Privacy Policy
Effective November 12, 2026
Short version: we collect what it takes to run a review site and nothing more. Your reviews and display name are public; your email never is. We use no advertising or third-party analytics, we never sell data, and a business's customer list is used only to send that business's review requests. You can see, correct and delete what we hold by emailing privacy@roovello.com.
1. Who this covers and who is responsible
This policy covers roovello.com, its subdomains, the business dashboard, our widgets and API, and emails we send. The controller (the party that decides why and how personal data is processed) is Provident Design, LLC, reachable at privacy@roovello.com. It applies to visitors, reviewers, business members, and to people whose email a business gives us for a review request (“request recipients”). For request recipients we act on the business's instructions as its processor, under the limits in section 3.3, and the business is the controller of its list.
2. What we collect
2.1 Account
Your email address; a display name you choose (shown on your reviews instead of your email); if you sign in with Google or Apple, the name, email and profile image they share; sign-in timestamps; a role (reviewer, business member, moderator).
2.2 Reviews and replies
The rating, title, text and service date you submit, every edited version, replies, reports you file with their reason, appeals, and the labels and risk score our moderation assigns. When you submit a review we record a one-way salted hash of your IP address and browser user-agent string (we do not keep the raw values) to detect duplicate accounts and coordinated campaigns.
2.3 Business profiles and teams
Business name, website domain, category, description, address, phone, contact email, time zone, who claimed it and how (the email used, the verification token), team members and roles, invitations, widget keys, and the files uploaded to bring reviews from another platform (the reviews themselves, the source, the reviewer first name and initial as exported, and the uploader's attestation).
2.4 Request recipients
From a business's uploaded list or a receipt copied to our address: email, first name (optional) and service date. From delivery: which emails were sent, bounced, were marked spam, or were opened or clicked where the mail provider reports it, and whether the recipient unsubscribed. Unsubscribed addresses go on a platform-wide suppression list so no business can request them again.
2.5 Payments
Stripe processes payments for Review Requests. We store the Stripe customer and subscription identifiers, plan and status, and period dates. We never see or store card numbers.
2.6 Usage
Server logs from our hosting provider (IP address, URL, time, response), first-party product events (for example “review created” with the business and review id), and, if our own analytics instance is enabled, page views without cookies or cross-site identifiers. We use no third-party analytics, advertising pixels, or tracking cookies, and this is enforced in the code, not just this policy.
2.7 What we do not collect
We do not ask for or store government identifiers, financial account numbers, precise location, health data, or anything about children. We do not buy data about you from anyone.
3. How we use it and on what basis
3.1 Running the service
To sign you in by email link, publish and rank reviews, compute scores, show business profiles, send the emails you asked for (sign-in links, claim confirmations, invitations, notices about your review or appeal), bill paid features, and serve widgets and the API. Basis: performing our contract with you.
3.2 Trust and safety
To detect fake, paid, insider, duplicate and coordinated reviews. New reviews go through rules that compare them with other reviews and account facts, and through an AI classifier run by Anthropic that receives the review text, title, rating, the business name and category, the collection method, whether the reviewer was verified, the reviewer's account age and prior review count, and up to three similar review texts on the same business. It never receives your name, email, IP address or any identifier. Anthropic processes this under its API terms and does not train on it. Basis: our legitimate interest in an honest platform and in protecting readers and businesses from fraud.
3.3 Review requests, strictly limited
A business's customer list is used only to send that business's request emails on the schedule described at For businesses, and to honor unsubscribes and bounces. It is stored in a separate database schema that no reporting, analytics, search or export code can read. We never contact a recipient for any other reason, never combine lists across businesses, never sell or share them, and delete them as described in section 5. Basis: the business's instructions as controller and, for the suppression list, our legal obligations under CAN-SPAM.
3.4 Communicating with you
Transactional email about your account, reviews, claims, team and billing. We do not send marketing email to reviewers. Business members may receive occasional product notices; each has an unsubscribe link. Basis: contract and legitimate interest.
3.5 Legal
To keep records the law requires, to respond to valid legal process, to enforce our Terms, and to defend claims. Basis: legal obligation and legitimate interest.
We do not use personal data for automated decisions with legal or similarly significant effect on you. Moderation decisions that remove a review are reviewable by a person on appeal.
4. What is public
- Your reviews, your display name, the rating, the labels, the service date you gave, the posting date, edit history markers, and replies are public, appear in search engines, on business websites that embed our widgets, in our API and in machine-readable pages for AI assistants. Choose a display name you are comfortable with; your email is never shown.
- Business profiles, scores and claimed status are public. The names and emails of team members are not.
- Reported and held reviews stay visible unless removed, but are excluded from the score while a moderator checks them. Removed reviews are not public; the reason code is shown to the reviewer.
