1. Scope & parties

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Media Yard LLC (New Jersey, USA — “we”, the processor) and you, the business customer using ReviewLoft (the controller). It applies whenever your use of the Service involves personal data of your own customers — most notably the private feedback they leave through your rating page. No separate signature is required: this DPA is automatically effective for all business customers.

2. What we process, and for whom

• Data subjects: your customers who use your rating page.
• Categories of data: star rating, feedback message, and — only when the customer chooses to provide them — their name and contact details.
• Nature and purpose: hosting your rating page, receiving the feedback, storing it, and delivering it to you by dashboard and email. Nothing else.
• Duration: for as long as you keep the business in your account, plus the deletion window in section 7.
• What must not be sent: a rating page is a free-text box, so you decide what your customers are invited to put in it. Do not use ReviewLoft to collect special category data under GDPR Article 9 (health, biometrics, race, religion, sexual life, political or trade-union affiliation), government identifiers, payment card numbers, or protected health information. We are not a HIPAA business associate and will not sign a BAA. If your customers routinely disclose that kind of detail, ReviewLoft is the wrong place to receive it.

3. Our commitments as processor

• We process your customers’ personal data only on your documented instructions — which, for ReviewLoft, means only as needed to provide the Service as described in the Terms. We never use it for advertising, profiling, resale, or training AI models.
• Everyone with access to production data (currently, only the operator of the Service) is bound to confidentiality.
• We apply the security measures in section 5 and will not weaken them during your subscription.
• We will assist you, to the extent reasonably possible, in responding to data-subject requests (access, correction, deletion, export) and in meeting your own security and impact-assessment obligations.
• If we become aware of a personal-data breach affecting your customers’ data, we will notify you without undue delay, and in any event within 72 hours of becoming aware, at your account email — with what we know about its nature and scope at that point, followed by updates as we learn more. We will not sit on a partial picture waiting for a complete one.

4. Subprocessors

These three, and only these three, ever touch your customers’ personal data. You authorize them:

• Netlify, Inc. (US) — application hosting and delivery, including rating pages
• Neon, Inc. (US) — Postgres database holding businesses and private feedback
• Resend, Inc. (US) — transactional email that delivers feedback alerts to you

Two other providers are part of the Service but are not subprocessors of your customers’ data, and we would rather be precise about the difference: Stripe, Inc. processes your own payment data as its own controller, and Anthropic, PBC receives only the business category and service area you type for the optional AI check — never customer feedback (see the AI disclosure). Google is not a subprocessor: the customer leaves our page to post a review under Google’s own terms.

Each subprocessor is bound by data-protection obligations consistent with this DPA. If we add or replace a subprocessor that will process your customers’ personal data, we will update this page and notify account holders by email at least 30 days in advance, and you may object on reasonable data-protection grounds (and terminate if we can’t resolve the objection). We stay responsible to you for what these providers do with your customers’ data.

5. Security measures

• Encryption in transit (TLS) for all connections, and encryption at rest by our database provider.
• Passwordless authentication with single-use, expiring sign-in links — no password database to breach.
• Feedback is only ever displayed to the authenticated owner of the business it was left for; it has no public URL.
• Production access limited to the operator of the Service; infrastructure credentials stored in the hosting providers’ secret managers, not in code.
• Minimal collection by design: rating pages set no cookies and store no visitor identifiers, which keeps the personal data we hold for you as small as possible.

6. International transfers

All processing under this DPA takes place in the United States, and ReviewLoft is sold to business customers in the United States. We are not certified under the EU–US Data Privacy Framework.

If you are established in the EEA, the UK, or Switzerland, or your customers are, then a transfer to us needs a Chapter V mechanism, and this DPA on its own is not one. We will sign the 2021 EU Standard Contractual Clauses (Module Two, controller to processor) with the UK Addendum or Swiss equivalent as applicable — email legal@getreviewloft.com from your account address and we will execute them with you before you send us any such data. We would rather tell you the paperwork is pending than let you assume it is already in place.

7. Deletion & return

Deleting a business in your dashboard permanently deletes its feedback immediately. When your account closes, we delete your customers’ personal data within 30 days, except minimal records we are legally required to keep. Before closure — or within 30 days after — you can request an export of your feedback records at legal@getreviewloft.com.

8. Audits & information

We will make available the information reasonably necessary to demonstrate compliance with this DPA. Written requests to legal@getreviewloft.com are answered within 30 days; this page, the Privacy Policy, and the AI disclosure together describe our processing in full.

9. California

Where the CCPA/CPRA applies, we act as your service provider. We do not sell your customers’ personal information, do not share it for cross-context behavioral advertising, and do not retain, use, or disclose it for any purpose other than performing the Service for you — including that we do not combine it with information from other sources except as those laws permit. We will tell you if we determine we can no longer meet these obligations.

10. Precedence & contact

If this DPA conflicts with the Terms on a data-protection matter, this DPA controls. Questions: Media Yard LLC · PO Box 73, Pennsauken, NJ 08110 · legal@getreviewloft.com.