Privacy Policy — India DPDP Act & US State Privacy

1. Introduction & Territorial Scope

Review Manager operates in India (via our Flutter mobile application and web portal) and the United States (via our web application). We are committed to processing personal data in strict compliance with the Digital Personal Data Protection Act 2023 (DPDP Act, India), US federal regulations, and state-level consumer privacy laws including the California Consumer Privacy Act as amended by CPRA (CCPA).

2. Customer Review Data Minimisation & 30-Day Purge

When a merchant pastes a customer review into our AI Reply Studio, the customer review text is stored strictly on a temporary basis to facilitate owner reply drafting and history review.

Strict Retention Rule: All customer review text is assigned a retention expiration timestamp (expiresAt) and is automatically and permanently purged 30 days after creation. Only anonymous star ratings and drafted owner replies are retained.

3. India DPDP Act 2023 Provisions

For Indian users, data is processed lawfully based on specified purpose consent:

Right to Access & Correction: Indian merchants may review and update their profile and business data via the portal at any time.
Right to Erasure (Right to be Forgotten): You may request complete erasure of your business data directly in-app or via our public Delete Account page.
Right of Grievance Redressal: Indian Data Principals may submit grievances to our designated Grievance Officer via support@reviewmanager.app.

4. United States & California Consumer Privacy Rights (CCPA / CPRA)

For users residing in the United States, including California:

No Sale or Sharing of Personal Data: We do NOT sell your personal data or share your information with third-party advertisers for cross-context behavioral advertising.
Right to Know & Delete: You have the right to request disclosure of categories of personal information collected and request deletion.
Non-Discrimination: We do not discriminate against any user for exercising their CCPA/CPRA privacy rights.

5. Payment Information Security

We never store, log, or transmit raw credit card numbers, debit card details, or UPI MPIN credentials on our servers:

India: Mobile subscriptions are billed securely via Google Play Billing and Apple In-App Purchase (RevenueCat). Web subscriptions are processed via RBI-compliant Razorpay Subscriptions (UPI AutoPay / e-Mandates).
United States: Web billing is processed via PCI-DSS Level 1 certified Stripe Checkout and Stripe Customer Portal, with automatic sales tax compliance via Stripe Tax.

6. Strict Anti-Gating Statement

Review Manager strictly complies with Google Business Profile policies. We never gate negative reviews, never reward customers with discounts or prizes for leaving reviews, and ensure every customer gets direct, unfiltered access to Google's genuine review form.