Privacy policy

ReviewComet is a review management service. It collects the reviews a business receives on the review sites it connects, helps the business answer them, and helps it ask its own customers for reviews. It is operated by Marketing Released B.V., a private limited company established in the Netherlands. The full company details are on our company information page. This policy explains what we do with personal data when you visit reviewcomet.com, when you use the app, and when we handle reviews, reviewer details and customer contacts on your behalf.

For your own account data, such as your name, your email address and your billing history, Marketing Released B.V. is the data controller. For the reviews and reviewer details we collect from your connected review sites, the customer contacts you add, and the private feedback your customers send you, you are the controller and we act as your processor. That split matters, because it decides who a person writes to about their data. The processor side is governed by our data processing addendum.

Questions about anything here go to privacy@reviewcomet.com.

Account and workspace data

Your name, email address, password hash, the locations you create, the people you invite and the role you gave each of them. If you enable two-factor authentication we store the secret and your recovery codes.

Signing in with Google, Microsoft or Facebook

If you sign in with one of these, we ask only for the basic sign-in permissions (for Google: openid, email and profile) and receive your name, your email address and the account identifier the provider gives our app. We store the identifier and the email address so we can recognize you next time. We do not store an access token from the provider and we do not call it again on your behalf. ReviewComet’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Connected review sources

When you connect a review site we store the access token the site issues, the identifiers and names of the Pages it covers, the permissions you granted, and the expiry. Tokens are encrypted at rest and are never shown back to you or to anyone else in your workspace. We do not receive or store your Facebook password at any point.

Facebook is the review site you can connect today: you choose which Facebook Pages to connect, through Facebook’s own login. Other sites are listed in the app as coming soon and collect nothing. We update this policy before a new site starts collecting data. Nothing is collected from a site you have not connected.

Reviews and reviewer details

For each connected Page we collect its reviews, which on Facebook are the Page’s recommendations. Each review brings the reviewer’s display name and the identifier the site attaches to them, their profile picture where the site provides it, the rating or the recommend or don’t recommend choice, the review text, and when it was posted or edited. We store the replies your business posts back. We add our own record on top: the sentiment our classifiers assigned, the reply status, who replied and when, a translation where you use one, and any assignment, flag or archive.

We do not read private messages, and we do not collect anything about people who have not reviewed your business, apart from the customer contacts you add yourself.

Review requests and customer contacts

To ask your customers for reviews you add them as contacts, one at a time or by importing a CSV file: their name, email address and, if you add one, phone number, plus their language and time zone. We store where their consent came from and when, each request you send them, and when they opened the review page or chose a review site. Requests go out by email today.

Every request carries an unsubscribe link that works without a login. Unsubscribing adds the address to your account’s suppression list and stops any pending requests. An address whose mail bounces permanently, or whose owner reports it as spam, goes on the same list. The list keeps a one-way hash of the address, not the address itself.

Every customer you ask gets the same review page with the same review sites. Nothing on it depends on a rating, and the private feedback form, where you switch it on, sits beside the sites rather than in front of them.

Private feedback

A visitor to your review page can send you private feedback: the message, a rating if they give one, and the name and email address they type in, or the contact’s own details when they arrived from a request. It goes to you and is never published, on a review site or on a widget.

Review widgets

A widget you embed on your website loads a script from our host and fetches your published reviews. It sets no cookies and stores nothing in the visitor’s browser. It shows a reviewer’s first name and last initial, the rating, the text and the date, and nothing else about them. Like any request to a web server, loading it passes the visitor’s IP address and browser details to our hosting provider.

Support tickets

The messages and images you send to support, and any assistant conversation you choose to attach to a ticket.

Usage and technical data

Log records of requests to the app and the API, including IP address, browser user agent, the action taken and the time. Sign-in records. Error reports. Aggregate counts we use for capacity planning and for the usage figures shown on your billing page.

Payment data

Your plan, your billing cycle, invoices and the last 4 digits and brand of your card. Full card numbers go straight to Stripe and never touch our servers.

Everything we read from a connected Facebook Page comes through the official Meta Graph API, using permissions Meta reviews and approves: listing the Pages you manage, reading their recommendations, posting the replies you approve, and subscribing to new recommendations. Nothing is scraped and no browser session is automated.

