Privacy policy

Last updated 28 October 2026

What ReviewLoop is

ReviewLoop helps a business ask its own customers for a review. You create an account, add customers you have served, and we email those customers a review request on your behalf.

What we store

• Your account: business name, email address, and your password as a salted scrypt hash. We never store the password itself.
• Your customers: the name, email address, and service date you enter, plus the review request we send and whether it was clicked.
• Sessions: a random token in an httpOnly cookie, stored as a hash so a database leak cannot be replayed as a live session.

Cookies

One cookie, rl_session, and it exists only to keep you signed in. It is httpOnly, SameSite=Lax, and Secure over HTTPS. There is no analytics, no advertising pixel, and no third-party script on any page.

Who else sees the data

These providers process data on our behalf and are bound by their own terms:

• Cloudflare — hosting and the database.
• Resend — delivery of review request emails.
• Stripe — payment processing, if you subscribe. Card details are entered on Stripe's pages and never reach our servers.

Your customers' data

The business that adds a customer is responsible for having a lawful reason to email them — normally that they are a recent customer. We act as a processor for that data and use it only to send the request you asked for. Every email contains a one-click unsubscribe link that works without signing in.

How long we keep it

Account and customer records are kept while your account is open, so you can see what was sent and what worked. Ask us to delete your account and we remove the account, its customers, and its request history. Outbound email logs are kept for a limited period to diagnose delivery problems and prevent abuse.

Your rights

You can ask for a copy of your data, correction of anything wrong, or deletion of your account. Email hello@reviewloop.link and we will respond within 30 days. If you are a customer of a business using ReviewLoop and want your data removed, contact that business first; we will act on their instruction. You can also unsubscribe from any request email directly.

Security

Passwords are hashed with scrypt and a per-user salt. Session tokens are hashed at rest. Traffic is served over HTTPS and state-changing requests are rejected when they come from another origin.

Changes

If this policy changes materially, account holders will be told by email before the change takes effect.