Privacy Notice

01 Who we are

Review Station is operated by NAPHERE LTD, a company registered in England and Wales under company number 17440245, with its registered office at Office 3271UP, 182–184 High Street North, East Ham, London E6 2JA, United Kingdom. NAPHERE LTD is the data controller for the personal data described in this notice.

For anything in this notice, write to us at hello@getreviewstation.com.

02 What Review Station does

Review Station connects to your Google Business Profile, follows the reviews your customers leave, and tells you when a problem starts repeating — where it is happening and whether it is getting worse or improving. It also prepares suggested replies that you review and send yourself.

03 What we collect

Your account

• Your Google account identifier, and the email address and name Google returns when you sign in.
• Your display preferences: interface language and time zone.
• Your organisation and the branches you monitor, including any internal branch labels you choose.

Data from your Google Business Profile

• The locations and accounts we discover for you during setup.
• Reviews: review text, star rating, the reviewer display name as Google provides it, the review and reply timestamps, and the Google resource identifiers needed to fetch and reply to them.
• Replies you publish through Review Station.

Data we derive

• Topic observations, issues and issue transitions produced by our analysis.
• Weekly report snapshots, which hold counts and internal topic identifiers.

Operational records

• Notification delivery jobs, provider events and delivery receipts.
• An email suppression list, so we stop writing to an address that bounced or complained.
• Records of processed Google notifications, used to avoid handling the same event twice.

04 Cookies

Review Station sets four cookies. We set no advertising cookies and no third-party analytics cookies.

• rs_session — keeps you signed in. It is httpOnly, so scripts in your browser cannot read it, and it lasts up to 30 days.
• rs_locale — remembers the interface language you chose in Settings, for up to one year. It works before you sign in, so a language you pick is not lost afterwards.
• rs_site_locale — set only if you pick a language from the menu at the top of the public pages (home, privacy and terms). It remembers that choice for up to one year; without it, those pages follow your browser’s language.
• rs_oauth_nonce — ties a Google sign-in response to the browser that started it, as protection against cross-site request forgery. It lasts 15 minutes.

05 What we ask Google for

We request a single Google authorisation scope — https://www.googleapis.com/auth/business.manage — which is what lets us read your reviews and publish the replies you approve. We also receive your basic identity from Google when you sign in, so we know which account you are.

We do not request access to your Gmail, your Drive, your contacts, or any other Google service.

06 How we use Google user data

We use data from your Google Business Profile only to provide Review Station to you: to show you your reviews, to find recurring problems, to alert you, to prepare the weekly report, and to publish replies that you approve.

• We do not sell Google user data.
• We do not use Google user data for advertising, and we do not share it with advertising networks or data brokers.
• We do not use Google user data to train our own models.
• We do not use it to build profiles of the people who wrote your reviews.

07 Artificial intelligence, and what is sent outside

Understanding review text and drafting suggested replies uses an external AI provider (OpenAI). This is gated by two separate permissions you give us, and both must be granted before any review text leaves our systems: one to analyse reviews at all, and one to allow that external processing. If either is missing, the analysis step stops before any external call is made.

What we send is deliberately minimal. The request carries the review text, the star rating, an optional language hint, and our own catalogue of topic identifiers. It does not carry the reviewer name, any Google resource identifier, your business or branch name or address, your email, or any access token — the request format has no fields for them, so they cannot be included by accident.

The AI only interprets text. Decisions about what deserves your attention are made afterwards by our own deterministic code, and every AI result is validated against a strict schema before it is used.

If you withdraw the analysis permission, we stop analysing, delete what we derived from your reviews — issues, observations and analysis results — and clear the written summary from your weekly reports. That deletion cannot be undone.

08 Suggested replies are never sent automatically

Review Station never publishes a reply on its own. A suggested reply is a draft: you read it, edit it if you want, and it is published to Google only when you press send.

09 Alerts and the weekly report

Alerts and the weekly report can reach you by email and, if you turn it on and confirm your consent, by WhatsApp.

These messages carry derived information only: an internal topic identifier, the branch label you chose yourself, a status word, and counts. Raw review text, reviewer names, Google resource identifiers and Google-supplied branch names are never included — the message format has no fields for them. WhatsApp messages use pre-approved templates, never free text.

10 How long we keep things

Anything that comes from Google is capped at 30 days. That cap is enforced in the code itself, so no configuration can raise it.

• Cached review content: 14 days by default, and never more than 30.
• Discovered locations and accounts: 14 days by default, and never more than 30.
• Records of processed Google notifications: up to 30 days.
• Weekly report snapshots: up to 35 days.
• Notification delivery jobs, provider events, delivery receipts and the email suppression list: 90 days, then deleted automatically. These hold operational data, not review content.
• Your sign-in session: up to 30 days. A pending Google sign-in request expires after 10 minutes.

Your account, your organisation, your branches and your record of permissions are kept while your account exists, because they are what the service is built on.

11 Disconnecting Google

You can disconnect Google at any time from Settings. We ask Google to revoke our access, and in the same operation we delete:

• the cached review content,
• the pending analysis work,
• the analysis results and the topic observations derived from them,
• the issues and their history,
• and the Google notifications we had not yet processed.

We deliberately keep a few things: your user account and its Google sign-in identity, because signing in is separate from connecting a business profile; your record of the permissions you granted and withdrew, as an audit trail; and your organisation and branches, which are your own data. Your branch links are marked unverified rather than deleted, so reconnecting does not create duplicates.

One consequence is worth stating plainly: reconnecting starts from an empty analysis memory. The age of an issue, the highest severity it reached, and the counters behind it are gone, so a complaint that was already known may be detected as new again.

12 Where your data is processed

We use a small number of processors to run the service: Google (your business profile and sign-in), OpenAI (review understanding and reply drafting, subject to the permissions above), Resend (email delivery), and Meta (WhatsApp delivery, if you enable it), together with our hosting provider. Some of these process data outside the United Kingdom; where they do, the transfer relies on the safeguards those providers offer for international transfers.

13 How we protect it

• Google access and refresh tokens are encrypted before they are stored, and are never shown in the interface or written to logs.
• Your session cookie is httpOnly, and what we store in the database is a hash of the session token, not the token itself.
• The site is served with HTTP Strict Transport Security, is not allowed to be embedded in a frame, and restricts what is sent in the Referer header — the Google sign-in return path carries sensitive values in the URL.
• Notification destinations — your email address or phone number — are kept out of our structured logs.

14 Your rights

Under UK data protection law you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to how we use it, to receive it in a portable form, and to withdraw a consent you have given. Withdrawing consent does not affect processing that already happened.

Two of these you can exercise yourself at any time, immediately: disconnecting Google, and withdrawing the analysis permission — which also deletes what we derived from your reviews.

For anything else, including deleting your account entirely, write to hello@getreviewstation.com. Review Station does not currently offer a self-service account-deletion button, so we handle those requests by email; we will confirm when it is done.

If you think we have handled your data badly, you can complain to the Information Commissioner’s Office (ico.org.uk). We would rather you told us first, so we can put it right.

15 Children

Review Station is a tool for businesses. It is not directed at children, and we do not knowingly collect data from them.

16 Changes to this notice

If we change how we handle your data, we will update this page and change the date at the top. If the change is significant, we will tell you directly rather than rely on you noticing.