Terms of Service

Privacy Policy

Last updated: February 2026

ReviewsLift AI ("ReviewsLift", "we", "us") provides review request automation and Google Business Profile review management software to local businesses. This policy explains what information we collect, how we use it, who we share it with, and the choices available to both our business customers and the consumers they message.

1. Who this policy covers

Business users are the people who create a ReviewsLift account. End consumers are the customers of those businesses, whose contact details are uploaded or synced into ReviewsLift so review requests can be sent. For end consumer data, the business is the data controller and ReviewsLift acts as a service provider/processor operating on that business's instructions.

2. Information we collect

  • Account data: name, business name, email address, phone number, password hash, billing contact.
  • Billing data: subscription tier, invoices, and payment status. Card details are collected and stored by Stripe; ReviewsLift never sees full card numbers.
  • End consumer data: first and last name, mobile number, email address, visit or transaction timestamp, location assignment, and opt-out status.
  • Message and delivery data: the content of review requests we send on your behalf, delivery receipts, link clicks, replies containing opt-out keywords, and error records.
  • Google Business Profile data: where you connect your Google account, we access your business locations, reviews, star ratings, reviewer display names and photos, and review replies.
  • Integration data: where you connect a POS or booking platform (for example Square), we receive completed transaction or appointment events and the associated customer contact record.
  • Technical data: IP address, browser and device type, pages viewed, and log timestamps.

3. How we use information

  • To send review request SMS and email messages at your direction.
  • To generate AI-suggested replies to your Google reviews and, where you enable it, publish approved replies to your Google Business Profile.
  • To monitor incoming Google reviews and alert you to negative feedback.
  • To operate the dashboard, analytics, opt-out suppression list, and billing.
  • To provide support, prevent abuse, and comply with legal obligations.

We do not sell personal information, and we do not use end consumer contact data for our own marketing.

4. Google API Limited Use disclosure

ReviewsLift's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

  • We use Google Business Profile data only to provide and improve the review monitoring, review reply, and reporting features you have explicitly requested.
  • We do not transfer Google user data to third parties except as necessary to provide those features, for security purposes, or to comply with applicable law.
  • We do not use Google user data for serving advertisements, including retargeting or personalized advertising.
  • We do not allow humans to read Google user data unless we have your affirmative consent for a specific support request, it is necessary for security or to comply with law, or the data has been aggregated and anonymized.
  • Review text and star ratings may be sent to our AI provider solely to generate a suggested reply for that review. That content is not used to train third-party foundation models.
  • You can revoke ReviewsLift's Google access at any time from your Integrations page or from your Google Account permissions page. On disconnect we delete stored Google OAuth tokens.

5. SMS and email consent

Business users are solely responsible for having a lawful basis and prior express consent to contact each customer they upload, in line with the TCPA, CAN-SPAM, CASL, and any applicable state law. Every SMS we send includes opt-out instructions, and every email includes a functioning unsubscribe link plus RFC 8058 one-click unsubscribe headers.

Consumers may opt out by replying STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT to any text message, by clicking unsubscribe in any email, or by contacting the business directly. Opt-outs are honored immediately and permanently across every campaign for that business. Replying START or UNSTOP resubscribes. Replying HELP returns support information. Message and data rates may apply. Mobile opt-in data and consent records are never shared with third parties or affiliates for marketing purposes.

6. Service providers we share data with

  • Telnyx — SMS delivery.
  • Resend — transactional and review request email delivery.
  • Supabase — database, authentication, and file storage.
  • Stripe — subscription billing and payment processing.
  • Google — Business Profile review retrieval and reply publishing.
  • AI model providers — generation of suggested review replies from review text.
  • Meta Platforms (Facebook/Instagram) — advertising measurement and optimization. We may share a hashed (SHA-256) version of a business user's email address and phone number, along with IP address, browser user agent, and page and conversion events (for example page views, sign-ups, and trial starts). Contact details are never sent to Meta in unhashed form, and end consumer contact data is never shared with Meta.

Each provider is bound by contract to use the data only to deliver its service to us. We may also disclose information when required by law or to protect our rights and users.

6a. Advertising and conversion measurement

We use the Meta pixel and Meta's Conversions API on our marketing and signup pages to measure the performance of our advertising. These fire only for our own website visitors, never on the review or signup pages your customers see. Advertising cookies are off by default for visitors in the EU, UK, and EEA until they opt in, and every visitor can turn them off at any time using the "Advertising cookies" control in our website footer.

7. Data retention

Account and message records are retained while your account is active and for up to 24 months afterward, unless a longer period is required for tax, accounting, or legal purposes. Opt-out records are retained indefinitely, because we must keep them in order to keep honoring the opt-out. Deleting a customer record removes their contact details but preserves the suppression entry.

8. Security

Data is encrypted in transit with TLS and at rest. Access is controlled by row-level security so each business can only read its own records. OAuth tokens and API keys are stored in an encrypted secret store and are never exposed to browser code. Webhook endpoints verify provider signatures before processing.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. California residents have rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them. We do not sell personal information. Sharing conversion data with an advertising platform such as Meta may constitute "sharing for cross-context behavioral advertising" under the CPRA; you can opt out at any time using the "Advertising cookies" control in our website footer, or by emailing us. Requests can be sent to privacy@reviewslift.ai and are answered within 30 days. If you are a consumer contacted by one of our business users, we will route your request to that business and honor it directly where we are able.

10. Children

ReviewsLift is a business tool and is not directed to anyone under 16. We do not knowingly collect personal information from children.

11. International transfers

ReviewsLift is operated from the United States and data is processed there. If you access the service from outside the US, you consent to that transfer.

12. Changes and contact

We will post any material change to this policy on this page and update the date above. Questions can be sent to privacy@reviewslift.ai.