Privacy Policy

Last updated: October 15, 2026

BetterReviews ("we", "our", "us") operates the BetterReviews platform, a Shopify app that helps merchants collect and display product reviews. This policy explains how we collect, use, and protect personal data.

1. Data We Collect

From Customers (via Shopify stores)

Email address — to send post-purchase review request emails and match reviews to verified buyers
First name — to personalize review request emails and display verified buyer attribution
Review content — ratings, titles, text, and uploaded photos/videos submitted by customers
Order data — order IDs, fulfillment status, and product line items to trigger post-purchase review request emails and verify purchases for verified buyer badges
Shipping location — city, state/province and country from the order's shipping address (never the street address or postal code). It is shown next to a published review as, for example, "from Texas" (outside the US and Canada, the country name only), unless the merchant turns this off. A merchant may choose to show the city as well ("from Austin, Texas"), but only for reviews submitted on or after September 25, 2026. Reviews imported from other review platforms never carry a location.
Conversation transcripts — full AI-guided conversation messages when using the chat-based review flow (see below)
AI analysis data — quality scores, sentiment analysis, content classifications, and buyer-persona labels generated from review content (see §2 for how persona labels are used)
Claim-support links — which merchant marketing claim a review was matched to, together with the sentence of the review quoted as evidence (recorded by the merchant or their AI assistant; disclosed to you on request)

AI-guided review conversations

When you use the chat-based review flow on a merchant's store, we collect and process the following as you interact — starting with your first message, not only when you press Submit:

Conversation messages — each message you send is stored and sent to our AI providers to generate follow-up questions and a draft review
Uploaded review photos — optional photos you attach during the conversation may be sent for vision analysis to help the AI ask relevant questions
Star rating — the rating you select at the start of the flow

Your name and email are collected separately (typically on the draft/submit step) and are not sent to our AI providers with conversation content.

Video in reviews

Attached videos. You may attach a video to your review the same way you attach a photo. An attached video is stored with your review and may be shown with the published review on the merchant's store. Attached videos are not sent to our AI providers for analysis.

Recorded video answers. When a store offers optional in-page video answers, you may record a short answer using your device's camera and microphone. If you choose to record, we collect:

Video recording — the video clip you capture, which may include your image, voice, and likeness
Audio for transcription — speech from the recording is sent for automated transcription so the AI can draft your written review
Speech transcript — the text produced from your recording, treated as a conversation message for review drafting

A recorded video answer is used to draft your written review and is stored with it, but the recording itself is not shown on the merchant's store. A recorded video answer is not used for separate marketing or advertising use. You must be at least 18 years old to record a video answer, or confirm you have authority to consent on behalf of anyone identifiable in the recording. You confirm that every identifiable person in the video consented to being recorded for this purpose, or that you are the only identifiable person.

From Merchants

Account email — for authentication and communication
Store information — store name, domain, subscription status
Support chat — when you open the support chat in the merchant admin, we share your account email, store name, store domain and myshopify domain, your BetterReviews plan name, billing status, and the date your store was created with our support-chat provider (Intercom), together with the messages you write in the chat, so our team can identify your store and answer you. The chat is staffed by people only (no AI replies) and is never shown to shoppers or on storefronts.
Shopify access token — encrypted, used for metafield writes and order verification
Invited viewer accounts — when a merchant invites someone (typically an agency or teammate) from Settings → Team, we store that person's email (encrypted at rest, with a one-way hash for lookup) so they can sign in to the view-only dashboard at app.betterreviews.app with a magic link. Viewer accounts are granted by the merchant, not by BetterReviews staff; they see per-store counts only (marketing-ready reviews, total and approved review counts, average rating, review-request funnel, credit usage). They cannot change settings or invite others.
Notification recipient emails — when a merchant enables email-driven moderation, they may add additional recipient email addresses (typically their customer-support team) to receive notifications about pending reviews and customer support requests. Each recipient row carries two independent flags (notify_reviews, notify_support) that control which kinds of emails the address receives — at least one must be true. These addresses are stored encrypted at rest, masked when displayed in the merchant admin dashboard, and require one-time email-link verification before becoming active. Each recipient can revoke themselves at any time. During the unified-recipient grace window (through Q3 2026), addresses configured in the legacy Settings → Support panel are read-capable as a fallback; revoking through the new Notifications tab removes the address from the unified recipient list, but legacy support_emails aliases may continue to receive chat-bubble forwards until the legacy column is retired.
Customer private-reply emails — when a merchant's CS rep explicitly clicks Reply Privately on a support-routed review notification, BetterReviews sends a one-time email to the customer carrying the rep's reply, a CAN-SPAM footer, and an independent unsubscribe link. Clicking the unsubscribe link in a private-reply email suppresses ONLY future private replies from BetterReviews — it does not affect review-request emails (which the customer can unsubscribe from independently) or merchant-notification emails (which are not customer-facing). Each suppression kind (customer, customer_reply, merchant_notification) routes through an isolated discriminator so opting out of one channel never silences the others.

