Privacy Policy
Last updated: August 2026
ReviewFlow ("we", "us") is operated from Portugal. This page explains what data we collect, why, and how you can control it. If anything here is unclear, email us at info@reviewflowhq.org — we'll answer directly, not with a bot.
1. Who this applies to
Two kinds of people interact with ReviewFlow: business owners who sign up for an account, and their clients — the people who get booked, reminded, and asked for a review. This policy covers both.
2. What we collect
From business owners: business name, owner email, a hashed password (we never store or see your actual password), your Google review link, your working hours and appointment settings, any custom fields or service presets you define, your language preference, and — if you signed up through a partner — which one.
From your clients (entered by you, or by them directly if you're on the Complete plan): name, email, phone number, appointment date and time, any custom field values you've chosen to collect (which may include a photo), and, if they choose to leave it, private feedback.
3. What we don't do
- We don't sell your data, or your clients' data, to anyone.
- We don't use it for advertising.
- We don't share it with anyone beyond what's needed to run the service (below).
- We never let private feedback determine who receives the public review request — every client gets asked, unconditionally. This is a fixed rule of how ReviewFlow works, not a setting.
4. Who we share it with
Two processors, both solely to make the product work:
- Resend — delivers the emails ReviewFlow sends on your behalf (confirmations, reminders, review requests, feedback requests).
- Railway — hosts our application and database.
Neither is permitted to use your data for their own purposes.
5. Cookies and tracking
This website does not currently use analytics or advertising cookies. If that changes, this page will be updated first and a consent option will be added for visitors in the EU.
6. How long we keep data
For as long as your account is active. If you close your account, or ask us to delete your data, we'll remove it — email info@reviewflowhq.org and we'll confirm once it's done.
7. Your rights
You can ask us, at any time, to access, correct, export, or delete the data we hold about you or your clients. Just email us — no formal process, no fees.
8. Security
Passwords are hashed, never stored in plain text. Access to business data is scoped so one account can never see another's. No system is perfectly secure, but we take reasonable, current precautions and keep improving them.
9. Children
ReviewFlow is a business tool. It isn't directed at, or knowingly used by, children.
10. Changes
If this policy changes in a meaningful way, we'll update the date above and, where appropriate, let account owners know by email.
11. Contact
ReviewFlow, Portugal — info@reviewflowhq.org