Privacy Policy

1. Who this applies to

This policy covers the Amazon sellers who create a ReviewLoop account ("you"). ReviewLoop does not collect or store any personal data about your customers — see section 3.

2. What we collect about you

• Account details — your email address and a securely hashed password (we never store your password itself, only a one-way bcrypt hash of it).
• Amazon credentials — your SP-API Client ID, Client Secret, and refresh token, encrypted with AES-256 the moment you save them. The encryption key is stored separately from the database, so the credentials aren't readable even if the database were compromised.
• Sending preferences — your chosen marketplaces, how many days after an order to wait, and whether you want a weekly email report.
• Run history — a daily count of orders checked, and how many review requests were sent, skipped, or failed, used to power your dashboard.
• Billing information — handled directly by Stripe; we store a Stripe customer reference, not your card details.

3. What we deliberately don't collect

We don't store your customers' names, email addresses, or any other personal data. Order identifiers are used transiently, in memory, for the length of a single daily run, to ask Amazon's own API whether a review request can be sent — they are not written to our database.

4. Who we share it with

• Amazon (Selling Partner API) — to fetch your recent orders and send review requests on your behalf, using your own encrypted credentials.
• Stripe — to process billing. Stripe receives your usage counts and billing contact details; we never see or store your card details ourselves.
• Resend — to send transactional email (weekly reports, connection alerts, and password resets) to the address on your account.

We don't sell your data, and we don't share it with anyone for advertising or marketing purposes.

5. How we protect it

Amazon credentials are encrypted at rest (AES-256 via Fernet) with the key held separately from the data it protects. Passwords are hashed with bcrypt and never stored in plain text. All traffic to and from the app is encrypted in transit (HTTPS).

6. How long we keep it

We keep your data for as long as your account is active. If you close your account, we'll delete your stored data — including your encrypted Amazon credentials — within a reasonable period, except where billing records must be kept for legal or accounting reasons.

7. Your rights

You can ask us at any time for a copy of the data we hold about you, ask us to correct it, or ask us to delete it. To do so, contact us at [email protected]. If you're not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO).

8. Cookies and tracking

ReviewLoop doesn't use tracking or advertising cookies. Your session is kept in your browser's local storage as a signed token, not a cookie, and is only used to keep you signed in.

9. Changes to this policy

If we make a material change to how we handle your data, we'll email the address on your account before it takes effect.

10. Contact

Questions about this policy can be sent to [email protected].