Analytics Events

Web pixel events — product views, widget interactions, and purchase events
We collect only opaque identifiers (customer_id, order_id) — no email, name, or other personally identifiable information
Analytics data cannot be reverse-mapped to individuals without Shopify API access
Collection respects Shopify's Customer Privacy API consent signals

From Visitors to Our Free Review-to-Ad Tool

Review content you provide for analysis — when you use our free "Studio Glimpse" review-to-ad tool on betterreviews.app, you either (a) upload a file of reviews you control, or (b) submit a store/product URL and ask us to read the reviews publicly displayed on that page. We process that review content (review text, star ratings, reviewer display names, and, where shown, review photos) to generate sample marketing creatives for you. You confirm, via a required checkbox, that you have the right to provide this content for this purpose.
How we handle reviewer details on the URL path — where you submit a URL, we minimize third-party personal data: reviewer names are masked to a first name and last initial (e.g. "Jane Doe" becomes "Jane D."), personal names are scrubbed from quoted text, and any review photos are shown only temporarily in your browser and are not included in the emailed copy. Generated creatives quote or paraphrase review content; you are responsible for clearing any result before you use it.
Lead email — if you choose to have your results emailed, the email address you enter and a timestamped record that you ticked the consent checkbox (see §3).
We do not use tool inputs to train AI models. Review content and uploaded files are sent to our AI provider only to generate your results (inference), never to train, fine-tune, or develop any model.

From Visitors Who Request a Demo

Demo request details — when you submit our demo-request form on betterreviews.app, we collect your name, work email address, company name, and approximate monthly order volume, along with a first-party analytics visitor identifier and your approximate region (derived from your IP), so our team can prepare for and follow up on your demo. Your name, email, company, and order-volume bracket are delivered to our internal sales channel (Slack), and if you proceed to book a time, the same details prefill the scheduling page (Cal.com); your email is stored only as encrypted ciphertext plus a one-way hash, and your company, monthly order volume bracket, analytics identifier, and region are stored in our database. We use these details solely to contact you about your demo request and to understand which marketing channel brought you to us. We do not add you to any automated marketing email sequence on the basis of a demo request, and the analytics identifier is kept for our own internal correlation only — it is never sent to our analytics provider. If you complete a booking on the scheduling page, Cal.com notifies us and we record the booking time and Cal.com's booking reference alongside your demo request. If you reached the form from one of our own online ads, we may also store the advertising click identifier from that visit (for example a Google Ads click ID) and later report the booking against that click to the advertising platform so we can measure which ads lead to booked calls. On erasure we delete the identifier from our systems and submit a retraction of any such report already sent to the advertising platform. See §3 for the lawful basis and §13 to exercise your erasure right.

From Visitors to Our Marketing Website

Interaction recordings and heatmaps — on our marketing website (betterreviews.app) only, we use Microsoft Clarity to record how visitors move through our pages: mouse movement, clicks, scrolling, and page navigation, replayed as a session recording and aggregated into heatmaps. This helps us find pages that confuse people. Clarity is configured in its strictest masking mode: the text of our pages and anything you type into a form are hidden before the recording leaves your browser. The page address and page title are recorded and are not masked, so we never place a person's or a customer's name in either. Clarity does not run on merchant storefronts, in the merchant admin, on our audit-report pages, or on any Shopify customer, review, or order data. Microsoft acts as a data controller for what it collects (see §6). For visitors in the EEA, UK, and Switzerland it loads only after you accept our cookie banner.

2. How We Use Data

Review collection — sending post-purchase review request emails to customers
Verified buyer badges — matching reviewers to orders to display trust signals
Review display — showing reviews on product pages via theme extensions
Send-time scheduling — using the country and state/province from the order's shipping address, and the time zone derived from them, to deliver review request emails at a reasonable local hour
Reviewer location display — showing the reviewer's state/province or country (and, where the merchant enables it, the city) next to their published review, so shoppers can see where a review comes from
Product analytics — aggregated metrics on review performance and product page optimization
AI conversations — guiding customers through detailed review submissions; each customer message is processed as it is sent to generate follow-up questions and a draft review
AI-powered review analysis — quality assessment, content moderation, and spam detection
Checkout personalization — a returning customer's own recent review experience may be used by a checkout partner the merchant has connected to tailor that customer's checkout, and a partner may show the merchant's published reviews at checkout or a link to review your own order on its order-tracking page (see §6)
Video answer transcription — when you record a video answer, converting speech to text so the AI can draft the written review

AI inference only — no model training. Customer review conversations and uploaded review media (including photos and the audio of optional video answers) are sent to our AI providers only to operate the review-collection service (inference). We do not use that content to train, fine-tune, or develop AI models — ours or any third party's.

We do not sell personal data. We do not use merchant, customer, or review data for advertising.

