Privacy Policy
ReviewVoice writes replies to the Google reviews your business receives. To do that we need access to your Google Business Profile. This page says exactly what we take, how long we hold it, and how to make us delete it.
The short version
We keep review content from Google for no more than 30 days. What we keep longer is our own record — counts, dates, star ratings and the replies we wrote — and longer text analysis runs on a separately licensed copy, never on Google's. We do not sell your data, we do not use it to train models, and we run no advertising or analytics trackers. We do count, on our own servers, how far people get with the product — never with your IP, email or review text. You can disconnect Google at any time and have everything deleted by sending us one email.
01 Who we are
ReviewVoice is the service described at review-voice.com. It is operated by East Light Labs Co., Ltd. (이스트라이트랩스), a company registered in the Republic of Korea, which is the data controller for the information described below. For anything in this policy — questions, data requests, complaints — write to hello@review-voice.com.
The service is currently in private testing. It is not open to the public, no payments are being taken, and the only accounts that exist are ones we set up ourselves.
02 What we collect
| What | When | Why |
|---|---|---|
| Your email address | When you join the waiting list | To tell you when a spot opens. We also record which form you used and the time. |
| Your IP address | When you join the waiting list | Only to stop one machine from flooding the list. It is not used to identify or profile you, and it is deleted with the rest of your entry when you ask. |
| Google account email | When you connect Google Business Profile | To show you which account is connected. |
| Google access tokens | When you connect Google Business Profile | To read your reviews and post the replies you approve. Nothing else. |
| Which business you picked | When you connect Google Business Profile | Google's identifiers for the account and location you selected. |
| Review content from Google | Continuously, while connected | Reviewer name, star rating, text, photos and date — used to draft a reply. Name, text and photos are deleted within 30 days. The star rating and date stay as counts (see the note below). |
| Replies we wrote | Every time we draft or post | Our own record of what we did on your behalf. This is our text, not Google's. |
| Your settings | When you change them | Reply mode, timing, tone dials, and any contact detail you choose to include in replies. |
| Consent records | When you turn automatic posting on or off | The exact wording you agreed to, its version, the time, and your browser's user agent. |
03 Google user data
When you connect your Google Business Profile, we ask Google for one permission:
business.manage. That lets us read the reviews for the location you picked and post
replies to them. We also read your account email so we can show you what is connected.
ReviewVoice's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, we do not:
- sell your Google data, or hand it to advertising platforms, data brokers or information resellers;
- use your Google data for advertising, or to build profiles for advertising;
- use your Google data to train, retrain or improve any machine learning model;
- let a human read your Google data, unless you ask us to look at something, we need to for a security investigation, or the law requires it.
Where your review text does go. To write a reply draft, we send the review text and your business name to Anthropic, which runs the AI that writes it. That is the feature you signed up for, and it is the only reason the text leaves us. Anthropic processes it on our instructions under contract, may not use it for its own purposes, and does not train models on it. Google's Limited Use rules allow a transfer like this only to provide the user-facing feature you asked for, and only with your consent — which is exactly what this is. Section 05 lists every provider and what each one receives. We do not transfer your Google data for anything else.
The 30-day rule
Google's Business Profile API terms say review content may only be stored temporarily, for at most 30 calendar days, and may not be manipulated or aggregated. We follow this. Each review we fetch is stamped with an expiry date, and the content is erased on or before that date. What survives is our own record: the reply we wrote, when we wrote it, and whether it posted.
Updated 7 September 2026. An earlier version of this page said we did not offer long-run review analytics at all, and that we would tell you here before adding any. We have since added weekly, monthly and all-time reports, so here is exactly what each part runs on:
- Review wording is never analysed after 30 days. Once the content is erased it is gone, and every text analysis (topics, what guests praise, recurring complaints) skips erased reviews.
- Counts, dates and star ratings stay. How many reviews arrived in a month, and the average rating, are counts we keep — no review wording is involved. That is what the long-run charts are built from.
- Longer text analysis uses separately licensed data. Where we look further back than 30 days at what reviews actually said, that runs on a licensed copy from DataForSEO, who confirmed in writing on 7 August 2026 that we may retain and analyse it. It is kept apart from the Google copy and labelled as such.
We should have written this before shipping the reports rather than after. This paragraph is the correction, left visible rather than quietly replaced.
04 What we never do
- We do not write, buy, solicit or filter reviews. We only reply to reviews your customers left on their own.
- We do not sell, rent or trade your data.
