ReviewXchange ("Company," "we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy ("Policy") describes how we collect, use, disclose, store, and protect information about you when you use our website and platform (collectively, the "Service").

This Policy applies to all users of the Service, regardless of location, and is intended to comply with applicable privacy laws, including but not limited to Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA"), the European Union's General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act ("CCPA"), and other applicable provincial and state privacy laws.

By using the Service, you consent to the collection, use, and disclosure of your personal information as described in this Policy. If you do not agree with this Policy, please do not use the Service.

We collect the following categories of personal information:

A. Information You Provide Directly

• Account Information: When you register, we collect your name, email address, and password (stored in hashed form). For social sign-in (Google, Facebook), we receive a profile name and email from those providers.
• Business Information: When you create a business profile, we collect your business name, category, location/country, website URL, Google Business Profile link, and other public business details you choose to provide.
• Payment Information: When you purchase credits or a subscription, we collect your billing name and payment method details. We do not store your full credit card number, CVV, or sensitive payment data on our servers. All payment data is processed and stored by Stripe, Inc. in accordance with PCI-DSS standards.
• Communications: When you contact us for support or submit a bug report, we collect the content of your communications and your contact details.
• Exchange Content: We collect and store the messages, suggested review texts, and exchange request data you create on the platform.
• User-Generated Content: Any other content you voluntarily submit through the Service, such as feedback or profile information.

B. Information Collected Automatically

• Log Data: Our servers automatically record information when you use the Service, including your IP address, browser type and version, operating system, referring URL, pages visited, and timestamps.
• Usage Data: We collect information about how you interact with the Service, such as features used, exchange actions taken, and session duration.
• Device Information: We may collect information about the device you use to access the Service, including device type, unique device identifiers, and mobile network information.
• Cookies and Tracking Technologies: We use cookies and similar tracking technologies (as described in Section 9 below) to maintain your session and improve the Service.

C. Information from Third Parties

• Social Login Providers: If you sign in using Google or Facebook, we receive your name, email address, and profile picture from those providers, subject to your privacy settings with them.
• Payment Processor: Stripe provides us with limited transaction data (e.g., transaction ID, amount, and payment status) necessary for account management and support.

For users in the European Economic Area ("EEA") and the United Kingdom, we process your personal data under the following legal bases:

• Contractual Necessity: Processing your account, business profile, and payment data is necessary to perform our contract with you (i.e., to provide the Service).
• Legitimate Interests: We process certain data (such as usage and log data) based on our legitimate interests in operating, improving, and securing the Service, provided these interests are not overridden by your rights.
• Consent: Where required by law, we will obtain your explicit consent before processing certain data (e.g., for direct marketing communications). You may withdraw consent at any time.
• Legal Obligation: We may process your data when required to do so by applicable law.

We use the information we collect for the following purposes:

• Providing the Service: To create and maintain your account, facilitate review exchanges, process payments, and provide customer support.
• Personalization: To suggest relevant exchange partners based on your business category, location, and platform preferences.
• Communication: To send you transactional emails (account confirmations, exchange notifications, billing receipts), platform updates, and, with your consent, marketing communications.
• Safety & Security: To detect, investigate, and prevent fraud, abuse, prohibited conduct, and other harmful activities on the platform.
• Legal Compliance: To comply with applicable legal obligations, respond to lawful requests from government authorities, and enforce our Terms of Service.
• Analytics & Improvement: To analyze usage patterns, troubleshoot technical issues, and improve the features and performance of the Service.
• Aggregate Statistics: To generate anonymized, aggregated data that cannot identify any individual user. This data may be used internally or shared publicly.

We will not use your personal data for any purpose incompatible with the purposes described in this Policy without your consent.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. We share your information only in the following circumstances:

• With Service Providers: We share data with trusted third-party vendors who process it on our behalf to help us operate the Service. These providers are contractually bound to protect your data and may only use it for the purposes we specify. Our current key service providers include:
  • Firebase / Google Cloud: Authentication, database (Firestore), and hosting.
  • Stripe, Inc.: Payment processing.
  • Email Delivery Provider: For sending transactional and marketing emails.
• With Other Platform Users (Exchange Partners): When you initiate or accept a review exchange, your business name, business category, country, and public review page links will be shared with your exchange partner. If you have enabled the "Remain Anonymous" setting, your business name will be hidden until an exchange is accepted. Your email address and personal account details are never shared with other users.
• For Legal Compliance & Protection: We may disclose your information if we believe in good faith that such disclosure is necessary to: (a) comply with a legal obligation, court order, or government request; (b) protect and defend the rights or property of ReviewXchange; (c) prevent or investigate possible wrongdoing in connection with the Service; or (d) protect the personal safety of users of the Service or the public.
• Business Transfers: If ReviewXchange is involved in a merger, acquisition, asset sale, or bankruptcy, your personal information may be transferred as part of that transaction. We will provide notice before your data becomes subject to a materially different privacy policy.
• With Your Consent: We may share your information for any other purpose with your explicit consent.