Advertising on our marketing website. All of our advertising measurement happens on our own marketing website (betterreviews.app) and nowhere else. To measure the effectiveness of our own ads we use two tools there: the Meta Pixel and a Google Ads conversion tag. Each sets cookies and shares limited visitor data with its vendor (see §6 and §10 for exactly what each shares). Neither tool runs on merchant storefronts, in the merchant admin, or on any Shopify customer data. Separately from advertising, we use Microsoft Clarity on the same website for session replay and heatmaps — a usability tool, not an advertising one, though some of the cookies it sets are Microsoft advertising cookies (see §10). For visitors in the EEA, UK, and Switzerland, both load only after they accept our cookie banner; elsewhere we honor a Global Privacy Control signal as an opt-out (see §9). We use both tools for conversion measurement only: we never enable Google's ad personalization signal and we do not build remarketing audiences.

We use automated profiling in one limited way: to help a merchant understand who buys from them, we analyze the text of the reviews left for that merchant and label each review with the buyer "persona" (buying-situation group) it most closely matches. This is an automated inference under GDPR Article 4(4); it is derived only from review content, is shown only to the merchant who received the review, does not produce legal or similarly significant effects and is not used for solely-automated decision-making about you (GDPR Article 22), and is disclosed to you on request (Article 15).

3. Lawful Basis for Processing (GDPR)

Legitimate interest (Article 6(1)(f)) — review submission is voluntary, and customers reasonably expect their data to be processed for the purpose of publishing their review on the merchant's store. The same legal basis covers sending post-purchase review-request emails to customers who bought from the merchant: the email is transactional (non-promotional, scoped to the product purchased, with an immediate-honor unsubscribe link), the merchant is the data controller, the customer was given a clear opt-out at the point of contact-details collection (Shopify's checkout marketing checkbox), and the processing is limited to what's necessary for the legitimate purpose of soliciting feedback on the purchased product. Where applicable, this also satisfies the PECR Regulation 22(3) soft-opt-in conditions (existing customer, similar products, opt-out at collection, opt-out in every message). Customers can withdraw consent at any time via the email's unsubscribe link or by setting their Shopify emailMarketingConsent.marketingState to UNSUBSCRIBED — both surfaces immediately suppress future BetterReviews emails to that recipient. Merchants whose legal posture requires the stricter explicit-opt-in interpretation can configure their store to send review-request emails only to customers in the SUBSCRIBED Shopify state.
Contract performance (Article 6(1)(b)) — when a customer responds to a review request email, processing is necessary to fulfill that request
Consent (Article 6(1)(a)) — on our free public review-to-ad tool (betterreviews.app), a visitor who enters their email to receive their generated creatives must tick a required checkbox consenting to receive those results and occasional marketing emails. We send the result email and enrol the address in a marketing email sequence (delivered via Loops.so) only on that consent. Every message carries a one-click unsubscribe that also erases the email from our records.
Legitimate interest (Article 6(1)(f)) — free-tool review processing — where you upload reviews you control (CSV), we process them to generate the results you requested, in reliance on your confirmation that you hold the necessary rights. For our free persona tool's URL path, we read reviews publicly displayed on a store page you submit and process them transiently to produce an aggregate, non-attributable customer-persona summary — the default output for any visitor: reviewer names are dropped at ingestion, no verbatim reviewer text appears in that summary, and the source reviews are not retained after the run. We rely on Article 6(1)(f) for this minimized, non-attributable processing. Full-fidelity output that includes verbatim quotes is unlocked only by proving control of the store's own email inbox (the store owner processing their own customers' reviews). Our free ad-creatives tool's URL path remains not available to visitors in the EEA, UK, or Switzerland. To ask us to remove a store or review processed by the tool, email privacy@betterreviews.app.
Pre-contractual measures (Article 6(1)(b)) and legitimate interest (Article 6(1)(f)) — demo requests — when you submit our demo-request form, you have asked us to contact you about using BetterReviews, so processing your request details is necessary to take steps at your request prior to entering into a contract, and we also have a legitimate interest in responding to inbound sales inquiries and attributing them to our marketing. We rely on this basis — not consent — because you initiated the contact and we do not enrol you in any automated marketing email sequence. To request erasure of your demo-request data, email privacy@betterreviews.app; because we send you no automated email, there is no self-serve unsubscribe link, so this is the route to exercise that right.
Consent (Article 6(1)(a)) — advertising measurement on our marketing site — the Meta Pixel, the Google Ads conversion tag, Microsoft Clarity (session replay and heatmaps), and our analytics cookies on betterreviews.app rely on consent where consent is required. For visitors in the EEA, UK, and Switzerland they load only after the visitor accepts our cookie banner; a visitor can withdraw at any time by declining the banner. Elsewhere, where prior consent is not legally required, they load by default, and we honor a Global Privacy Control signal as an opt-out for both advertising tools (see §9). A Global Privacy Control signal also keeps Google's advertising signals denied for our analytics cookies.

Under the legitimate interest basis, no consent checkbox is required at the point of submission. Transparency is provided by this Privacy Policy and our Terms of Service, which are linked at the point of collection — including when you start an AI-guided review (for example, by selecting a star rating to continue).