- We do not run advertising or marketing trackers. There is no Google Analytics, no Meta pixel,
no ad network tag, and nothing about you is sold or handed to an advertiser.
One correction, added 7 September 2026: our host, Cloudflare, automatically adds
its own page-speed script (
cloudflareinsights.com) to every page. It is cookieless and counts page loads and load times; we did not add it and we do not use it for advertising. We had written that there were no analytics scripts at all — that sentence was wrong, and this is the correction rather than a quiet edit. - We do not post a reply to a review below four stars without you approving it first.
04b The one thing we do count, on our own servers
We keep a short record of how far people get with the product: that someone started the Google connection, that a business finished connecting, that a first draft was written, that a first reply went out. Each of these is stored once, on our own servers, and it tells us where people get stuck.
Alongside each of those we store the campaign name from the link you arrived on (the
utm_source style values we put in our own adverts) and a random number we generate in
your browser so the first visit and the later sign-in can be recognised as the same journey. That
random number is ours, it means nothing outside this site, and it expires after 90 days.
What this record never contains: your IP address, your email, your name, your review text, or anything a customer wrote. It is not shared with anyone, and no third party can read it. If you would rather not be counted at all, block cookies for this site — the product works exactly the same.
05 Where it is kept, and who can see it
Everything is stored on Cloudflare's platform (Workers and D1), which processes and hosts the data on our behalf. Access is limited to the people running ReviewVoice.
What your browser loads from other companies. Each of these sees your IP address when the page loads, the same way any website you visit does. We checked the live pages on 7 September 2026 and this is the complete list:
- Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — typefaces, every page
- unpkg.com — the icon stylesheet, on the home page and the app
- Cloudflare — the bot check on the sign-up form, and the page-speed script noted above
- Paddle (cdn.paddle.com) — the checkout window, loaded in the app
- i.pravatar.cc and picsum.photos — placeholder faces and pictures, used only by the sample data in the demo. Your own reviews never load from them.
The older wording said fonts and icons were the only two. Those two providers will see your IP address when the page loads, as they would on any site that uses them. We do not send them anything else.
Who else processes it
We use a small number of providers to do specific jobs. They act on our instructions, only receive what the job needs, and are not allowed to use it for their own purposes. We do not sell your data, and we do not share it with advertisers or data brokers.
| Provider | What it does | What it receives |
|---|---|---|
| Cloudflare | Hosting, database, bot check | Everything we store, and your IP address |
| Sign-in, and reading and replying to your Business Profile | Your Google account identity, and the replies you approve | |
| DataForSEO | Reads public Google reviews and map rankings | Your Google Place ID, your language and country |
| Anthropic | Writes reply drafts and summarises reviews | Review text and your business name |
| Anthropic (Claude) | Checks whether AI assistants recommend businesses like yours | Your trade and city only — never your business name or reviews |
| OpenAI, Google Gemini, Perplexity, Foursquare | Same checks, planned — not in use today. We will update this page before we switch any of them on. | Nothing is sent to them at present |
| MailerSend | Sends sign-in links and alerts | Your email address and the message |
| Paddle | Takes payment as merchant of record, and issues refunds | Your name, email, billing country and payment details — card numbers go straight to Paddle and never reach us |
We may also disclose data if the law requires it, or to protect our rights or someone's safety. If we ever transfer the business, we will tell you before your data moves, and this policy will travel with it.
06 How long we keep things
| Data | Kept for |
|---|---|
| Review content from Google | Up to 30 days, then erased |
| Google access tokens | Until you disconnect, or you ask us to delete |
| Replies we wrote and posting logs | Kept as our record of what we did |
| Your settings and consent records | While your account is open |
| Waiting-list email and IP | Until you ask us to remove it |
07 Your controls
Disconnect Google yourself
Go to myaccount.google.com/permissions, find ReviewVoice, and remove access. Our tokens stop working immediately.
Have everything deleted
Email hello@review-voice.com and ask. We will delete your account, tokens, settings and any review content still inside the 30-day window, and confirm when it is done. We aim to do this within 30 days.
If you are in the EU, the UK or a similar jurisdiction
You have the right to see the data we hold about you, correct it, have it deleted, take a copy elsewhere, and object to how we use it. Use the same address above. You also have the right to complain to your local data protection authority.
08 Children
ReviewVoice is a tool for business owners. It is not intended for anyone under 16, and we do not knowingly collect their data.
09 Changes to this policy
If we change how we handle data, we will update this page and change the date at the top. For anything material — a new category of data, a new recipient, a longer retention period — we will email connected accounts before it takes effect.