Privacy notice

Information used by the service

• Business accounts: email and authentication records; workspace membership; business name, category, location and the profile or contact details you provide.
• Reviews: display name, rating, text, dates, account association and confirmation information. Business replies and review reports are stored with their associated records.
• Review invitations: the customer name and email supplied by the business, an event identifier and type, and link status and expiry. Automation connections also keep key metadata and event records.
• Billing: legal business name, billing address, country, registration number when supplied, tax declaration, subscription and payment references, amounts and invoice records. We do not collect your full payment-card details or PayPal password.
• Operation and security: authentication sessions, technical request information and records needed to limit abuse, investigate errors and manage the service. Hosting and authentication providers may keep their own operational logs.

Providing information through these forms is voluntary. Email confirmation is required to submit a review or use a business account. Without the required business or recipient details, we cannot create the corresponding profile or invitation. Do not include health, payment or other sensitive personal information in reviews.

Why information is used

Information is used to authenticate users, publish business profiles and reviews, match invitation recipients, manage replies and reports, prevent abuse and respond to support requests, administer subscriptions and issue accounting documents. Creating a review link does not send a message. The business chooses how to deliver it and is responsible for having an appropriate basis to provide and use its customer information.

Public and private information

Public profile details, review display names, ratings, review text, dates, source labels and published business replies can be read by visitors. They may also appear in widgets, shared review cards and search engines. Use a display name you are comfortable making public.

Confirmation email addresses and raw integration keys are not displayed on public review pages. Authorized workspace users can access the business records permitted by their role. The operator can process non-public records to administer the service and handle reports or support requests.

Service providers and external pages

The service uses Supabase for authentication and database functions, and the operator’s existing Vangus hosting and email services. These providers process information needed to operate the service. If a business page displays an external map or you follow an external link, that provider may receive request information under its own privacy terms.

PayPal processes subscription payments and returns payer and transaction information to us. Morning (Green Invoice) receives billing identity, payer email and payment details to issue and deliver invoice receipts. These services can process information outside your country. Their privacy information describes their handling of information; contact us for questions about your records in Rate My Biz.

Some guides embed official Google videos using YouTube’s privacy-enhanced player at youtube-nocookie.com. Loading a guide connects to YouTube to display these players; videos do not play automatically. YouTube may receive technical request information, including your IP address and browser details, and process additional playback data when you play a video, under Google’s privacy policy. These embedded players are separate from our optional Google Ads measurement choice.

Optional Google Business Profile connection

Where this feature is available, a workspace owner or administrator can authorize a Google account and choose a managed business. Google requests its Business Profile management permission. Our connector uses that permission to list managed businesses and read their reviews, including reviewer display names, ratings, text and dates. It does not edit your Google profile or post replies.

Google review content is retrieved for the private business dashboard and held in the browser while that view is open. It is not saved as a Rate My Biz review, included in a combined rating, published on public pages, or used for advertising. The server stores an encrypted access grant, the selected business identifier and name, and connection and refresh timestamps. Access grants are not sent to the browser.

Disconnect Google in the workspace to remove its saved connection and access grant. You can also withdraw the app permission for all connected businesses through your Google Account connections. Google retains its own records under its privacy policy. For removal of account records and backup retention questions, contact us using the details below.

Connected stores and product-review requests

When an authorized business connects a supported store, Rate My Biz processes the store identifier, purchased product identifiers and names, order status and dates, and the buyer’s email address to request feedback on that purchase. Store access grants and buyer email addresses are encrypted in application records. We do not import payment-card details, shipping addresses or customer phone numbers for product-review invitations.

Requests remain paused until the business enables them. We use the buyer’s email only for the purchase-related review request, not advertising. We queue one request per eligible order and do not automatically retry ambiguous delivery; cancellation, refund, plan access and unsubscribe checks can suppress it. Customer email addresses are not published. Submitted ratings, review text and chosen display names may appear on the relevant public product-review page or widget.

Raw buyer email is removed from order records after 60 days. Unsubscribe hashes are kept separately to respect the customer’s choice. Public reviews have a separate publication purpose and can be subject to a privacy removal request. Store privacy-request references are retained for up to 90 days and access/event audit records for up to 180 days. Encrypted operational backups follow the backup rotation; a restored copy must be checked against subsequent removal requests before returning it to service.

Disconnecting a store pauses requests and removes its saved provider access grant; it does not itself delete published reviews. Businesses can obtain Shopify customer-data exports through Customer privacy requests in Connections when a request is received. Store customers can also contact the merchant or use the privacy contact below for access or removal. Availability and beta status differ by platform.

Browser storage and retention

Browser storage is used for business sign-in sessions and incomplete onboarding details. Signing out ends the local business session; it does not delete the business or its reviews. The customer review form keeps its confirmation session in memory. The current application does not include a visitor-analytics dashboard. Your optional advertising measurement choice is stored in this browser for up to 180 days.

Saved records are not automatically erased when an invitation expires or a user signs out. Account closure and deletion are currently handled by contacting the operator, rather than through a self-service deletion button. Deletion and retention requests require review by the operator, including any records that must be kept for security, dispute handling or accounting obligations. Payment and invoice history may need to be retained after an account closes. Request the applicable retention information when contacting us about removal.

Optional advertising measurement

With your permission, we load the Google Ads tag on marketing and account-entry pages to measure advertising performance, including a newly created business after email verification. The tag is not loaded before you allow measurement. Rejecting optional measurement does not prevent registration or use of the service. We do not load the tag on business review pages, embedded widgets or the administration area on a fresh visit.

Google may process advertising identifiers, cookies and technical request information, including your IP address and browser details, and may process information outside your country. Our conversion event does not include your email, name, password, verification code or review content. It includes an opaque deduplication identifier and a nominal signup value, not a payment. Advertising personalisation, enhanced conversions and Google Analytics measurement are not enabled by this integration.

Use Cookie choices in the footer to allow or withdraw optional measurement. Withdrawal stops future measurement by this integration and removes its accessible first-party advertising cookies; it does not recall information already sent to Google. Google may retain its own records under its privacy policy. A conversion deduplication marker stays in your browser until browser storage is cleared.

Access, correction and removal requests

You may ask to access personal information about you and to correct inaccurate information, subject to applicable law. You can also request account or content removal. These requests are handled manually; identity or account control may need to be confirmed before private records are disclosed or changed. Review moderation and a privacy request are separate processes.

For privacy, access, correction or removal requests, email contact@rate-my.biz. Include the relevant page link and a brief description. Do not send passwords, one-time codes, payment details or unnecessary sensitive information.

See the Israeli Privacy Protection Authority’s information on data-controller duties (Hebrew PDF) and our review explanation.