4. Data We Do NOT Collect

Street addresses or postal codes
Phone numbers
Payment or credit card information
Browsing history outside of the merchant's store — with exceptions on our own marketing website (betterreviews.app), where consent-gated third-party tools set cross-site identifiers that let their vendors correlate your visit with your activity elsewhere: the Meta Pixel and the Google Ads conversion tag (advertising measurement), and Microsoft Clarity, which sets Microsoft cookies that Microsoft states are used for advertising, analytics and other operational purposes (see §2, §6, and §10). None of this applies to merchant storefronts, the merchant admin, or Shopify customer data.

What we do not do with AI

When we use AI on review content, conversation messages, photos, or optional video answers, we do not:

Run facial recognition or identify individuals from photos or video
Perform speaker identification, voice biometrics, or voiceprint matching
Infer sensitive categories (such as health, ethnicity, or religious belief) from review media
Use customer review content to train, fine-tune, or develop AI models

5. Data Retention

Data Type	Retention Period
Reviews (content)	Until merchant deletes or store uninstalls
Customer PII in reviews	Until redaction request (within 30 days)
Review requests	90 days after sending
Conversation transcripts	Until merchant deletes or store uninstalls
Video review recordings and speech transcripts	Until merchant deletes or store uninstalls
AI analysis data	Until merchant deletes or store uninstalls
Claim-support links (claim matched to a review + quoted sentence)	Until the review is deleted or redacted, or the store uninstalls
Analytics events	13 months
Compliance exports	90 days
Database backups	Rolling tiered retention across multiple encrypted off-site copies. Depending on the copy, daily backups are kept up to 30 days, weekly backups up to about a year, and monthly backups from about three months up to indefinitely, plus a short recovery window of up to 30 more days before expired copies are permanently removed. Every backup is encrypted before it leaves our servers.
Free-tool generated results (per run)	Ephemeral — held briefly server-side under an unguessable token solely to display and email your results, then automatically deleted (within ~7 days). No public, shareable, or indexed result page is created.
Free-tool lead email	Until you unsubscribe or request erasure (one click in any email). On unsubscribe we delete your email from our records and from our email provider, and add a one-way hash to a suppression list to honor your opt-out.
Marketing-site session recordings and heatmaps	Session recordings are kept for 30 days; recordings we mark as favorites, plus a randomly selected sample, and heatmap data are kept for up to 9 months. One caveat, disclosed for transparency: Microsoft Clarity provides no facility to delete an individual visitor's recording — deletion is only possible for an entire project. We therefore cannot single out and erase one person's recording on request; the data expires on the schedule above. Because these recordings are captured in Clarity's strictest masking mode and we collect no name, email, or account identifier alongside them, we hold no means of identifying which recording belongs to which visitor.
Demo-request details	Retained while we follow up on your demo request and for sales attribution, until you request erasure (email `privacy@betterreviews.app`). On erasure we delete the stored record(s) for your email and add a one-way hash to a suppression list so we do not re-capture it. If a conversion report was already sent to an advertising platform (see §1 and §6), we also submit a retraction of that report to the platform.
Invited viewer accounts	Access revoked when the inviting merchant removes the person (the membership record is retained until shop redact). Shop redact deletes memberships for that store. Uninstall alone does not. Neither shop redact nor revoke deletes the account. The stored email is removed only on an erasure request to `privacy@betterreviews.app`. v1 has no self-service delete.