Platform data is handled under the terms Meta sets, including the Meta Platform Terms and Developer Policies. In practice that means:

• We use platform data only to provide the review features you switched on, including the assistant, and never to build an advertising profile, sell it, or feed a data broker.
• We keep platform data only for as long as it is needed for those features, and we delete it when you disconnect a Page, when you close your account, or when Meta tells us to.
• We honor deletion signals from Meta, including the Meta data deletion callback, and we process them within the window Meta requires.
• We do not transfer platform data to anyone except the processors listed below, each of which is bound to the same restrictions.

Removing ReviewComet in your Facebook settings, or disconnecting the Page inside ReviewComet, ends collection immediately. To have the platform data we already hold deleted, follow the steps in deleting your data.

Where we rely on legitimate interests, we have weighed them against your rights and the rights of the people who review your business. You can object at any time using the contact address below.

When an AI feature runs, the review text, its title and rating, the reviewer’s name and the knowledge entries that matched are sent to AI models from our subprocessors, so a classification, a draft reply or a translation can come back. That happens for deciding whether a review needs an answer, choosing which agent answers, agent replies and reply drafts, reply drafts for private feedback, testing an agent in the playground, translation of reviews and replies, and the search over your knowledge entries. It happens only for the features you switched on.

The in-app assistant works the same way, in its Copilot tab, its Help tab, and the read-only assistant in the agency staff console. It only reads what the signed-in person may already see: reviews, review sources and their connection health, rules and rule test runs, insights, saved replies, credit usage and, for agencies, client usage and the activity log; the Help tab reads the help articles instead. Only your question and the text of the records it looks up are sent to the AI models, shortened where long; images, avatars, attachments and links are never sent. It proposes a change on a card, such as a reply, an assignment, archiving a review, a rule change, or for agencies a credit re-split, and nothing happens until you confirm it; an unconfirmed card expires after 10 minutes. We store your questions, its answers and the names of the tools it used, never the records it looked up, and a card stores only the ids it acts on and, for a reply, the reply text, never the reviewer’s text. A conversation is deleted within 30 days of starting, sooner where your review window is shorter. Only you can read your own conversations; our staff do not, except for what you choose to send to support. “Ask support about this” under an answer opens a support form prefilled with that exchange, and nothing reaches our team until you send it.

• The AI models come from a small set of subprocessors. Each is bound by contract to process the content only to return our result. The table in the next section says what they receive and where they run.
• We update that table whenever it changes, and before a new subprocessor starts handling data.
• Your content is not used to train their models. We have that on the terms of their business APIs, and we do not opt in to any training program.
• They retain the request only for the short abuse-monitoring window their terms allow, then delete it.
• We do not send them your access tokens, your card details, your customer contacts or the contents of your team list.

If you would rather no review text left our systems for this purpose, switch off the agents and automatic translation, and do not ask the assistant about your reviews. Everything else in the product keeps working.

We use a small set of sub-processors. Each one is under a written contract with confidentiality and security terms, and each is used only for the purpose named here. This is the whole list.

The current list always lives on this page. We publish changes here before a new processor starts handling data, and customers on a data processing addendum can object as set out in that document.

Other recipients, when they apply. If you reached us through an agency, that agency sees the locations it runs for you, because running them is the service you bought from it, and if it bills you, it does so through its own Stripe account. If you set up an outgoing webhook or use the API, the data goes to the address you chose.

Beyond this list, we share data only when the law requires it, and only after checking that the request is valid and no broader than it has to be. We do not sell personal data, and we do not share it for advertising.

Some of the processors above operate in the United States. Where personal data leaves the European Economic Area or the United Kingdom, the transfer runs on the European Commission’s Standard Contractual Clauses together with the UK addendum, backed by a transfer risk assessment we keep on file and review annually.

Our database and file storage are hosted in western Europe on Cloudflare. Some processing happens elsewhere: AI requests may be served from the United States, which is why the AI features are individually switchable, and reviews pass through Cloudflare’s global network on their way in. Transfers outside the EEA run on Standard Contractual Clauses.

