
14. Changes
We will post any changes here and update the date above; material changes will be notified to account holders.
15. Contact
BizRevVue
Maharashtra, India
hello@bizrevvue.com