1. Overview

ReviewLoft is operated by Media Yard LLC (New Jersey, USA). We built ReviewLoft to be minimal by design: we collect what the product needs to work — your business details, anonymous rating tallies, and the private feedback customers choose to leave — plus the business contact details we use to tell businesses about ReviewLoft (section 2). We do not sell personal data, we do not run advertising trackers, and we do not use your data to train AI models.

2. Data we collect

• Account data: your email address (used for magic-link sign-in).
• Business data: the business name and Google review link you provide — and, if you enable AI visibility checks, the business category and service area you enter.
• Rating tallies: when a customer visits your rating page, taps a star, or continues to Google, we count the event. These tallies are anonymous — no cookies, no visitor identifiers.
• Private feedback: the star rating, message, and — only if the customer chooses to provide them — their name and contact details. This is delivered to the business owner and never published.
• Free AI visibility checker: if you use the public checker at /ai-check without an account, we store the business name, category, and location you type, whether the answer mentioned you, and a one-way hash of your IP address. The hash exists only to enforce the free daily limit — we cannot read an IP address back out of it. These rows are deleted after 7 days.
• Support chat: if you open the chat in the corner of our marketing pages, the messages you type are sent to our support assistant, run for us by Support Proof (see section 6), so it can answer. Transcripts are kept so we can review answers and follow up, and we delete them on request. The chat stores nothing in your browser and does not appear on rating pages.
• Businesses we contact about ReviewLoft: to reach local businesses that aren’t customers yet, we use business contact details — a business name, its owner or manager’s name and work email, city, and industry — obtained from Apollo.io and from public business listings. We use them only to send a small number of emails about ReviewLoft. If you reply asking us to stop, or email legal@getreviewloft.com, we stop and delete your details, keeping only what we need to make sure we don’t contact you again.
• Technical logs: standard server logs (IP address, timestamps, requested pages) held by our hosting provider for security and debugging, on that provider’s own short rotation. We do not build our own log archive from them.

Cookies: we set one essential cookie — the business owner’s sign-in session. Customers using a rating page get no cookies at all. No analytics cookies, no ad cookies, no cross-site tracking.

3. How we use data

• To provide the Service: hosting rating pages, tallying the funnel, delivering private feedback to the business owner.
• To send transactional email: magic sign-in links and feedback notifications. We don’t send account holders marketing email without their explicit opt-in.
• To tell businesses that aren’t customers yet about ReviewLoft, using the business contact details described in section 2.
• To keep the Service secure and diagnose problems.

4. AI visibility checks

If you run the optional “Does AI recommend you?” check, we send one question to a third-party AI provider (currently Anthropic) built from the business category and service area you provided — for example, “What are the best dentists in Princeton, NJ?”. No customer data, feedback, or account data is ever included. The AI’s response is stored so you can see it in your dashboard. Anthropic processes API requests under its own terms and does not use them to train its models by default. Our full explanation is in the AI disclosure.

The same check is also offered publicly, with no account, at /ai-check. There we send Anthropic the business name, category, and location the visitor types, and nothing else. What we keep from a public check is described in section 2 and deleted after 7 days.

5. If you left feedback for a business

If you used a business’s rating page, the business you rated controls the feedback you sent — we process it on their behalf and deliver it only to them. Choosing to write a Google review happens on Google, under Google’s own terms and privacy policy — we only link you there. To correct or delete feedback you sent, contact that business, or email us at legal@getreviewloft.com and we will assist.

6. Service providers (subprocessors)

We share data only with the infrastructure providers needed to run ReviewLoft:

• Netlify — application hosting and delivery
• Neon — database hosting (Postgres, US region)
• Resend — transactional email delivery
• Stripe — subscription billing and payment processing
• Anthropic — AI responses for the optional “Does AI recommend you?” check
• Apollo.io — business contact data, and sending emails to businesses that aren’t customers yet
• Support Proof (also operated by Media Yard LLC) — the support chat on our marketing pages. It relies on xAI (generating answers), OpenAI (searching our help articles), Supabase (storing transcripts, US region), and Cloudflare (running the service)

Each provider processes data under its own security and privacy commitments. We never share your data with advertisers or data brokers.

7. Retention

Account data and feedback are kept while your account is active. Deleting a business in your dashboard permanently deletes that business, its feedback, and its stored AI checks immediately.

To close your account entirely, email legal@getreviewloft.com from your account address. We delete your account and its remaining data within 30 days. Two things survive that deletion, and we would rather name them than imply otherwise: billing records and the raw payment-provider webhook payloads behind them, which we keep for accounting and tax purposes, and anonymous product counters that carry no name, email, or feedback content. Free-checker rows are deleted after 7 days regardless.

8. Your rights

Depending on where you live (including the EU/EEA, UK, and California), you may have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. Email legal@getreviewloft.com and we will respond within 30 days. We do not discriminate against you for exercising these rights.

9. Security

Data is encrypted in transit (TLS) and at rest by our database provider. Sign-in uses single-use, expiring magic links — no passwords to leak. Access to production systems is limited to the operator of the Service.

10. International transfers

Our infrastructure is hosted in the United States. If you use ReviewLoft from outside the US, your data will be processed in the US under the safeguards described in this policy. Support chat traffic is received by Cloudflare at the data centre nearest you, which may be outside the US, before it reaches the service in the US.

11. Children

The ReviewLoft dashboard is a business tool: you must be 18 or older to hold an account, and it is not directed at children. Rating pages are a different matter — they are shown to a business’s walk-in customers, who may be of any age. A rating page sets no cookies and asks for no identifying information; a name or contact detail is supplied only if the customer chooses to type one. We do not knowingly collect personal data from children, and if you believe a child has sent feedback through a rating page, email legal@getreviewloft.com and we will delete it.

12. Changes

If we materially change this policy, we will notify account holders by email or in the dashboard before the change takes effect.

13. Contact

Media Yard LLC · PO Box 73, Pennsauken, NJ 08110 · legal@getreviewloft.com