1. Who We Are
Review Pilot is operated by ReviewPlane Ltd., registered in Bulgaria (Plovdiv, Tsar Boris III Obedinitel Blvd 36). For privacy matters, contact us at privacy@reviewpilot.com.
2. Data We Collect
We collect the following categories of personal data:
- Account data - name, email address, company name, and password (stored as a hash).
- Billing data - billing address and payment method details (processed by our payment provider; we do not store full card numbers).
- Review & platform data - review content, reviewer names, and ratings synced from connected platforms (Google).
- Usage data - pages visited, features used, browser type, IP address, and session timestamps.
- Communications - emails, support tickets, and contact form submissions you send us.
3. How We Use Your Data
We use your data to:
- Provide, operate, and improve the Service.
- Generate AI-assisted review responses on your behalf.
- Process billing and send invoices.
- Send transactional emails (receipts, alerts, product updates).
- Respond to support requests.
- Detect and prevent fraud or abuse.
We do not sell your personal data to third parties, and we do not use it for advertising profiling.
4. Legal Basis (GDPR)
We process your personal data on the following legal bases:
- Contract performance - processing necessary to deliver the Service you subscribed to.
- Legitimate interests - security monitoring, fraud prevention, and product analytics.
- Legal obligation - retaining billing records as required by Bulgarian and EU law.
- Consent - where we ask for your explicit agreement (e.g. marketing emails).
5. Data Storage and Security
All data is stored on Hetzner Cloud servers located in Frankfurt and Helsinki - within the European Union. We use encryption at rest and in transit (TLS 1.2+), access controls, and regular security reviews to protect your data.
6. Data Retention
We retain your account data for as long as your account is active. After account deletion or contract termination, data is deleted within 90 days, except where longer retention is required by law (e.g. billing records - 5 years under Bulgarian accounting law).
7. Third-Party Services
We share data with a limited set of sub-processors to operate the Service:
- Hetzner Cloud - infrastructure hosting (EU).
- Stripe - payment processing.
- Postmark / AWS SES - transactional email delivery.
- OpenAI - AI response generation (review text is sent to generate responses; OpenAI does not use this data to train models under our API agreement).
All sub-processors are contractually bound to process data only as instructed and in compliance with GDPR.
8. Cookies
We use strictly necessary cookies for session management and authentication. We do not use third-party advertising or tracking cookies. You can disable cookies in your browser settings, though this may affect Service functionality.
9. Your Rights
Under GDPR, you have the right to:
- Access - request a copy of the personal data we hold about you.
- Rectification - ask us to correct inaccurate data.
- Erasure - request deletion of your data ("right to be forgotten").
- Portability - receive your data in a structured, machine-readable format.
- Restriction - ask us to restrict processing in certain circumstances.
- Objection - object to processing based on legitimate interests.
- Withdraw consent - where processing is based on consent, withdraw it at any time.
To exercise any of these rights, email privacy@reviewpilot.com. We will respond within 30 days. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (cpdp.bg).
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you by email or via an in-app banner at least 14 days before material changes take effect.
11. Contact
For privacy-related questions or requests, contact us at privacy@reviewpilot.com or write to ReviewPlane Ltd., Tsar Boris III Obedinitel Blvd 36, Plovdiv, Bulgaria.