6. Third-Party Processors

Provider	Purpose	Data Shared
Google Workspace	Business email (inbox)	Email correspondence content
Resend	Transactional email delivery (primary)	Recipient email, email content
Amazon Web Services (SES, US)	Transactional email delivery for post-purchase review request emails	Recipient email, recipient first name, email content
Amazon Web Services (SNS, US)	Delivery feedback for those emails — receiving bounce and spam-complaint notifications so we can stop emailing an address	Recipient email address, bounce or complaint type and time
OpenAI	AI conversation support, review drafting and analysis, photo vision analysis, and speech-to-text for recorded video answers	Conversation messages, review text, uploaded review photos for vision analysis, and audio from recorded video answers for transcription (no email, name, or order identifiers)
Anthropic	AI conversation guidance	Conversation messages you send (no email, name, or order identifiers)
Tinybird	Analytics pipeline	Opaque IDs only (no PII)
Cloudflare R2	Media storage and off-site database backups	Uploaded images/videos, and complete database backups (encrypted before storage)
Amazon Web Services (S3, US)	Off-site database backups (third copy)	Complete database backups (encrypted before storage)
Hetzner	Infrastructure hosting and off-site database backups	All application data (encrypted), and complete database backups (encrypted before storage)
PostHog (US)	Product analytics and session replay for the merchant admin app	Masked DOM events, route paths, click coordinates, viewport size, store identifier. HTTP request bodies and headers are not recorded. Inputs and rendered text are masked client-side before transmission.
LogRocket (US)	Session replay for the merchant admin app	Masked DOM events and network request URLs. HTTP bodies are not recorded; sensitive headers (Authorization, Cookie, X-CSRF-Token, X-Shopify-Access-Token) are stripped client-side. Visitor IP is not recorded.
Intercom (US)	Live support chat in the merchant admin only, answered by our team (no AI replies)	Account email, store name, store domain and myshopify domain, BetterReviews plan name, billing status, store creation date, and the chat messages you write. Never run on storefronts or shown to shoppers; no shopper data is sent. Deleted when a store is erased under Shopify's `shop/redact` request.
Google Analytics (US)	Visitor analytics on our marketing website (betterreviews.app) only	Pseudonymous usage events, IP-derived region, online identifiers (e.g. the `_ga` client ID). Analytics cookies share the site-wide consent state: where a visitor's advertising consent is granted (see the Google Ads section below), Google also processes these signals for advertising measurement. Not run on storefronts or in the merchant admin.
Google Ads (US)	Advertising conversion measurement on our marketing website (betterreviews.app) only	Ad-click identifiers, a demo-form-submitted conversion event, and booked-demo conversions reported from our own records (not for EEA/UK/CH visitors), page URL and referrer, IP address, browser/device information. Consent-gated, conversion measurement only, no remarketing. See the Google Ads section below.
DataFa.st	Visitor analytics on our marketing website (betterreviews.app) only	Page views, referrers, and first-party cookies, including a visitor identifier and a session identifier. No cross-site identifiers. For visitors in the EEA, UK, and Switzerland, loaded only after the visitor accepts our cookie banner.
Microsoft Clarity (US / Microsoft Ireland Operations Ltd for EU visitors)	Session replay and heatmaps on our marketing website (betterreviews.app) only. Microsoft acts as a data controller for this data, not as our processor — see the section below.	Mouse movement, click coordinates, scroll depth, page navigation, page address and page title, referring page, IP address (used for approximate location and then not retained by us), browser/device information, and Microsoft cookie identifiers. Page text and anything you type are masked in your browser before upload. Not run on storefronts, in the merchant admin, or on our audit-report pages.
Cloudflare Turnstile (US)	Bot protection on our free review-to-ad tool (betterreviews.app) only	Your IP address and a browser-challenge signal, used solely to block automated abuse. No tracking cookies, no cross-site identifiers, no advertising use.
Loops.so (US)	Marketing email delivery for free review-to-ad tool leads (betterreviews.app) only — used only after you consent	Your email address and non-identifying tags (which tool you used, the product name). We never send Loops the review content or generated creatives. You can unsubscribe and erase your email from any message.
Slack (US)	Internal notification of demo requests to our private sales channel	Your name, work email, company, and monthly order volume bracket from the demo-request form. Used only to prepare for and follow up on your demo.
Cal.com (US)	Demo call scheduling	Your name, work email, company, and monthly order volume bracket, passed to the booking page to prefill it, only if you proceed to book a time.

Our AI providers receive review and conversation content only as needed to operate the service. We do not send them customer email addresses, names, or order identifiers, and we do not use their services for facial recognition, speaker identification, or model training on customer content.

We use three session-replay tools in total, on two separate surfaces: PostHog and LogRocket in the merchant admin (below), and Microsoft Clarity on our marketing website (above). None of them runs on customer-facing storefronts. PostHog and LogRocket are used only on the merchant admin dashboard inside the Shopify Admin. They do not run on customer-facing storefronts and never see customer review submissions in transit. Both are configured mask-by-default — every input value and every rendered text node is replaced with a placeholder before the snapshot leaves the browser. Customer review content visible to merchants in the admin is additionally redacted at the DOM level so it does not appear in replays. Both replay tools are configured to exclude the Intercom support chat, so your support conversations are not recorded in a session replay.

Merchant-granted viewer access (Settings → Team, magic-link sign-in to app.betterreviews.app) is not staff access. BetterReviews personnel do not use viewer accounts to look at a store; internal access is the separate founder dashboard described under Internal access by BetterReviews staff.

Advertising measurement on our marketing website (Meta Pixel)

Our marketing website (betterreviews.app) uses the Meta Pixel to measure the effectiveness of our advertising. For the personal data the pixel collects, BetterReviews and Meta Platforms, Inc. act as joint controllers of that collection and transmission (Meta is not merely our processor here). The pixel runs only on our marketing website — never on merchant storefronts, in the merchant admin, or on any Shopify customer, review, or order data. The data shared with Meta is limited to:

The marketing-site page you view and the page you came from, your IP address, and general browser/device information
A first-party cookie identifier (_fbp, and _fbc when you arrive from a Meta ad)
Two standard events — a page view, and a "Lead" event if you submit your email to one of our free tools

We have turned off Meta's automatic data collection ("automatic advanced matching" and automatic events), so the pixel does not read your email, name, or other form-field contents, and we attach no such personal data to the Lead event. The pixel does not send review content or generated results to Meta. (If a merchant has asked us to turn on a Meta catalog feed, published reviews reach Meta through that feed instead; see "Syndication to third-party product-rating services" below.) For visitors in the EEA, UK, and Switzerland the pixel loads only after you accept our cookie banner (consent); for visitors elsewhere it loads by default, we apply Meta's Limited Data Use, and we honor a Global Privacy Control signal as an opt-out (see §9). You can review Meta's practices in the Meta Privacy Policy.

