Legal

Privacy Policy

Effective date: March 28, 2026  ·  Last updated: March 28, 2026

Exorous (trading as ReviewSpark) ("ReviewSpark", "we", "us", or "our") operates the website https://reviewspark.online and the ReviewSpark platform (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.

By using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Account and Business Data

When you create an account we collect:

  • Your name and email address (via email/password signup or Google OAuth)
  • Your business name, address, phone number, and website
  • Your Google Business Profile details (via OAuth consent)
  • Subscription and billing information (processed by Paddle — we do not store payment card numbers)

1.2 Your Customers' Data

To send review requests on your behalf, you provide us with your customers' contact information. We collect and store:

  • Customer name
  • Customer phone number (stored AES-256 encrypted at rest)
  • Customer email address
  • Review sentiment scores and feedback responses
  • SMS and email delivery status

You are responsible for ensuring you have the legal right to share your customers' contact information with us and to send them marketing or transactional communications.

1.3 Usage Data

  • IP address and approximate location
  • Browser type and device identifiers
  • Pages visited, features used, and timestamps
  • Review request send events and click-through data
  • Error logs and diagnostic information

2. How We Use Your Information

  • Sending SMS review requests to your customers via Twilio
  • Sending email review requests via Resend
  • Generating AI-drafted Google review replies via Google Gemini
  • Connecting to your Google Business Profile via the Google Business Profile API
  • Processing subscription payments via Paddle
  • Sending you transactional emails (weekly digest reports, payment alerts, system notices)
  • Providing dashboard analytics and reporting
  • Improving the Service, detecting abuse, and maintaining security
  • Complying with legal obligations

We do not sell your data or your customers' data to third parties. We do not use your customers' contact information for any purpose other than sending review requests on your behalf.

3. Third-Party Service Providers

We share data only with the third-party processors necessary to operate the Service. Each processor is bound by their own privacy and security commitments:

  • Paddle — Subscription billing and payment processing. Paddle acts as Merchant of Record and handles all payment card data directly. See paddle.com/legal/privacy.
  • Twilio — SMS delivery for review requests and opt-out processing.
  • Resend — Transactional email delivery.
  • Google — Google Business Profile API (review data, reply posting), Google Gemini (AI reply generation), and Google Places API (business lookup).
  • Supabase — Database hosting and user authentication infrastructure.
  • Vercel — Application hosting and edge network infrastructure.
  • Upstash — Redis-based rate limiting (no personal data stored).

4. SMS Communications and TCPA

ReviewSpark sends SMS messages to your customers solely on your instruction, using contact information you provide. By using the SMS review request feature, you represent and warrant that:

  • You have obtained the necessary consents from your customers to send them SMS messages
  • Your use complies with the Telephone Consumer Protection Act (TCPA) and all applicable laws

Every SMS we send includes an opt-out instruction. Customers who reply STOP are immediately unsubscribed and will not receive further messages from your account. Customers may also opt out at any time via https://reviewspark.online/api/unsubscribe.

5. Cookies and Local Storage

We use the following browser storage mechanisms:

  • Authentication cookies — Supabase sets a session cookie to keep you signed in. This cookie is strictly necessary for the Service to function.
  • localStorage (theme) — We store your light/dark mode preference locally in your browser. No personal data is involved.
  • localStorage (UI state) — We store transient UI state (e.g., dismissed onboarding banners) locally. No personal data is involved.

We do not use advertising or tracking cookies.

6. Data Retention

  • Account data — Retained for the duration of your account plus 90 days after deletion, unless a longer period is required by law.
  • Customer contact data — Retained for as long as your account is active. Deleted within 30 days of account termination.
  • Review and feedback data — Retained for as long as your account is active.
  • Usage logs — Retained for up to 12 months for security and debugging purposes.
  • Billing records — Retained for 7 years as required for financial and tax compliance.

7. Your Rights

Depending on your jurisdiction, you may have the following rights:

  • Access — Request a copy of the personal data we hold about you
  • Correction — Request correction of inaccurate data
  • Deletion — Request deletion of your personal data ("right to be forgotten")
  • Portability — Request your data in a machine-readable format
  • Objection — Object to certain processing activities
  • Restriction — Request that we restrict processing of your data

To exercise any of these rights, email us at contact@reviewspark.online. We will respond within 30 days.

8. GDPR — European Users

If you are located in the European Economic Area (EEA) or United Kingdom, the following additional terms apply.

Legal basis for processing

  • Contract performance — Processing necessary to provide the Service you subscribed to
  • Legitimate interests — Usage analytics and security monitoring
  • Legal obligation — Financial record retention
  • Consent — Where you have provided explicit consent (you may withdraw at any time)

International data transfers

Our infrastructure providers (Vercel, Supabase, Google, Twilio) operate servers in the United States. When your data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs) or the recipient's adequacy decision to ensure appropriate protection.

Data Protection

We do not have a formal Data Protection Officer given our current scale. For GDPR-related inquiries, contact us at contact@reviewspark.online.

9. Children's Privacy

The Service is not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately.

10. Security

We implement industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest for sensitive fields, and access controls. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you by email. Continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy, please contact:

Exorous (trading as ReviewSpark)
Mirpur, Dhaka, Bangladesh
Email: contact@reviewspark.online
Website: https://reviewspark.online