Privacy Policy

1. Information we collect

• Business account details you provide at sign‑up: business name, email, phone number, GSTIN (if any), city, state, category, and Google Business Profile URL.
• Authentication data: one‑time passwords (OTP) sent to your email/phone for sign‑in, and session tokens stored in your browser's local storage.
• Google account data (only with your explicit consent): if you connect your Google Business Profile via Google OAuth, we access the reviews on your own listing (reviewer display name, star rating, review text, timestamp) and your account/location identifiers — read‑only.
• Reviewer information: publicly available details of Google reviewers (display name, profile link, review text, rating) that businesses submit or import in order to flag suspicious reviewing patterns.
• Usage logs for security and audit.

2. How we use information

• To operate the service: detect suspicious review patterns, let you flag reviewers, and generate evidence to report reviews to Google.
• To verify businesses (admin review) and prevent abuse/fakes.
• To send transactional messages (OTPs, account/verification notices).
• To secure the service and comply with law.

3. Google user data — Limited Use

ReviewSting's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google Business Profile review data only to provide the review‑monitoring and reporting features you request.
• We do not sell this data, use it for advertising, or transfer it to third parties except as necessary to provide the service, with your consent, or as required for security or legal reasons.
• We do not allow humans to read this data except with your consent, for security/abuse/legal purposes, or where the data is aggregated/anonymised.
• You can disconnect Google at any time, which revokes our access and stops further data retrieval.

4. Sharing & disclosure

• Reviewer database (shared): flags and publicly‑sourced reviewer information are pooled across businesses so the network can identify reviewers who target many businesses. This concerns reviewers' public review activity — not your private Google account data.
• Your private data (your account details and your own Google reviews fetched via OAuth) is not shared with other businesses.
• Service providers: we use Supabase (database, AWS Mumbai) and Google Cloud (hosting) under their data‑protection terms. We do not sell personal data.
• We may disclose information if required by law.

5. Data retention & deletion

We keep account and review data while your account is active. Disconnecting Google revokes access and stops new retrieval; you may request deletion of stored Google review data. You can request closure of your account and deletion of your personal data by emailing us (below). We delete or anonymise data we are not legally required to retain.

6. Security

Data is stored in access‑controlled systems with encryption in transit (TLS). Access is restricted to authorised personnel for the purposes above.

7. Your rights (DPDP Act, 2023)

You may request access to, correction of, or erasure of your personal data, and may withdraw consent (including the Google connection) at any time. Contact us to exercise these rights.

8. Cookies / local storage

We store session tokens in your browser's local storage to keep you signed in. We do not use third‑party advertising cookies.

9. Children

ReviewSting is for businesses and is not directed at children under 18.

10. Changes

We may update this policy; we'll post the new "Last updated" date here.

11. Contact

Questions, data requests, or complaints: Grievance Officer, BlueSting — contactus@bluesting.com (we respond within 48 hours on business days).