Advertising measurement on our marketing website (Google Ads)

Our marketing website (betterreviews.app) also uses a Google Ads conversion tag to measure whether our own Google ads lead to demo requests and booked demo calls. For the personal data the tag collects, BetterReviews and Google act as joint controllers of that collection and transmission (Google is not merely our processor here). The tag runs only on our marketing website: never on merchant storefronts, in the merchant admin, or on any Shopify customer, review, or order data. The data shared with Google is limited to:

The marketing-site page you view and the page you came from, your IP address, and general browser/device information
First-party cookie identifiers (_gcl_aw and _gcl_gb) that hold the ad-click identifier from a Google ad you clicked
One conversion event when you submit our demo-request form (a booked demo call is not reported from your browser)
If you booked a demo call after clicking one of our Google ads, we may later report that booking to Google Ads from our own records — the stored ad-click identifier, the booking time, and a booking reference used only to prevent double counting — so we can measure which ads lead to booked calls (see §1). We do not report bookings from visitors in the EEA, UK, or Switzerland

We use the tag for conversion measurement only. We never grant Google's ad personalization signal, so your data is not used to build remarketing audiences or to show you personalized ads, and we attach no name, email, or other form-field contents to any conversion event. For visitors in the EEA, UK, and Switzerland the tag loads only after you accept our cookie banner (consent); for visitors elsewhere it loads by default, and we honor a Global Privacy Control signal as an opt-out (see §9). You can review Google's practices in the Google Privacy Policy.

Syndication to third-party product-rating services

When a merchant enables a syndication integration (Google Shopping, which the merchant turns on in their BetterReviews admin, or a Meta catalog feed for Facebook and Instagram Shops, which our team turns on at the merchant's request), approved reviews you submit may be shared with the corresponding third-party product-rating service so that the merchant can display review ratings on their listings in Google Shopping, Google Search, Google Ads, and Facebook and Instagram Shops. The data shared per review is limited to:

Your displayed reviewer name, shown as first name and last initial (e.g. "Jane D.")
Review title, body content, and star rating
Verified-buyer status (true/false)
The review's language (a two-letter code such as "en"), when known
Details of the product the review is associated with (name, URL, and barcode/GTIN, SKU, and where applicable brand and manufacturer part number; for Meta, the Shopify product ID)
The review submission timestamp (and, for Meta, when the review was last updated)

The following are never shared with these services:

Reviewer email address
Order ID or any order details
Conversation transcripts or AI analysis data
Shopify customer ID
Reviewer location (city, state/province or country)
Uploaded photos or videos

If a redaction request is processed for your review, the syndicated copy is refreshed on the third-party service's next crawl of our feed (typically within 24 hours). The third-party service may retain its own copy of the previously-fetched feed for an additional period under its own retention policy.

Session replay and heatmaps on our marketing website (Microsoft Clarity)

Our marketing website (betterreviews.app) uses Microsoft Clarity to understand how visitors use our pages. Microsoft states that it acts as a data controller for the data Clarity collects — it is not our processor, and no Article 28 data processing agreement is available for it. For the collection and transmission that happens on our site we and Microsoft act as joint controllers; once the data reaches Microsoft, Microsoft determines its own further use as an independent controller. For visitors in the EEA, UK and Switzerland the contracting Microsoft entity is Microsoft Ireland Operations Limited, which transfers data to Microsoft Corporation in the United States under Standard Contractual Clauses.

Clarity runs only on our marketing website — never on merchant storefronts, in the merchant admin, on our audit-report pages, or on any Shopify customer, review, or order data. What it records:

How you move through the page: mouse movement, click coordinates, scroll depth, and page navigation, replayed as a session recording and aggregated into heatmaps
The page address and page title, the page you came from, your IP address, and general browser, device, language and timezone information
Microsoft cookie identifiers (see §10)

What it does not record. Clarity is configured in its strictest masking mode, which replaces the text of our pages with placeholder characters in your browser before anything is uploaded. Everything you type into a form is masked in every mode and cannot be unmasked. We additionally mark the regions of our free tools that can display customer review content, so those are masked independently of that setting. The page address and page title are not masked, so we keep personal and customer names out of both.

Your choices. For visitors in the EEA, UK and Switzerland, Clarity loads only after you accept our cookie banner. Elsewhere it loads by default, and we do not load it at all if your browser sends a Global Privacy Control signal. Microsoft additionally offers an industry opt-out at optout.aboutads.info (select Microsoft), and Clarity honors Global Privacy Control. Recordings expire on the schedule in §5; as noted there, Microsoft provides no way to delete an individual visitor's recording.

