Privacy Policy

LocalReviewDesk(“we”, “us”) provides a hosted tool that lets local businesses collect Google reviews and private feedback. This policy explains how we handle personal information collected through our website and service.

Privacy contact: privacy@localreviewkit.com.

Business owners who sign up for a LocalReviewDesk account, and end customers of those businesses who submit private feedback or visit a review page.

• Account data (business owners): email, password hash or Google OAuth identifier, business name, Google review URL, brand color, optional logo, optional phone and category.
• Billing data: we do not store card numbers. Stripe processes payments and stores a customer identifier we reference.
• Customer feedback: message, optional rating, and any contact details a customer voluntarily provides (name, email, phone) plus their consent-to-contact flag.
• Event logs:page views, button clicks, and submissions tied to a review page, used for the business’s analytics. No third-party tracking.
• Technical data: IP address (used for rate limiting and abuse prevention), request timestamps.

• Provide the service (account auth, review pages, inbox).
• Deliver email alerts and reports to business owners.
• Bill subscriptions through Stripe.
• Prevent abuse and spam (rate limiting).
• Comply with legal obligations.

We process personal data under one or more of the following bases:

• Contract: to deliver the service you signed up for.
• Legitimate interests: abuse prevention, security, improving the service.
• Consent:when a customer ticks “happy to be contacted” on a private feedback form.
• Legal obligation: tax, billing, security incident reporting.

We collect the information described in section 3 to provide the service. If we cannot collect it, we cannot create your account or deliver feedback to the business. We do not sell personal information. You may access or correct your information by contacting privacy@localreviewkit.com.

We use the following sub-processors. Primary database storage is in ap-northeast-1 (Tokyo).

• Supabase — Database, authentication, file storage (ap-northeast-1).
• Stripe — Subscription billing and payments (Global).
• Resend — Transactional email (Global).
• Vercel — Application hosting (Global edge).
• Upstash — Rate limiting (Global edge).

If you are in the EU/UK and your data is transferred outside the EEA or UK (for example to our sub-processors), we rely on standard contractual clauses or equivalent safeguards.

Account data is retained while your account is active. Feedback data is retained while the business owner has a LocalReviewDesk account. Cancelled accounts and their data are deleted within 30 days, except where we are required by law to retain longer (e.g. tax invoices).

Depending on where you live, you may have the right to access, correct, delete, port, or object to processing of your personal data. EU/UK residents may lodge a complaint with their supervisory authority. Australian residents may complain to the Office of the Australian Information Commissioner (OAIC). California residents have rights under the CCPA including the right to know, delete, correct, and opt out of sale — LocalReviewDesk does not sell personal information.

To exercise any of these rights, email privacy@localreviewkit.com.

The service is not intended for users under 16. We do not knowingly collect personal information from children.

We use industry-standard practices including transport encryption (TLS), database row-level security, and least-privilege access. No system is perfectly secure; if a breach affects you we will notify you as required by law.

We only use essential cookies. See the Cookies notice for details.

We may update this policy. Material changes will be reflected by updating the “Effective” date at the top of this page.

Questions or requests: privacy@localreviewkit.com.