• Reviews, replies and private feedback: 12 months from the date the review arrived, then automatic deletion. The workspace owner can set a shorter or a longer window per location, of at least 30 days, from the location’s settings.
• Activity history: 24 months, on its own clock. Who replied to, assigned or archived a review, and when, is kept whatever window the location sets.
• Customer contacts, their consent records and their review requests: until you delete the contact or close the account.
• Suppression list: a one-way hash of each address that unsubscribed, bounced or complained, kept while the account exists so that address is not asked again.
• Access tokens: until you disconnect the source, the token is revoked, or the account closes. Whichever comes first.
• Data from a disconnected source: deleted 30 days after you disconnect it.
• Account and workspace records: for as long as the account is open, then 30 days.
• Invoices and payment records: 7 years, because tax law says so.
• Request and security logs: 90 days. Records of successful sign-ins: 180 days.
• Raw deliveries from a review site: 30 days, with their content blanked after 7.
• Email delivery records: 12 months.
• Assistant conversations: 30 days from the start, shorter when your review window is shorter.
• Support tickets, including attached images and any conversation you attach: while your account exists, deleted with the account (images you upload but never send: 24 hours).
• Backups: encrypted, rolling, and overwritten within 30 days. A deletion reaches the backups as they roll, and a backup is never restored to undo one.

You have 4 ways to get data out of our systems, and none of them needs an email to support:

• Disconnect a review source. Its token is deleted here, we stop receiving its updates, and the reviews we collected from it are deleted 30 days later.
• Delete a contact. The contact, its consent records and its review requests are erased at once. Only the hashed suppression entry stays, so the address is not asked again.
• Delete your account from Settings, Danger zone. We email you a link, you press it, and everything is deleted after 24 hours, apart from invoices we are required to keep and encrypted backups that roll within 30 days. Until then you can cancel from the email we send.
• Remove us on Facebook. Removing ReviewComet in your Facebook settings stops collection at once. If you also ask Facebook to have your data deleted, Facebook sends us the request and we act on it as our data deletion page describes.

If you reviewed a business that uses ReviewComet and you want your details removed from our copy, write to privacy@reviewcomet.com with the business, the review site and the name you reviewed under. We will pass the request to the customer whose workspace holds it and, where we are permitted to act directly, delete it ourselves within 30 days. Deleting our copy does not remove your review from the review site.

If a business asked you for a review through ReviewComet, the unsubscribe link in that email stops its requests at once, without a login. To have your details removed, write to the business or to privacy@reviewcomet.com.

If the GDPR, the UK GDPR or a comparable law applies to you, you have the right to ask for a copy of your data, to correct it and to have it deleted. You can also restrict or object to processing, receive your data in a portable format, and withdraw consent where consent was the basis.

Write to privacy@reviewcomet.com and we will answer within 1 month. We do not charge for this, and we will not make the service worse for you because you asked.

If you are not satisfied with our answer you can complain to your local data protection authority. We would rather you told us first, so we get the chance to fix it.

We set strictly necessary cookies, such as the session cookie that keeps you signed in. It is httpOnly, Secure and SameSite=Lax, and it expires when your session ends. Strictly necessary cookies need no consent. Review widgets set no cookies at all.

The app also uses your browser’s local storage for preferences that never leave your device: the light or dark theme, saved views of your reviews, and which columns you have collapsed.

Analytics and marketing tags only run after you accept them in our cookie banner, per category, and you can change that choice at any time with the Cookie settings link or button. We keep a record of each answer (a random id, the site, your choice, the banner version and the time, without your IP address) for 3 years. Every cookie by name, with its purpose and its lifetime, is in our cookie notice.

• Everything is encrypted in transit with TLS, and encrypted at rest. Review site access tokens get a second layer of application-level encryption.
• Passwords are hashed with a memory-hard algorithm and are never recoverable, by us or by anyone else.
• Access to production data is limited to the engineers who need it, is authenticated with two factors, and is logged.
• Workspaces are isolated at the query layer, so one customer’s data cannot be read from another customer’s session.
• If a breach affects your personal data we will tell the supervisory authority within 72 hours and tell you without undue delay, with what happened and what we did about it.

ReviewComet is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16 as a user. Reviews written by minors may reach a workspace because they were posted publicly on a review site, and they are handled under the same retention and deletion rules as everything else.

When we change something that affects you, we update the date at the top of this page and email account owners at least 30 days before it takes effect. Changes that only clarify wording go live when they are published. Previous versions are available on request.