Merchant-connected email-marketing platforms (Klaviyo)

A merchant can connect their own email-marketing platform — currently Klaviyo — to their BetterReviews account. When that connection is active, data about your review and your contact details may be shared with the merchant's Klaviyo account so the merchant can send communications and include review content in their emails. The data shared may include:

Your name and email address
Your review title, body content, and star rating
Review metadata such as sentiment, verified-buyer status, and our internal quality/marketing scores
The product the review is associated with

The merchant is the data controller of their own Klaviyo account; Klaviyo acts as a processor for the merchant, and as a sub-processor in our processing chain. The merchant's use of your data inside Klaviyo is governed by the merchant's own privacy policy and Klaviyo's terms. You can review Klaviyo's privacy practices at klaviyo.com/legal/privacy-policy.

When you exercise your right to erasure, the merchant — as controller of their Klaviyo account — is responsible for deleting your profile there. As a courtesy, when a redaction request is processed, BetterReviews also asks Klaviyo to delete the corresponding profile on a best-effort basis. To exercise any data right, contact the Shopify store where you made your purchase.

Merchant-connected checkout partners

A merchant can connect a checkout or post-purchase app — for example PDQ — to their BetterReviews account. When that connection is active, the partner may receive:

For a returning customer who is signed in to their account at checkout, a single coarse label describing that customer's own most recent review experience in the last 180 days at that store: "had a poor experience", "had a good experience", or "nothing to act on". The same "nothing to act on" answer is given when the customer has never reviewed, left a neutral review, or is unknown to us. The partner never receives your review text, star rating, name, email, or any other contact details through this label.
The merchant's published reviews of a product, exactly as they are already shown on the merchant's storefront — review text, star rating, date, the reviewer's public display name (e.g. "Jane D."), the reviewer's location label (e.g. "from Texas") and review photos and videos — optionally ordered so reviews from the shopper's own area come first. The location label follows the merchant's location setting: when the merchant turns it off, the partner receives no location for any review. The partner never receives a reviewer's email, full name, customer or order number, or street address or postal code.
For a specific order, a link the customer who placed it can use to review their own order, shown on the order-tracking page. The link opens a review of that one order only and works for up to 7 days.

The partner uses this only to tailor that customer's checkout and order-tracking page for the merchant — for example, to offer help to a customer who had a poor experience, or to show nearby shoppers' reviews. The merchant is the data controller; the partner acts as a processor for the merchant and as a sub-processor in our processing chain. The partner fetches this information from us on request; we do not send it customer data on our own initiative, we require the partner to keep the label and the reviews for no longer than one hour, and we require it to hold an order's review link only in memory while showing it to that order's customer. When the merchant disconnects the partner, its access stops immediately. To exercise any data right, contact the Shopify store where you made your purchase.

Internal access by BetterReviews staff

A small number of authorized BetterReviews personnel (currently the two cofounders) may access encrypted customer personal data (email and name) for operational purposes — investigating support tickets, diagnosing review-submission issues, and reviewing platform health. Every such access is recorded in an append-only audit log and is bound by per-session rate limits. Access is restricted to staff devices on our private network; the access surface is not reachable from the public internet. Staff cannot modify customer data through this surface — it is read-only.

7. Security Measures

AES-256-GCM encryption for customer PII and Shopify access tokens at rest
TLS 1.3 for all data in transit
bcrypt password hashing with strong password requirements
SHA-256 one-way hashing for API keys
Per-store rate limiting
Database accessible only via internal network (no public access)

8. Your Rights (GDPR)

If you are located in the European Economic Area, you have the right to:

Access — request a copy of your stored data
Rectification — request correction of inaccurate data
Erasure — request deletion of your data
Restriction — request limits on how your data is processed
Portability — receive your data in a machine-readable format
Objection — object to processing of your data

To exercise these rights, contact the Shopify store where you made your purchase. The merchant will submit your request through Shopify, which triggers our automated GDPR webhook handlers. We process all data requests and redaction requests within 30 days.

9. Your Rights (CCPA)

If you are a California resident, you have the right to:

Know what personal information we collect and how it is used
Request deletion of your personal information
Opt out of the sale or sharing of your personal information

We do not sell personal information for money. On our marketing website (betterreviews.app) the Meta Pixel and the Google Ads conversion tag share limited visitor data with Meta and Google for advertising measurement, and Microsoft Clarity sets Microsoft cookies that Microsoft states are used for advertising as well as analytics — any of which California law may treat as "sharing" for cross-context behavioral advertising. You can opt out of both in any of these ways: enable a Global Privacy Control signal in your browser, which we honor automatically for the Meta Pixel, for Google Ads, and for Microsoft Clarity (none of the three is loaded at all when that signal is present); decline our cookie banner (shown to EEA/UK/CH visitors); or email us. We also apply Meta's Limited Data Use for US visitors, we never grant Google's ad personalization signal, and Microsoft offers a separate industry opt-out at optout.aboutads.info. This sharing is limited to marketing-site visitors — we never sell merchant, customer, or review data, or share it for cross-context behavioral advertising. (Syndicating published reviews to a merchant's Google or Meta product listings at the merchant's request is a service we provide to the merchant, not a sale or sharing.) To exercise your rights, contact the Shopify store where you made your purchase, or email us directly.