We retain your personal information for as long as your account is active or as long as necessary to provide you with the Service. We also retain data as required to comply with our legal obligations, resolve disputes, and enforce our agreements.

Specifically:

• Account Data: Retained for the duration of your account and for a period of up to 2 years following account deletion, to comply with legal obligations.
• Transaction & Financial Data: Retained for a minimum of 7 years to comply with Canadian tax and accounting laws.
• Exchange & Communication Data: Retained for up to 2 years from the date of the exchange for dispute resolution purposes.
• Log Data: Typically retained for up to 12 months.

When data is no longer needed, it is securely deleted or anonymized.

We implement technical, organizational, and administrative security measures designed to protect your personal information against unauthorized access, disclosure, alteration, and destruction. These measures include:

• Firebase Authentication for secure account access.
• Firestore Security Rules to restrict database access to authorized users only.
• Encrypted data transmission using HTTPS/TLS for all communications between your browser and our servers.
• PCI-DSS compliant payment processing through Stripe (we never handle raw card data).
• Access controls limiting employee access to personal data to those with a legitimate business need.

However, no security system is completely impenetrable, and we cannot guarantee the absolute security of your information. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and applicable regulatory authorities as required by law.

Our Service operates globally. Your personal information may be transferred to, stored, and processed in countries other than your own, including Canada, the United States, or countries where our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction.

Where we transfer personal data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or reliance on adequacy decisions, to protect your information in accordance with applicable law.

We use cookies and similar technologies (such as session tokens and local storage) to operate and improve the Service. The types of cookies we use include:

• Strictly Necessary Cookies: Essential for the Service to function, such as maintaining your login session. These cannot be disabled.
• Functional Cookies: Enable enhanced functionality and personalization, such as remembering your preferences.
• Analytics Cookies: Help us understand how users interact with the Service so we can improve it. We may use Google Analytics or similar tools for this purpose.

You can control cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Service.

Depending on your location, you may have the following rights regarding your personal information:

• Right of Access: The right to request a copy of the personal data we hold about you.
• Right to Rectification: The right to request that we correct any inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): The right to request that we delete your personal data, subject to certain exceptions (e.g., legal retention obligations).
• Right to Data Portability: The right to receive your data in a structured, machine-readable format.
• Right to Object / Restrict Processing: The right to object to or request that we restrict certain types of processing of your personal data.
• Right to Withdraw Consent: Where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right Not to be Subject to Automated Decision-Making: The right not to be subject to decisions based solely on automated processing that produce significant legal effects.

You can exercise many of these rights directly through your account dashboard. For other requests, please contact us via our Contact Form. We will respond to verified requests within the timeframes required by applicable law (typically within 30 days). We may need to verify your identity before processing a request.

California Residents (CCPA): In addition to the rights above, California residents have the right to know what personal information is sold or disclosed for business purposes, the right to opt-out of the sale of personal information (note: we do not sell personal information), and the right to non-discrimination for exercising these rights.

The Service is not directed to, and we do not knowingly collect personal information from, children under the age of 18. If we become aware that we have inadvertently collected personal information from a child under 18, we will take prompt steps to delete such information. If you believe we have collected information from a minor, please contact us immediately.

The Service may contain links to third-party websites and services (such as Google Business Profile, Yelp, Trustpilot, and social media platforms). This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party service you visit. We are not responsible for the privacy practices or content of any third-party service.

Our Service does not currently respond to Do Not Track ("DNT") signals from browsers, as there is no universally accepted standard for DNT. If a standard is adopted in the future, we will update this Policy accordingly.

With your consent (or where otherwise permitted by applicable law), we may send you marketing emails about new features, offers, or relevant platform news. You can opt out of marketing emails at any time by:

• Clicking the "Unsubscribe" link in any marketing email.
• Adjusting your notification preferences in your account settings.
• Contacting us via our Contact Form.

Please note that even if you opt out of marketing emails, you will continue to receive transactional and account-related emails that are necessary for the operation of your account.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last Updated" date at the top of this page and notify you through the Service or via email.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically.

ReviewXchange is the data controller responsible for your personal information. If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us via our Contact Form.

If you are located in the EEA and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local Data Protection Authority (DPA).