Sub-processors
The plain-language version
- ·These are the outside services we use to run ReviewBox, and what each one receives.
- ·Review text is sent to AI providers only when a draft, sentiment score, or keyword suggestion is generated.
- ·Most of these providers are in the United States, so your data crosses borders.
- ·We publish changes here before a new sub-processor starts handling customer data.
This summary is for convenience. The legal terms below are what actually govern your use of the service.
1.Current sub-processors
ReviewBox uses the third parties below to provide the service. Each has access only to the data needed for its function, and each is bound by a data processing agreement with us.
| Provider | Purpose | Data it receives | Location |
|---|---|---|---|
| Vercel | Application hosting and content delivery | All data in transit through the application, including review content and account data | United States (global edge network) |
| Supabase | Primary database and file storage | Review content and metadata, workspace and app records, reply drafts and published replies | United States / EU, depending on project region |
| Clerk | Authentication and user session management | Account email, name, authentication identifiers and session metadata | United States |
| Stripe | Subscription billing and payment processing | Billing name, billing address, email and payment method details (card data is handled by Stripe; we never receive full card numbers) | United States, with local processing entities |
| Groq | AI inference for reply drafting | Review text and your reply templates and knowledge-base entries, at the moment a draft is generated | United States |
| Google (Gemini API) | AI inference for sentiment analysis and keyword suggestions | Review text submitted for classification | United States |
| Upstash | Redis cache and rate limiting | Cached AI drafts keyed by content hash, rate-limit counters | United States / EU, depending on database region |
| Resend | Transactional and notification email | Recipient email address and the content of the email, which may summarise review activity | United States |
| Sentry | Error monitoring and diagnostics | Diagnostic data: stack traces, request paths, browser and device information, IP address and a user identifier | United States |
| PostHog | Product analytics | Usage events, page views, a user identifier and device information | United States / EU, depending on instance region |
2.How review text is used by AI providers
When you generate a reply draft, ReviewBox sends the review text — together with the templates and knowledge-base entries you have configured — to an AI provider so a draft can be written. Sentiment analysis and keyword suggestions work the same way. No review text is sent to an AI provider except to perform one of these actions.
Reviews published on an app store are public, but they may still contain personal data about the person who wrote them. Treat this section as a description of where that text travels.
We do not use your data to train our own models. Whether a given AI provider may use submitted content to improve its own services depends on that provider’s terms and the plan we are on; where a provider offers a no-training or zero-retention configuration for the tier we use, we enable it.
3.International transfers
AT WORK Inc is a partnership firm registered in India, and most of the providers listed above operate from the United States. Using ReviewBox therefore involves transferring data across borders.
Where personal data protected by the GDPR or UK GDPR is transferred, we rely on Standard Contractual Clauses with the relevant provider. Our Data Processing Addendum sets out the terms that apply between us and customers.
4.Notice of changes
Before a new sub-processor begins handling customer personal data, we update this page. Customers with an executed DPA can ask to be notified by email of changes by writing to privacy@tryreviewbox.com.
If you object to a new sub-processor on reasonable data-protection grounds, contact us at the same address and we will discuss alternatives; if none is workable, you may cancel your subscription under the Refund & Cancellation Policy.