Privacy Policy

1. Who We Are

Grow Our Reviews is operated by Welto Digital ("we," "us," or "our"). We provide automated review request services to help businesses collect more Google reviews from their customers.

2. Information We Collect

Account Information (You provide directly):

• Your email address and password
• Business name and Google Reviews URL
• Billing information for subscription payments

Customer Data (You provide on behalf of your customers):

• Customer names and phone numbers for SMS delivery
• Review responses and ratings submitted by customers
• Feedback messages from customers who provide private feedback

Automatically Collected:

• Usage data (features used, pages visited, time spent)
• Device information (browser type, IP address, operating system)
• SMS delivery status and click tracking for review requests

3. How We Use Your Information

• Service Delivery: Send SMS review requests, process customer responses, display analytics
• Account Management: Create and manage your account, process payments, provide customer support
• Service Improvement: Analyze usage patterns to improve our service features
• Communication: Send service updates, billing notifications, and customer support
• Legal Compliance: Comply with applicable laws and protect our rights

Our Legal Bases (UK GDPR)

• Contract: to create your account, deliver the service, and take payment
• Legitimate interests: to secure, maintain, and improve the service and prevent abuse
• Consent: for optional analytics and marketing cookies, which you can withdraw at any time
• Legal obligation: to keep records we are required to keep and to honour opt-out requests

4. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share information in these limited circumstances:

• Service Providers (sub-processors): Twilio (SMS delivery), Stripe (payment processing), Supabase (database & authentication hosting), Resend (transactional email), Google Places (business search and review data), Microsoft Clarity (website analytics), and Meta (advertising measurement). Each receives only the data needed to perform its function.
• Legal Requirements: When required by law or to protect our rights and safety
• Business Transfer: In connection with a merger, acquisition, or sale of assets (with notice to you)

5. Data Processing Role

For customer data you provide (names, phone numbers, reviews), we act as a data processor on your behalf. You remain the data controller and are responsible for:

• Obtaining proper consent from your customers before using our service
• Ensuring your customers understand their data will be used for review requests
• Handling any data subject requests from your customers
• Complying with applicable data protection laws in your jurisdiction

6. Your Rights (GDPR Compliance)

Under the UK GDPR (and the EU GDPR if you are in the European Economic Area), you have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data
• Portability: Receive your data in a machine-readable format
• Restriction: Limit how we process your data
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time where processing is based on consent

You can delete your account and all associated data at any time from your account settings, delete an individual customer's data from your dashboard, and export your review and feedback data as CSV. To exercise any other right, contact us at hello@growourreviews.com and we will respond within one month.

7. Data Security

We implement appropriate technical and organizational measures to protect your information, including encryption in transit and at rest, access controls, optional two-factor authentication on accounts, breach-checked password requirements, and regular security assessments. However, no internet transmission is 100% secure.

8. Data Retention

We retain your information for as long as your account is active or as needed to provide services. When you delete your account, your data is removed promptly and any active subscription is cancelled. Short-lived operational logs that contain technical identifiers (such as IP addresses used for rate limiting and abuse prevention) are automatically deleted after 90 days. Limited records may be kept where required for legal compliance, tax, or fraud-prevention purposes for up to 7 years.

9. International Transfers

Your information may be transferred to and processed in countries outside your country of residence. We ensure appropriate safeguards are in place for such transfers in accordance with applicable data protection laws.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by email or through our service.