Privacy Policy

From business customers (account holders):

• Email address — used as your login identifier and for OTP verification.
• Name and phone number, where you provide them.
• Business details: business name, locations, addresses, Google Business Profile links, branding and logo images you upload.
• Payment records: plan purchased, amount, currency, transaction and order identifiers, and payment status received from Razorpay. We never receive your full card number, UPI PIN or bank credentials.
• Support correspondence you send us.

From end customers who submit feedback:

• The rating and feedback text they submit, and any contact detail they choose to enter.
• Technical data attached to a QR scan or link visit: IP address, browser and device user-agent, timestamp, and which QR code or location was scanned. This is used for analytics and abuse prevention.

We do not knowingly collect data from children under 18, and the Service is not directed at them.

• To create and operate your account, and to authenticate you by OTP.
• To deliver the Service: generating QR codes and links, recording scans, storing feedback and rendering dashboards.
• To generate AI-assisted draft review text at your or your customer's request.
• To take payment, apply plan limits and AI credits, and send receipts.
• To provide support and to send essential service notices such as expiring subscriptions.
• To detect, prevent and investigate abuse, fraud and technical faults, including rate limiting.
• To comply with legal and tax obligations.

We do not sell personal data, and we do not use your customers' feedback to train our own models.

We process personal data on the basis of your consent (given when you create an account or submit feedback), to perform our contract with you, to meet legal obligations, and for our legitimate interest in securing and improving the Service. You may withdraw consent at any time by closing your account — this does not affect processing already carried out.

We use the following processors, each of which receives only the data needed for its function:

• Vercel — application hosting and request logs.
• Neon — managed PostgreSQL database hosting.
• Redis Cloud — short-lived storage for OTPs and rate-limit counters.
• ImageKit — storage and delivery of logo and banner images.
• Razorpay — payment processing. Razorpay handles your payment credentials under its own privacy policy.
• OpenRouter and the AI model providers it routes to — generation of draft review text. Prompts may include the business name, category and the feedback context needed to draft text.
• Google Maps Platform — address autocomplete and location data.
• Our email provider — delivery of OTP, receipt and notification emails.

We may also disclose data where required by law, or to protect our rights, safety or property.

Some of these providers operate outside India. Where data is transferred internationally, we rely on the provider's contractual safeguards to keep it protected at a standard comparable to this policy.

• All traffic is served over HTTPS/TLS.
• One-time passwords are encrypted at rest using AES-256-GCM and expire within 10 minutes, with a limited number of verification attempts.
• Sessions use signed tokens in HTTP-only cookies, and you can review and revoke active sessions from your account.
• Access to production infrastructure is restricted and credentials are held in the hosting provider's encrypted environment store.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authority as required by law.

• Account and business data is retained while your account is active.
• OTPs are deleted on use or expiry, within 10 minutes.
• Payment and invoice records are retained for as long as tax and accounting law requires.
• Reviews, scans and analytics are retained while your account is active so that your historical dashboards remain meaningful.
• After account closure we delete or anonymise personal data within a reasonable period, except records we must keep by law.

Subject to applicable law, including India's Digital Personal Data Protection Act, 2023, you may request access to the personal data we hold about you, correction of inaccurate data, deletion of your data, or a copy of it. You may also raise a grievance about how we handle your data.

To exercise any of these rights, email contact@reviewsnext.com from the address associated with your account. We aim to respond within 30 days. If you are an end customer who submitted feedback and want it removed, contact the business you gave it to, or contact us and we will pass the request on.

We use only the cookies needed to run the Service: authentication and session cookies, and a preference cookie for light/dark theme. We do not use advertising cookies or third-party tracking pixels. Blocking essential cookies will prevent you from logging in.

We may update this policy; the “Last updated” date above will change and material changes will be notified by email or in the dashboard.

For any privacy question or grievance, contact:
ReviewsNext (sole proprietorship)
Email: contact@reviewsnext.com
Phone: +91 86687 21925