Privacy Policy
Last updated: April 13, 2026
This Privacy Policy explains how RateMyBiz ("we", "us", "our") collects, uses, stores, and shares personal data when you use our platform. We are committed to protecting your privacy and complying with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and the Brazilian Lei Geral de Proteção de Dados (LGPD).
1. Data We Collect
1.1 Account Data (Customers)
When you sign up, we collect your name, email address, and authentication credentials through our authentication provider (Clerk). If you subscribe to a paid plan, we process payment information through PayPal, Mercado Pago, or Lemon Squeezy — we do not store your payment card or bank details directly.
1.2 Business Data
When you register a business, we store the business name, address, Google Place ID, review page slug, logo (uploaded to Cloudflare R2), and configuration preferences (star threshold, background color, custom headline).
1.3 Feedback Data (End Users)
When an end user submits feedback through a review page, we collect the star rating, optional comment text, and the traffic source (QR code, WhatsApp, email, or direct). After submitting, the thank-you step may optionally ask for an email address so the business owner can follow up; providing it is voluntary and we store it only when the user submits it. We do not collect the end user's name or any other personal identifiers. IP addresses are processed for rate limiting but are not stored alongside feedback records.
1.4 Analytics Data
We record page-view events (SCAN) and Google redirect events (REDIRECT) for each review page, along with the traffic source. These events do not contain personal identifiers.
Separately, we use PostHog to measure marketing conversion on our public site (for example visits to the landing and pricing pages, sign-up completion, and checkout starts). When you decline non-essential cookies, PostHog runs in a cookieless mode that does not rely on advertising cookies. Public customer review pages (/r/…) are excluded from PostHog tracking.
1.5 Cookies
We use a small number of functional cookies. See our Cookie Policy for details.
2. How We Use Your Data
- Provide and operate the Service — display review pages, deliver feedback to business owners, generate analytics.
- Process payments — manage subscriptions and billing via PayPal, Mercado Pago, or Lemon Squeezy.
- Send notifications — email alerts when new feedback is received, using Resend as our email provider.
- Prevent abuse — IP-based rate limiting on public API endpoints.
- Improve the Service — aggregated, anonymized analytics to understand usage patterns, including marketing conversion analytics via PostHog.
- Monitor reliability — diagnose errors and crashes via Sentry (production only).
3. Legal Basis for Processing (GDPR)
- Contract performance — processing necessary to provide the Service you signed up for.
- Legitimate interest — abuse prevention, security, and service improvement.
- Consent — non-essential cookies (where applicable).
4. Third-Party Services
We share data with the following processors:
| Provider | Purpose | Data Shared |
|---|---|---|
| Clerk | Authentication | Email, name, auth tokens |
| PayPal / Mercado Pago / Lemon Squeezy | Billing | Email, subscription ID |
| Google Maps Platform (Places) | Business search during onboarding (browser) | Search query text (sent to Google), Place ID, business name, address (stored by us) |
| Sentry | Error monitoring & diagnostics | Error messages, stack traces, session replay metadata (production only) |
| PostHog | Marketing conversion analytics | Page views and product events on marketing/auth/checkout flows (not public review pages); cookieless when consent is declined |
| Cloudflare R2 | File storage | Uploaded logos |
| Resend | Email delivery | Recipient email, feedback content |
4.1 Google API Services Disclosure
RateMyBiz uses Google Maps Platform (Places) via the Maps JavaScript API in your browser to allow business owners to search for and verify their business during onboarding. When you search, the query text you enter is sent to Google to retrieve matching business results. Once you select a business, we store the Google Place ID, business name, and address in our database to enable Google Review redirect functionality. We do not access or store any other Google user data. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
5. Data Retention
| Data Category | Retention Period |
|---|---|
| Account data (email, auth) | Duration of active account |
| Business profiles | Duration of active account |
| Feedback & analytics | Up to 60 days on free, trial, and Starter plans; up to 365 days on Pro — based on the account's current subscription tier. Retention follows your current plan, not the plan in effect when the data was collected. Also deleted when the associated business is removed, or when the account is hard-deleted as described below. |
| Subscription / billing metadata | Duration of active account (payment details are held by the payment provider, not by us) |
| Server logs & rate-limit data | Up to 30 days, then automatically purged |
When you delete your account — either from Settings → Delete Account in the dashboard or by contacting us — we schedule deletion rather than removing data instantly. Your account is marked for deletion and you retain read access until the effective date, which is the later of (i) seven days from the request or (ii) the end of your current paid billing period, if applicable. Before that date you may cancel the pending deletion from your dashboard settings. After the effective date, a daily automated job permanently deletes all associated data (businesses, feedback, analytics, and subscription records). Any residual backups are purged within 30 days.
6. Your Rights
Under GDPR and LGPD, you have the right to:
- Access — view or download the personal data we hold about you. Use Settings → Download data in the dashboard to export your data in JSON format at any time.
- Rectification — correct inaccurate data via your dashboard settings.
- Erasure ("right to be forgotten") — delete your account and all associated data. Use Settings → Delete Account or contact us.
- Data portability — receive your data in a structured, machine-readable format (JSON) via the export feature.
- Withdraw consent at any time (where processing is based on consent).
- Lodge a complaint with your supervisory authority.
To exercise any of these rights, you can use the self-service tools in your dashboard or contact us at privacy@ratemybiz.shop.
7. International Transfers
Your data may be processed in countries outside your country of residence. Where data is transferred outside the EEA or Brazil, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses) in accordance with GDPR and LGPD requirements.
8. Security
We implement industry-standard security measures including HTTPS encryption in transit, access controls, and rate limiting. While we take reasonable steps to protect your data, no system is 100% secure.
9. Children's Privacy
The Service is not directed to children under 18. We do not knowingly collect personal data from children.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service.
11. Contact
For privacy-related questions or requests, contact us at privacy@ratemybiz.shop.