Privacy Policy

Who is who

A business that signs up (the "account owner") decides which of its customers to contact and what to send. For its customers' data we act on the business's behalf. For account data we decide how it is used.

If you got a text or email from a business through OneTouchReview, that business has your details. You can ask the business, or us, to stop messages or delete your data.

What we hold

• Account data: the names, emails, phone numbers and passwords (stored hashed) of the people who use the app, and the business's name, address, locations and settings.
• Customer data that a business adds: its customers' names, phone numbers and emails, and notes it adds.
• Consent records: when and how each customer agreed to get texts, and opt-outs (STOP replies, email unsubscribes, bounces and complaints).
• Messages: the content of the texts and emails sent through OneTouchReview, their delivery status, and replies such as STOP, START and HELP.
• Review page activity: whether a link was opened, the rating or private feedback a customer leaves, and which review site they chose.
• Card pages: messages and contact details that visitors send to a business through its card page.
• Google Business Profile data, when a business connects it: the profile's name and locations, its Google reviews (reviewer name, rating, text, date) and the replies to them.
• Facebook data, when a business connects a Facebook Page: the Page name and ID, the Page's reviews and recommendations (reviewer name, recommends or not, text, date), and the replies we post for the business. We store the Page access tokens Facebook gives us encrypted, and use them only to read those reviews and post the business's replies.
• Basic technical data: IP address, browser type and error reports, used to keep the service working and secure.
• Website visits: on onetouchreview.com we keep a first-party cookie with how you found us (for example the ad, link or site you came from), and, with your consent, ad cookies set by Meta, Google, LinkedIn, X and TikTok (see "Cookies and ads on our website" below).

If we add posting to Instagram later, we will only post what the account owner chooses to post.

Why we use it

• Account data: to run the account, sign people in, send service emails and give support.
• Customer data, consent records and messages: to send the review requests and follow-ups the business sets up, to respect opt-outs and quiet hours, and to show the business who opened a link.
• Review page activity and card pages: to show the business its feedback, messages and stats.
• Google and Facebook data: to show the business its reviews in one place, alert it to new ones, and post the replies it writes or approves.
• Technical data: to find and fix errors and stop abuse.

We do not sell personal information. We never use a business's customer data, review pages, card pages or anything inside the app for advertising. The only advertising use is on our own website and sign-up, described in "Cookies and ads on our website".

Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Data from Facebook is used only for the purposes above and is shown only to the business that connected the Page.

Who processes it for us

We use these service providers. Each gets only what it needs for its job.

• Hosting: the servers that run the app and store the database.
• Twilio: sends and receives text messages.
• Amazon Web Services (Amazon SES): sends email and reports bounces and complaints.
• OpenAI: writes suggested replies to reviews. It receives the review text and the business name, and only when someone asks for a suggestion.
• Sentry: error reports, so we can fix bugs.
• Stripe: will process payments once billing starts. We will not store full card numbers.
• Google and Meta (Facebook): we read and post through their official APIs when a business connects its accounts.
• Meta, Google, LinkedIn, X and TikTok: ad measurement on our website and sign-up, only with consent (see "Cookies and ads on our website").

If an account owner connects an AI assistant (such as Claude or ChatGPT) to their account, that assistant can read the account's data the owner allows, under the assistant provider's own terms. The owner can remove that access at any time.

We may share data if the law requires it, or to protect people or the service from fraud or abuse.

Cookies and ads on our website

On onetouchreview.com and on the app's sign-up, login and payment-success pages we can use ad tags from these companies, to see which of our ads bring sign-ups and to show our ads to people likely to need us:

• Meta (Facebook and Instagram): Meta Pixel and Conversions API.
• Google: Google Analytics (GA4) and Google Ads.
• LinkedIn: LinkedIn Insight Tag and Conversions API.
• X (Twitter): X Pixel.
• TikTok: TikTok Pixel and Events API.

What they get: the pages you visit on our website, your browser and device, your IP address, their own cookie or click identifiers (for example an ad click id from the link you followed), and, when you sign up or start paying, that event and its value. When a new account signs up with ads consent, we also send these companies the account email and phone number hashed (scrambled with SHA-256, not readable as text) so they can match the sign-up to their ad. They act under their own privacy policies.

No ad tags run on the review pages and card pages we host for businesses, or inside the logged-in app, and a business's customer data is never sent to them.

Your choice: visitors in the United States get these tags unless they opt out; everywhere else, a banner asks first and nothing loads until you choose Accept. If your browser sends Global Privacy Control, the tags stay off. You can change your choice at any time with "Cookie settings" or "Do not sell or share my information" at the bottom of every page on our website. An account owner can also turn ads tracking off in the app's settings.

You can also limit ads through each company: Meta ad preferences, Google My Ad Center, LinkedIn advertising settings, and the ad settings described in the X privacy policy and the TikTok privacy policy. The industry opt-out page optout.aboutads.info covers many ad companies at once.

Our own source cookie (how you found us) is first-party measurement and stays either way; it is not shared with these companies.

How long we keep it

• Account and customer data: while the account is open. When an account is deleted, its business data is deleted.
• Facebook data: until the business disconnects Facebook or removes the OneTouchReview app in its Facebook settings. Then we delete the tokens and remove the Facebook reviews.
• Google data: until the business disconnects Google or deletes its account. Then we delete the tokens and remove the Google reviews.
• Opt-out records: kept as long as the account is open, so we never text someone who said STOP.
• Backups: deleted data can stay in backups until those backups are replaced.

Security

Data travels over HTTPS. Passwords are stored hashed, and Facebook and Google access tokens are stored encrypted. Only the people a business adds to its account can see its data, and our staff access it only to run and support the service. No system is perfectly secure; if we learn of a breach that affects you, we will tell you as the law requires.

Your choices and rights

• Texts: reply STOP to any text to stop texts from that business. Reply HELP for help.
• Email: use the unsubscribe link in any email.
• Access, correction and deletion: ask the business that contacted you, or email us at info@onetouchreview.com. We will answer within the time the law allows.
• US state privacy rights: depending on where you live (for example California, Colorado, Connecticut, Virginia or Utah), you may have the right to know what we hold about you, get a copy, correct it, delete it, and opt out of sale or targeted advertising ("sharing"). We do not sell personal information. Our website's ad tags may count as sharing for targeted advertising; to opt out, use "Do not sell or share my information" at the bottom of any page on our website, or turn on Global Privacy Control in your browser, which we honor. We will not treat you differently for using these rights. An authorized agent may ask for you; we may need to check who is asking.

To delete data, including Facebook data, see Data Deletion.

Children

OneTouchReview is for businesses and is not meant for children under 13. We do not knowingly collect their data. If you think a child's data is here, email us and we will delete it.

Changes

If we change this policy, we will update the date at the top. If a change is significant, we will tell account owners by email or in the app before it takes effect.

Contact

OneTouchReview is run by Saman Technosys Pvt Ltd. Questions or requests: info@onetouchreview.com.