Legal

Privacy Policy

Last updated: 2 July 2026

This Privacy Policy explains how ReviewFlow (“ReviewFlow”, “we”, “us”) collects, uses, stores, and shares personal data when you use our service at reviewflow.arestadigital.pt (the “Service”). ReviewFlow helps business owners draft and publish replies to their Google Business Profile reviews.

1. Who we are (Data Controller)

The data controller responsible for your personal data is [Legal entity name], [registered address], Portugal (NIF [NIF]). For any privacy question or to exercise your rights, contact us at privacy@arestadigital.pt.

2. What data we collect

• Account & authentication data — your name and email address, and the identity provided by your login provider (Google or Microsoft). We do not store a password.
• Google Business Profile data — when you connect a profile, we access your business/location information, your reviews (review text, star rating, and the reviewer’s display name), and we publish the reply text you approve. This is accessed with your explicit consent through Google’s OAuth flow.
• Billing data — your subscription plan and status. Card details are collected and stored by Stripe, our payment processor; we do not receive or store your full card number.
• Usage & technical data — log data, IP address, browser/device information, and error diagnostics needed to operate and secure the Service.
• Communications — emails you send us and transactional emails we send you.

3. Why we use your data & legal basis

Under the GDPR, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to create your account, connect your Google Business Profile, generate and publish review replies you approve, and manage your subscription.
• Legitimate interests (Art. 6(1)(f)) — to secure the Service, prevent abuse, monitor errors, and improve the product, balanced against your rights.
• Consent (Art. 6(1)(a)) — for any optional marketing communications, and via Google’s consent screen for access to your Business Profile data. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — to retain invoicing records as required by Portuguese law.

4. Google user data & Limited Use

ReviewFlow’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data obtained from your Google Business Profile is used only to provide ReviewFlow’s features. We:

• use it solely to display your reviews and to draft and publish the replies you approve within ReviewFlow;
• do not sell it, and do not transfer it to data brokers, advertising platforms, or other information resellers;
• do not use it for advertising, retargeting, or interest-based advertising;
• do not use it to determine credit-worthiness or for lending purposes;
• do not use it to train generalized AI/ML models — review text is sent to our AI provider only to generate a draft reply for you to approve (see §12), never to improve third-party models;
• do not allow humans to read your Google data except: with your explicit request (e.g. for support), where necessary for security, or where required by law.

In line with Google’s Business Profile API policies, we do not cache Google-provided content longer than needed to provide the feature (and no more than 30 days for content not actively in use), and we never let third parties reuse our API access for their own purposes.

5. How we share your data (sub-processors)

We share personal data only with the service providers below, strictly to run the Service:

We may also disclose data where required by law, or to protect our rights, safety, or property.

6. International data transfers

Some of our providers (including Stripe, Anthropic, Vercel, and Sentry) process data in the United States. Where we transfer personal data outside the European Economic Area, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework where the recipient is certified. You can request more detail about these safeguards using the contact above.

7. Data retention

• Account data is kept while your account is active and deleted within 30 days of an account-deletion request.
• Google OAuth tokens are deleted when you disconnect a business or close your account.
• Billing and invoicing records are kept for the period required by Portuguese tax law.
• Error logs are retained according to our monitoring provider’s configured retention period.

8. Data security

We apply appropriate technical and organisational measures. Google OAuth access and refresh tokens are encrypted at rest using AES-256-GCM; data in transit is protected with TLS; and access to production data is restricted to authorised personnel. No system is perfectly secure, but we work to protect your data and to respond promptly to any incident.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased (“right to be forgotten”);
• restrict or object to processing;
• receive your data in a portable format;
• withdraw consent at any time, where processing is based on consent.

To exercise any right, email privacy@arestadigital.pt. You also have the right to lodge a complaint with Portugal’s supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD).

10. Automated decision-making

ReviewFlow uses AI to suggest a draft reply to each review. Drafts are never published automatically — you (the business owner) always review, edit, and approve a reply before it is sent to Google. There is no solely-automated decision that produces legal or similarly significant effects.

11. Cookies

We use only cookies that are strictly necessary to sign you in and keep your session secure. We do not use advertising or cross-site tracking cookies.

12. Children’s privacy

The Service is intended for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16.

13. Changes to this policy

We may update this policy from time to time. We will post the new version here with an updated date and, for material changes, notify you by email or in-app.

14. Contact us

Questions about this policy or your data? Email privacy@arestadigital.pt.