1. Who we are
ReviewPulse (the "Service") is operated by SecureDen ("we") — SecureDen · Strada Muncii 8, 106100 Sinaia, Prahova, Romania. Data-protection contact: [email protected].
For your account data and for data obtained by connecting your Google profile, SecureDen is the controller under Regulation (EU) 2016/679 (GDPR).
2. What data we process
- Account data: name, email address, password (stored only as a hash), account role, the businesses you manage.
- Business data: name, address, city, website, business category, review-platform connections, alert preferences (including your WhatsApp phone number, if you enable alerts).
- Public reviews: reviews published on platforms such as Google, TripAdvisor or Trustpilot about your business and the competitors you track — the author's display name, rating, text, date and owner reply, as publicly shown on that platform.
- Google Business Profile data: only if you connect your Google account (section 4).
- Content created in the Service: reply drafts, style guidance you provide, personalisation preferences, reports.
- Technical data: one strictly necessary session cookie, browser local storage for your selected business and language, server logs (IP address, timestamp, errors). We do not use advertising or analytics cookies.
3. Why, and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
| Providing the Service (account, collecting and displaying reviews, reply drafts, alerts, reports) | Performance of a contract |
| Processing third parties' public reviews (review authors, competitors) | Legitimate interest — analysing a business's public reputation |
| Security, abuse prevention, logs | Legitimate interest |
| Invoicing and tax obligations | Legal obligation |
4. Google user data (Google API Services)
If you choose to connect a Google Business Profile, we request the business.manage permission (https://www.googleapis.com/auth/business.manage) via Google's official sign-in (OAuth 2.0).
What we access: the list of accounts and business locations that you own or manage, those locations' information, their reviews and owner replies.
How we use it: we display the reviews in your dashboard, analyse them (sentiment, themes) and generate reply drafts and reports for you. We publish a reply to a review only when you choose to publish it. We never access locations you do not manage.
What we store: reviews and replies of connected locations, location identifiers, and OAuth tokens, encrypted (AES-256-GCM).
Who we share it with: Google user data is never sold and never used for advertising. Review text is sent to our AI providers (section 5) solely to produce the analyses and drafts you request. We do not use Google user data to train AI models, and we do not allow our providers to do so.
Limited Use: ReviewPulse's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Revocation and deletion: you can revoke access at any time from your Google Account permissions. Upon revocation or on your request, we delete the tokens immediately and your locations' Google data within 30 days, except data we are legally required to keep.
5. Recipients (processors)
Transfers outside the EEA rely on the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, as applicable.
- Anthropic PBC (USA) — AI models for analysis, reply drafts and reports.
- OpenAI (USA) — alternative AI provider, when enabled.
- Twilio Inc. (USA) — sending WhatsApp alerts.
- Google — Places API and Business Profile API.
- Vultr — hosting of the application and database.
6. How long we keep data
- Account data: for the life of the account; after deletion, personal data is deleted or anonymised within 30 days.
- Reviews and analyses: for the life of the business account.
- Google tokens: until disconnection or revocation.
- Technical logs: up to 90 days.
- Invoicing records: as required by tax law (usually 10 years).
7. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. Email [email protected]; we reply within one month. You may lodge a complaint with the Romanian supervisory authority ANSPDCP (www.dataprotection.ro).
If you wrote a public review and object to its processing in ReviewPulse, contact us at the same address.
8. Security
Hashed passwords, encrypted tokens, HTTPS connections, role-based access and logging of administrative access.
9. Changes
We may update this policy; material changes will be announced in the app or by email.