1. Overview

ReviewLoft is operated by Media Yard LLC (New Jersey, USA). We built ReviewLoft to be minimal by design: we collect what the product needs to work — your business details, anonymous rating tallies, and the private feedback customers choose to leave — and nothing else. We do not sell personal data, we do not run advertising trackers, and we do not use your data to train AI models.

2. Data we collect

• Account data: your email address (used for magic-link sign-in).
• Business data: the business name and Google review link you provide.
• Rating tallies: when a customer visits your rating page, taps a star, or continues to Google, we count the event. These tallies are anonymous — no cookies, no visitor identifiers.
• Private feedback: the star rating, message, and — only if the customer chooses to provide them — their name and contact details. This is delivered to the business owner and never published.
• Technical logs: standard server logs (IP address, timestamps, requested pages) kept briefly for security and debugging.

Cookies: we set one essential cookie — the business owner’s sign-in session. Customers using a rating page get no cookies at all. No analytics cookies, no ad cookies, no cross-site tracking.

3. How we use data

• To provide the Service: hosting rating pages, tallying the funnel, delivering private feedback to the business owner.
• To send transactional email: magic sign-in links and feedback notifications. No marketing email without your explicit opt-in.
• To keep the Service secure and diagnose problems.

4. If you left feedback for a business

If you used a business’s rating page, the business you rated controls the feedback you sent — we process it on their behalf and deliver it only to them. Choosing to write a Google review happens on Google, under Google’s own terms and privacy policy — we only link you there. To correct or delete feedback you sent, contact that business, or email us at legal@getreviewloft.com and we will assist.

5. Service providers (subprocessors)

We share data only with the infrastructure providers needed to run ReviewLoft:

• Netlify — application hosting and delivery
• Neon — database hosting (Postgres, US region)
• Resend — transactional email delivery

Each provider processes data under its own security and privacy commitments. We never share your data with advertisers or data brokers.

6. Retention

Account data and feedback are kept while your account is active. Deleting a business permanently deletes its feedback. If you close your account, we delete your data within 30 days, except minimal records we must keep for legal or accounting reasons. Server logs rotate on a short schedule.

7. Your rights

Depending on where you live (including the EU/EEA, UK, and California), you may have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. Email legal@getreviewloft.com and we will respond within 30 days. We do not discriminate against you for exercising these rights.

8. Security

Data is encrypted in transit (TLS) and at rest by our database provider. Sign-in uses single-use, expiring magic links — no passwords to leak. Access to production systems is limited to the operator of the Service.

9. International transfers

Our infrastructure is hosted in the United States. If you use ReviewLoft from outside the US, your data will be processed in the US under the safeguards described in this policy.

10. Children

ReviewLoft is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.

11. Changes

If we materially change this policy, we will notify account holders by email or in the dashboard before the change takes effect.

12. Contact

Media Yard LLC · legal@getreviewloft.com