Privacy Policy

Last updated: October 16, 2026

This policy explains what Reviewr does with personal data when you use reviewr.site. It is written for people in the European Union and the European Economic Area, and it also applies wherever you use the service. If a privacy law where you live gives you more protection, that law still applies.

You can ask us to delete your data. Email reviewr.site@gmail.com with the subject “Data deletion request” and the email address on the account. The steps are in Your rights.

Who we are

Reviewr, at reviewr.site, is the controller of the personal data described here. For privacy questions, access requests, corrections, and deletion requests, email reviewr.site@gmail.com.

What we collect

Account. Your email address, password (stored by our authentication provider in hashed form), and the age you enter when you create an account. If you choose Google sign-in, Google shares the account details needed to identify you, such as your email address.
Content you submit. Customer reviews you paste, optional brand name, emphasis, and words to use or avoid, plus the outputs we generate and anything you edit or save.
Use of the service. Your plan (Free or Pro), how many outputs you have used in the current month, and saved library items tied to your account.
Messages. The name, email, feedback type, and description you send us from the contact form or by email.
Browser storage. Sign-in state, plan, drafts, and preferences kept in this browser. The list is in the cookie policy.

The public preview on the marketing page is produced in your browser. That preview is not sent to our generation provider. A review is sent for generation only after you are signed in and you choose Generate.

Card numbers are not stored on Reviewr servers. Stripe collects the card and billing details when you subscribe to Pro.

Why we use it

We use personal data on these grounds under Article 6 of the GDPR:

Contract, Article 6(1)(b). To create your account, check that you are old enough to sign up, generate outputs you request, save your library, and provide the plan you choose.
Legal obligation, Article 6(1)(c). To keep the records that tax or accounting law requires if you pay us, and to respond to lawful requests.
Legitimate interests, Article 6(1)(f). To keep the service secure, enforce monthly allowances, prevent abuse, and fix failures. You can object to this use. We do not use this ground to send marketing email.

You do not have to give us this data, but without an account email, a password or Google sign-in, and an age of 13 or older, we cannot create an account. Without the review text, we cannot generate an output.

We do not sell personal data. We do not use your reviews or outputs to advertise to you, and we do not make automated decisions that produce legal effects about you. The monthly output limit is a plan rule, not a judgment about you.

Who receives it

Supabase hosts the account database, authentication, saved outputs, usage counts, and the generation function.
OpenAI receives the review and the settings for that run (tone, length, channel, brand, emphasis, and words to use or avoid) when you generate while signed in, so it can write the outputs.
Google receives a font request when a page loads, described in the cookie policy. If you choose Google sign-in, Google also processes that sign-in.
Our inbox at reviewr.site@gmail.com receives messages you email to us. The contact form opens your email app and sends the message to that address.
Stripe receives the billing details needed to charge Pro, send invoices, and manage cancellation. We store Stripe’s customer id and the subscription status on your account. We do not store your card number.

We do not share your data with advertisers or analytics services. We do not run advertising or analytics cookies.

Transfers outside the EEA

OpenAI and Google process data in the United States. Supabase may process data outside the European Economic Area, depending on where the project is hosted. Where a provider processes personal data outside the EEA, the transfer relies on that provider’s transfer tools, including standard contractual clauses where the GDPR requires them. You can ask us which provider terms apply to your account.

How long we keep it

Account details, including the age you entered, for as long as the account exists.
Reviews, edits, and saved outputs until you delete the item or we delete the account.
Monthly usage counts for the current UTC month, and longer only if we need them to resolve a billing or abuse dispute.
Support messages until the request is finished, then only as long as we need them for a follow-up or a legal duty.
Payment records for as long as tax and accounting law requires.
Browser storage until you log out or clear site data, as described in the cookie policy. Some of it lasts only until you close the tab.

Cookie policy

Reviewr does not set advertising cookies or analytics cookies, and we do not use a cookie to follow you across other sites.

We do store a few values in this browser so the service you asked for can work. Under the ePrivacy rules, storage that is strictly necessary to provide a service you explicitly requested does not need a separate consent banner. You can clear it in your browser settings. Clearing it signs you out and can remove drafts and library items that exist only on this browser. Items saved to your account stay until you delete them.

Sign-in session (a local storage entry whose name starts with sb- and contains auth-token). Keeps you signed in. Removed when you log out, the session ends, or you clear site data.
reviewr_logged_in, reviewr_email, reviewr_plan. Remember that you are signed in, which email to show, and whether the workspace is on Free or Pro. Kept until you log out or clear site data.
reviewr_library. Testimonials saved on this browser when they are not stored on the account. Kept until you delete them or clear site data.
reviewr_generator_draft, reviewr_pref_tone, reviewr_pref_length, reviewr_pref_channel, reviewr_pref_words_use, reviewr_pref_words_avoid, reviewr_pref_voice_remember. An unsaved draft and the tone, length, channel, and word rules you chose to remember. Kept until you change them or clear site data. Drafts in session storage end when the tab closes.
reviewr_usage_month and reviewr_public_generate_used. Session storage. The first shows usage during the visit when the account total is not available. The second remembers that the public preview on the marketing page was already used. Both end when the tab closes.
reviewr_signup_age. Session storage, only while an account is being created, so the age you entered can be saved on the account. Removed after that, or when the tab closes.

Pages also request the Inter typeface from Google (fonts.googleapis.com and fonts.gstatic.com). That request sends your IP address and basic browser details to Google. It is not a cookie we set, and we do not use it for advertising. Google’s own policy describes what Google does with that connection.

Age

Reviewr is not directed at children under 13. You must be at least 13 years old to create an account. The signup form asks for your age. If the age is under 13, we do not create the account, and we do not store that number. If we learn an account belongs to someone under 13, email us and we will delete it.

GDPR Article 8 lets a country set the age for agreeing to an online service anywhere from 13 to 16. If you are 13, 14, or 15, and the law where you live requires a parent or guardian to authorise the account, that person must agree before you sign up. We rely on the age you enter and on that agreement. A paid plan is a separate contract. The terms of service explain who can enter it.

Your rights

If the GDPR applies to you, you can ask us to:

confirm whether we process your data, and for a copy of it
correct inaccurate data
delete your data
restrict processing in the cases the GDPR allows
receive data you provided, in a portable format, where the processing is based on contract and carried out by automated means
object to processing based on legitimate interests

A data deletion request is made by contacting us. Email reviewr.site@gmail.com with the subject “Data deletion request” and the email address on the account. You can use the contact form for the same request. We delete the account, the age stored on it, the reviews and outputs stored for it, and the related usage records. We keep a record only where a legal duty requires it, such as a tax or accounting record after a payment, or where we need it to establish, exercise, or defend a legal claim. We reply within one month. If a request is unusually complex, the GDPR lets us extend that by up to two further months, and we will tell you if we do.

You can also complain to a supervisory authority. That can be the authority in the EU or EEA country where you live or work, or where you believe a problem happened. A list of authorities is published by the European Data Protection Board at edpb.europa.eu.

Questions about this policy: reviewr.site@gmail.com