Privacy Policy

ReviewDesk is operated by APURI STUDIO INC (“we”, “us”). This policy explains what we collect when you use the service, why we collect it, and who else sees it.

We do not sell your data, and we do not use your customers’ reviews to train anyone’s models.

What we collect

From you

• Your email address and a hashed password
• Your restaurant’s name, address and menu details
• A mobile number and email address for alerts, if you provide them
• Billing details are handled entirely by Stripe. We never see or store your card number.

From your Google Business Profile

• Your reviews: the reviewer’s public display name, star rating, review text and date
• Your business listing name, address and location
• An access credential that lets us read reviews and post replies on your behalf, and — on plans that include it — publish menu items you have confirmed

We never receive your Google password. Access is granted through Google’s own authorisation screen, under the single permission Google calls business.manage, and is limited to the Business Profiles you choose. You can revoke it at any time from your Google account settings, and we will stop immediately.

About nearby businesses

For competitor benchmarking we record the public rating and review count of nearby restaurants at points in time. We keep our own measurements and the place identifiers, not copies of their review content.

How your Google credential is stored

The credential that lets us act on your listing is encrypted before it is written to our database, using a key held separately from the data. Someone who obtained a copy of our database would not be able to use it.

When you disconnect Google, or revoke our access from your Google account, the stored credential is erased at once. What remains is a dated record that access existed and when it ended, which we keep so that we can answer questions about our own conduct.

Google user data

ReviewDesk’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. In plain terms, that means all of the following, and we hold ourselves to them whether or not anyone asks:

• We use what we read from your Business Profile only to provide and improve the features you can see in ReviewDesk — drafting replies, alerting you, and reporting back to you.
• We do not sell it, and we do not transfer it for advertising.
• We do not use it to train anyone’s general-purpose models, including our own suppliers’.
• No person at ReviewDesk reads your Google data except where you have asked us to, where it is necessary for security or to fix a fault you have reported, or where the law requires it.

Draft replies are generated by sending the review text to our model provider, listed below, under terms that forbid training on it. That transfer is the one place your Google data leaves our systems, and it exists so that a reply can be written at all.

Who else processes your data

We use these companies to run the service. Each sees only what it needs to.

Review text is sent to OpenAI to draft a reply and to categorise what customers mentioned. Under OpenAI’s API terms this content is not used to train their models.

Where your data is processed

We are a Canadian company, but most of the companies above are based in the United States, and some process data in other countries. That means your information — including your business details, the reviews we read, the replies we draft, and the email address and phone number you give us for alerts — is stored and processed outside Canada.

While it is outside Canada, that information is subject to the laws of the country it is in, and may be accessible to courts and government authorities there. We choose providers that offer contractual protections comparable to what Canadian law requires, but we cannot put your data beyond the reach of foreign law.

Text message alerts in particular are sent through Twilio, which routes them onward through mobile carriers. Once a message is handed to a carrier network it is outside our control and is not encrypted end to end, which is why our alerts contain a link rather than the review itself.

If you would rather we did not text you, leave the phone number blank in your settings and we will send alerts by email only.

What we publish

When you approve a reply — or when you have switched on automatic replies for positive reviews — we post that text publicly on Google under your business’s name. We keep a permanent record of every reply that went out, who approved it and when, so you can always see what was published on your behalf.

How long we keep it

• Reviews and reports: for as long as your account is open
• Uploaded menu files: not retained. We extract the text and discard the file.
• Competitor measurements: kept as our own historical record, not as copies of Google’s content
• After you close your account: deleted within 30 days, except records we are required to keep for tax and accounting

Your rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Email privacy@reviewdesk.ca and we will respond within 30 days.

You can disconnect Google at any time from your settings, or revoke our access directly in your Google account. Neither requires talking to us.

Changes

If we change this policy in a way that materially affects you, we will email you before it takes effect.

Contact

APURI STUDIO INC
privacy@reviewdesk.ca