10. Cookies

BetterReviews does not set first-party cookies on merchant storefronts. Our web pixel uses Shopify's built-in analytics infrastructure, which respects the merchant's cookie consent configuration.

The merchant admin dashboard (used only by store owners and staff inside the Shopify Admin) does set first-party cookies via PostHog and LogRocket for session replay and product analytics. These cookies are not set on shopper-facing pages. The support chat in the merchant admin (Intercom) also sets first-party cookies and browser local storage (intercom-session-*, intercom-id-*, intercom-device-id-*) to keep your chat session and conversation history; they are used only to run the support chat and are likewise never set on shopper-facing pages.

Our marketing website (betterreviews.app) uses Google Analytics, which sets _ga first-party cookies. For visitors in the EEA, UK, and Switzerland these cookies are set only after the visitor accepts our cookie banner; until then Google Analytics runs in a cookieless, consent-denied mode. For visitors elsewhere, where prior consent is not required, the cookies are set by default. The marketing site also uses DataFa.st for visitor analytics, which sets first-party cookies, including a visitor identifier and a session identifier. Like Google Analytics, for visitors in the EEA, UK, and Switzerland DataFa.st is loaded only after the visitor accepts our cookie banner; for visitors elsewhere it loads by default. The marketing site also uses the Meta Pixel for advertising measurement, which sets first-party cookies (_fbp, and _fbc when you arrive from a Meta ad). Like the analytics cookies, for visitors in the EEA, UK, and Switzerland the Meta Pixel and its cookies load only after the visitor accepts our cookie banner; for visitors elsewhere they load by default (subject to the opt-outs in §9). The marketing site also uses a Google Ads conversion tag, which sets the first-party cookies _gcl_aw and _gcl_gb (holding the ad-click identifier, kept for 90 days). These cookies are set only where advertising consent has been granted: for EEA/UK/CH visitors only after they accept our cookie banner, and never for a visitor whose browser sends a Global Privacy Control signal (see §9). Our marketing site also uses Microsoft Clarity for session replay and heatmaps. Clarity is the first tool on our site to set third-party cookies — cookies set on a Microsoft domain rather than ours, which Microsoft can read across other sites that use its services. It sets two first-party cookies, _clck (a visitor identifier, about 1 year) and _clsk (joins your page views into one recording, about 1 day), and the Microsoft third-party cookies MUID (about 13 months), CLID, ANONCHK, MR and SM. Microsoft's documentation describes MUID as used for advertising, site analytics and other operational purposes. Like the tags above, for visitors in the EEA, UK, and Switzerland Clarity and its cookies load only after the visitor accepts our cookie banner; for visitors elsewhere they load by default, and never when a Global Privacy Control signal is present (see §9). Our free review-to-ad tool uses Cloudflare Turnstile for bot protection; it sets no tracking cookies, although Cloudflare may set a strictly-necessary security cookie if an interactive challenge is required, which is exempt from consent.

Our standalone merchant app sets first-party cookies that are strictly necessary to sign you in, and no analytics or advertising cookies at all. _ppo_app_key is the session cookie: it holds only a signed reference to the store you are signed in to, or — for an invited viewer — a signed reference to that viewer account. It contains no personal data, no analytics, and no advertising identifiers. It is HttpOnly and Secure, restricted to same-site requests, expires after 12 hours, and is deleted when you sign out. If you sign in using "Log in with Shopify" rather than opening the app from the Shopify Admin or from an emailed sign-in link, we also set a short-lived _ppo_app_oauth_state cookie for the duration of that sign-in. It holds only your store's Shopify domain and a random one-time value (plus the time it was issued) used to verify that the sign-in you complete is the one you started; it expires after 10 minutes and is deleted as soon as the sign-in finishes. We do not store any Shopify access token from that sign-in. Both cookies are strictly necessary and are therefore exempt from consent. Your browser also remembers two preferences on your device only: the store domain you last entered for "Log in with Shopify" (sent to us only as part of a sign-in you initiate) and which store you last viewed in the dashboard (never sent to us). You can clear both by clearing your browser's site data.

11. Children's Privacy

BetterReviews is not directed at children under 13. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via the app dashboard. The "last updated" date at the top reflects the most recent revision.

13. Contact

For privacy inquiries: privacy@betterreviews.app

BetterReviews is operated by BetterReviews Daniel Studziński, a sole proprietorship (jednoosobowa działalność gospodarcza) registered in Poland and the data controller for the purposes of this policy, with a registered address at al. Solidarności 68/121, 00-240 Warsaw, Poland.