- Imported reviews show the reviewer's first name and initial as exported by the business, the source platform and the original date.
- Nothing about a business's plan or payments is public, and nothing about it affects what is public.
5. How long we keep it
- Reviews are append-only. Published, withdrawn and removed reviews and their versions are kept while the Service operates so that scores, appeals, audits and legal defenses remain verifiable. Withdrawn and removed reviews are not public.
- Accounts are kept until you ask us to close them. On closure we delete your email, name and image, detach sign-in identities, and keep your reviews under the display name you had or “Former member” at your choice; you may also withdraw them first.
- IP and user-agent hashes are kept with the review they belong to; raw values are never stored.
- Request recipients: a business's list entries are deleted 24 months after the last email to that recipient, or sooner when the business asks, closes, or is terminated. Suppression (unsubscribe) records are kept indefinitely because they exist to stop future email.
- Server logs at our hosting provider rotate within 30 days. First-party product events and the audit log are kept for the life of the Service.
- Billing records are kept for seven years for tax and accounting law.
6. Who we share it with, and legal requests
6.1 Service providers
Vercel (hosting, United States), Neon (database, United States), Resend (email delivery and inbound receipts, United States), Stripe (payments), Anthropic (review classification, section 3.2), and Google or Apple only if you choose them for sign-in. Each processes data only to provide its service to us under a contract. There are no others.
6.2 Businesses
A business sees reviews of it as the public does, plus the reports it filed and the request statistics for its own campaigns (sent, bounced, unsubscribed, reviewed). It never sees a reviewer's email, IP or account details, and never sees which of its request recipients wrote which review beyond the public review itself.
6.3 Legal process
We disclose account information only when required by a valid subpoena, court order, search warrant or equivalent legal process, or when we believe in good faith that disclosure is necessary to prevent imminent harm. We review every request for validity and scope, narrow it where we can, and, unless prohibited by law or a court, notify the affected user before complying so they can object. Because we store IP addresses and user agents only as salted hashes, we cannot produce the raw values. We may disclose evidence of review fraud to the FTC, a state attorney general, or another platform whose terms were breached.
6.4 Business transfers
If the Service is sold or merged, personal data transfers with it under this policy, and we will notify account holders before the transfer takes effect.
We never sell personal data, never share it for cross-context behavioral advertising, and never give it to data brokers. No opt-out is needed because there is nothing to opt out of; we say so to be clear.
7. Your rights
Whoever you are and wherever you live, you can email privacy@roovello.com to:
- Know what personal data we hold about you and get a copy in a portable format.
- Correct it. Reviewers edit their own reviews and name from their account; business members edit their profile from the dashboard.
- Delete it. We close the account and delete personal data as described in section 5, subject to the records we must keep. Public reviews are withdrawn if you ask.
- Object to or restrict processing based on legitimate interest, including the trust classifier, and we will explain the outcome.
- Withdraw consent where processing relies on it, without affecting what was done before.
- Appeal our decision by replying to it; a different person will review it.
We answer within 30 days (45 where state law allows an extension, which we will tell you about). We verify requests by sending a link to the account email. You may use an authorized agent; we will ask the agent for proof of authority. We never discriminate for exercising a right. Residents of California, Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Delaware, New Jersey and other U.S. states with privacy laws, and residents of the EEA, UK and Switzerland, have these rights by law; everyone else has them by this policy. EEA and UK residents may also complain to their supervisory authority. In the last twelve months we have not sold or shared personal information as those terms are defined by California law.
If a business gave us your email as a request recipient and you want it removed: use the unsubscribe link in any request email (that suppresses you platform-wide), or email us and we will remove you from that business's list and suppress you.
9. Children
The Service is for people 18 and older. We do not knowingly collect personal information from anyone under 13, and we delete any account we learn belongs to a child under 18. If you believe a child has an account, email privacy@roovello.com.
10. Security
Data is encrypted in transit (TLS) and at rest by our hosting and database providers. Access to production data is limited to the people who operate the Service and is logged. Sign-in uses one-time links that expire in 15 minutes; there are no passwords to steal. Every change made through the business dashboard, moderation and billing is written to an audit log. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the authorities as the law requires, without unreasonable delay.
11. International transfers
We operate from the United States and our providers store data there. If you use the Service from outside the United States, your data is transferred to and processed in the United States. For EEA, UK and Swiss data we rely on the Standard Contractual Clauses in our providers' data processing terms, or on an adequacy decision where one applies.
12. Changes and contact
We will post changes here with a new effective date and, for material changes, email account holders at least 14 days before they take effect. Questions, requests and complaints: privacy@roovello.com. Mail that reaches mail.roovello.com addresses other than the request address is not read. Our Terms of Service are at /terms.