Privacy Policy

RIFFReviews is a Google review management service run by Headbanger Marketing (“we”, “us”). This policy explains what personal information the service handles, why, who we share it with, and the choices you have. It applies to riffreviews.com, the RIFFReviews dashboard, the review widget, and the text messages and emails the service sends.

Who is responsible for your information

RIFFReviews handles two kinds of personal information, and the responsibility differs for each.

• Our clients’ account information. When a business uses RIFFReviews, we are responsible for the information about that business and the people who sign in for it.
• Our clients’ customers. When a business uses RIFFReviews to reply to its Google reviews or to text its customers, the business decides whose information goes into the service and is responsible for having the right to use it. We process that information on the business’s behalf, only to provide the service to it.

If you are a customer of a business that uses RIFFReviews, the best first contact for privacy questions is that business. You can also contact us and we will pass your request on.

What we collect

Account information

• Name, email address and role of each person who signs in.
• A securely hashed password. We never store passwords in readable form.
• A record of important account actions, such as sign-ins, setting changes and approvals.

Business information

• The business name, its locations and their Google Business Profile details.
• Brand voice guidance, reply examples, message templates and other settings the business enters.
• Billing and subscription status, if the business pays through the service.

Google reviews

When a business connects its Google Business Profile, we read its locations and reviews through Google’s official API. A review includes what Google shows publicly: the reviewer’s display name, star rating, review text, date, and any reply. We also store the replies we draft and post.

Customer contact information

To send review requests, a business may add its customers by hand, by file upload, or by connecting its Square account. For each customer we may store:

• Name, mobile phone number and email address.
• Whether the customer agreed to receive messages, and when and how that consent was given or withdrawn.
• The review requests sent, their delivery status, and replies such as STOP or HELP.
• If Square is connected, the customer, payment, order and appointment details needed to know who visited and when.

Technical information

• IP addresses, used to limit abuse and keep accounts secure.
• Error reports when something breaks. These are set up not to include personal details by default.
• The cookies described below.

How we use it

• To run the service: show reviews in the dashboard, draft replies, and post them to Google.
• To send review requests by text message, only to customers whose consent the business has recorded, and to stop messaging anyone who opts out.
• To send account emails, such as password resets and reply approval links.
• To keep the service secure, prevent misuse, and fix problems.
• To meet our legal obligations.

We do not sell personal information, use it for advertising, or share it with anyone outside the list below. Every customer receives the same neutral review request and the same public Google link. We do not filter or steer customers based on whether they seem happy.

AI-drafted replies

RIFFReviews uses Anthropic’s Claude AI to draft review replies in the business’s voice. To write a draft we send Anthropic the review’s rating and text, the reviewer’s first name, and the business’s name and brand voice settings. Under Anthropic’s commercial terms, this data is not used to train its models. The business chooses which replies post automatically and which wait for a person to approve them.

Google user data

RIFFReviews’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Business Profile access only to read the connected business’s locations and reviews and to post, update or remove its replies. We do not use Google data for advertising, do not sell it, and do not let people read it except where the business asks us to help, for security, or where the law requires. A business can disconnect Google at any time, and can also remove our access from its Google account settings.

Service providers we share it with

We use these companies to run RIFFReviews. Each gets only what it needs to do its job.

• Vercel hosts the website and the app.
• Neon hosts the database.
• Google provides reviews and receives the replies we post.
• Anthropic drafts review replies.
• Twilio sends and receives text messages.
• Resend sends account emails.
• Sentry records errors so we can fix them.
• Square, only for businesses that connect it.
• Stripe, only for businesses that pay through the service.

Some of these providers store or process information outside Canada, mainly in the United States. When that happens the information is protected by our agreements with them but may be accessible to authorities under the laws of that country. We may also disclose information when the law requires it, or to a buyer if the business is sold, under the same protections.

Cookies

We use only the cookies the service needs to work: one that keeps you signed in, and a short-lived one that protects the Google connection step. We do not use advertising or tracking cookies. The review widget does not set cookies on the websites that show it.

Text messages and opting out

Review requests are sent only to customers who agreed to hear from the business, as Canada’s Anti-Spam Legislation (CASL) requires. Reply STOP or ARRET to any message to stop receiving them, or HELP or AIDE for help. We keep a record of opt-outs so we can keep honouring them.

How long we keep it

We keep information while the business uses RIFFReviews. When a business stops using the service, or asks us to, we delete or anonymize its information within 90 days, except where we must keep it longer by law. We keep consent and opt-out records for as long as needed to prove consent and to avoid messaging someone who said no. Database backups are overwritten on a rolling basis.

How we protect it

• All traffic to riffreviews.com is encrypted with HTTPS.
• Google and Square connection tokens are encrypted before they are stored.
• Passwords are hashed, and sign-in attempts are rate-limited.
• Each business can see only its own data, and access to production systems is limited to the people who need it.

No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify the affected businesses and people, and the regulator, as the law requires.

Your rights

You can ask to see the personal information we hold about you, ask us to correct it, or withdraw your consent to its use. Some laws, including Quebec’s, also let you ask us to delete it or to receive it in a portable format. We will answer within 30 days. If you are a customer of one of our clients, we may involve that business in your request.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.

Children

RIFFReviews is a business tool and is not meant for children. We do not knowingly collect information from anyone under 16 except as a business’s customer record.

Changes to this policy

We will update this page when our practices change and change the date at the top. If a change is significant, we will tell our clients before it takes effect.

Contact us

Our privacy officer at Headbanger Marketing handles privacy questions and requests. Reach us through our contact page. See also our Terms of Service.