Privacy Policy

We collect the following categories of information:

• Account information: Name, email address, and authentication data collected via Clerk when you register or sign in.
• App review data: Reviews, ratings, author names, device metadata, and version information imported from your connected Google Play or Apple App Store accounts via their respective APIs.
• Usage data: Pages visited, features used, session duration, and interactions within the Service, collected via PostHog.
• Payment information: Billing details processed and stored by Stripe. We do not store raw card numbers.
• Communication data: Emails or messages you send to our support address.

We use collected information to:

• Provide, operate, and maintain the Service, including syncing reviews, generating AI reply drafts, and detecting incidents.
• Improve and fine-tune our AI models using aggregated, anonymized review data. We do not use personally identifiable information for model training without explicit consent.
• Send operational alerts (email, Slack) based on your configured notification preferences.
• Process payments and manage your subscription via Stripe.
• Detect, prevent, and respond to security incidents or abuse.
• Comply with legal obligations.

We do not sell your personal data, and we do not use it to train our own models. We share data only with the third parties needed to run the service. The complete, current list — what each provider receives and where it operates — is published at Sub-processors, which is updated whenever that list changes.

In summary, those providers host the application, store your review and account data, authenticate you, process payments, generate AI drafts, send email, cache results, and give us error and usage diagnostics.

We may also disclose data if required by law or court order, or to protect the rights and safety of AT WORK Inc, trading as ReviewBox or its users.

App store reviews and associated metadata are retained for up to 2 years from the date they are imported. Upon account cancellation or deletion, all personal data and review data associated with your account will be permanently deleted within 30 days. Aggregated, anonymized statistics may be retained indefinitely for product improvement purposes.

If you are located in the European Economic Area (EEA) or United Kingdom, you have the following rights under GDPR:

• Access: Request a copy of the personal data we hold about you.
• Export: Download your data in a portable format via Settings → Privacy → Export data.
• Deletion: Request erasure of your data via Settings → Privacy → Delete account or by emailing us.
• Correction: Request correction of inaccurate personal data.
• Objection: Object to processing of your data for direct marketing purposes.

To exercise any of these rights, email legal@tryreviewbox.com. We will respond within 30 days.

The measures we actually operate today are:

• Data is encrypted in transit using TLS, and at rest by our database provider.
• Database access is enforced with row-level security policies, so a workspace can only read its own data.
• Access to production systems is limited to people who need it, and authentication to our own accounts uses multi-factor authentication.
• Secrets and API credentials are held in environment configuration, never in source code.

We do not currently hold SOC 2, ISO 27001, or any comparable certification, and we do not claim one. If that changes, this page will say so and name the auditor.

Despite these measures, no system is completely secure. Please notify us immediately at security@tryreviewbox.com if you believe your account has been compromised.

We use essential cookies (Clerk auth), functional cookies (preference storage), and optional analytics cookies (PostHog). We do not use advertising or tracking cookies. For the full list see our Cookie Policy.

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected data from a child, please contact us at legal@tryreviewbox.com and we will delete it promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a prominent notice within the Service at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

AT WORK Inc, trading as ReviewBox is registered in India, and we handle personal data in accordance with Indian data protection law, including the Digital Personal Data Protection Act, 2023 as it comes into force, alongside the obligations described elsewhere in this policy.

You may ask us to give you access to your personal data, to correct or complete it, or to erase it, and you may withdraw a consent you previously gave. You can also nominate another person to exercise these rights on your behalf if you are unable to.

Requests and complaints go to privacy@tryreviewbox.com. If you are not satisfied with our response, escalate it through our grievance redressal process, which names the officer responsible and the timelines we work to. You retain the right to complain to the relevant data protection authority.

ReviewBox drafts replies, classifies sentiment, and suggests keywords using third-party AI providers. When you use one of those features, the review text and the templates and knowledge-base entries you have configured are sent to that provider so the output can be generated. No review text is sent to an AI provider except to perform one of those actions.

Reviews published on an app store are public, but they still describe identifiable people and can contain personal data about the reviewer. Our Sub-processors page names each AI provider and where it operates.

Drafts are suggestions. Nothing is published to an app store until a person at your organisation reviews it and chooses to post it.

If you have questions about this Privacy Policy or our data practices, please contact us at legal@tryreviewbox.com.