Privacy Policy

Account information. When you create an account, we collect your email address and basic account and business profile information you provide. Depending on how you sign in, we use a one-time email code (OTP) and/or a password. Passwords are handled by our authentication provider (Supabase) and are stored only in hashed form — ReVloom does not receive or store your plaintext password.

Business profile data. If you connect a Google Business Profile account, we access the business and location information, customer reviews, and reply data needed to provide the connected features, via the Google Business Profile API.

Review screenshots. If you use the screenshot import feature, you intentionally submit an image of review content. The image is transmitted to our AI vision provider to extract the review text; see "Data Retention" below for how it is handled.

Usage data. We record which features you use and reply/generation counts per billing period to operate the service, enforce plan quotas, and prevent abuse.

Subscription and billing. Subscription purchases are processed by the applicable app store (currently Apple's App Store) and managed through RevenueCat. We receive confirmation of your subscription status and plan tier. We do not receive or store your full payment-card details.

Device and diagnostic data. We and our infrastructure providers collect standard technical information — such as device type, operating system, app version, IP address, and server request metadata — to operate the service, secure it, and diagnose errors.

We use the information described above to:

• Generate and transform AI reply drafts for your customer reviews
• Authenticate your account and maintain secure sessions
• Manage your subscription, enforce plan quotas, and process subscription events
• Send transactional messages (OTP codes, account and billing notices)
• Monitor service health, diagnose errors, and prevent fraud and abuse
• Improve the quality and reliability of our features
• Comply with applicable legal obligations

ReVloom is designed for business use — our users are businesses, business owners, and their authorized staff, including restaurants and other small and medium-sized businesses, not consumers.

• We do not sell your personal information
• We do not use your data to build advertising profiles or serve targeted ads
• We do not track your precise location
• We do not store your payment-card details — billing is handled by the app store
• We do not use customer review content to train our own general-purpose AI models

We rely on trusted infrastructure and AI providers to deliver the service. Each processes data only as directed by us:

• Supabase — authentication, database, storage, and backend functions
• OpenAI — AI text generation and transformation, and vision-based review-text extraction from screenshots, via the OpenAI API
• Apple App Store — in-app payment processing
• RevenueCat — subscription status and entitlement management
• Google (Business Profile API) — accessing your authorized business reviews and submitting replies at your direction
• Sentry — crash and error diagnostics, when enabled (see "Diagnostics" below)

These providers maintain their own privacy policies governing their handling of data, and we encourage you to review them.

When you connect Google Business Profile, ReVloom requests authorized access to the business information, reviews, and reply data needed for the connected features. ReVloom reads this information to help you draft replies and submits a reply to Google only after you review and choose to send it. You can disconnect the integration at any time.

ReVloom's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. ReVloom is not affiliated with, endorsed by, or partnered with Google.

When enabled, ReVloom uses Sentry for crash and error diagnostics. This may process limited technical information when a crash or error occurs — such as device type, operating system, app version, and technical error context. It is used for stability and debugging only; it is not advertising or behavioral analytics. We apply an allow-list that removes sensitive fields (such as email addresses, names, and review or reply text) before diagnostic reports are sent.

We retain your account data, review information, and reply history for as long as your account is active.

For screenshot import, ReVloom does not intentionally retain the raw screenshot image after the review text has been extracted. A non-reversible hash of the image may be kept to avoid re-processing duplicate images and to help prevent abuse. The review text extracted from a screenshot, and the replies you generate, may be stored as part of your review and reply history.

Our AI provider states that API inputs and outputs are not used to train its models by default unless the customer explicitly opts in. We do not control, and make no promises about, how long our third-party AI provider retains data submitted to it for processing; that is governed by the provider’s own policies.

We use industry-standard security practices, including HTTPS for all data in transit, encrypted storage for authentication tokens on your device, and row-level security in our database. No system is perfectly secure; please use a strong, unique email account and notify us promptly if you suspect unauthorized access.

Delete your account. You can delete your account directly in the app at Profile → Account → Delete Account. Deletion removes your account and its associated application data. Limited information may be retained where required for legal, security, fraud-prevention, accounting, or transaction-record purposes.

Access, correction, and other requests. You may request access to, correction of, or deletion of your personal data at any time by contacting hello@revloomapp.com.

If you are located in the European Economic Area (EEA), the United Kingdom, or California, additional rights may apply under the GDPR, UK GDPR, or CCPA, including data portability, restriction of processing, and the right to object to certain uses. We respond to verifiable requests as required by applicable law.

ReVloom is intended for use by business owners and their authorized staff who are 18 years of age or older. We do not knowingly collect personal data from individuals under the age of 16. If you believe we have inadvertently collected such data, please contact us so we can remove it.

We may update this Privacy Policy periodically to reflect changes in our practices or applicable law. We will notify you of material changes via in-app notice or email before they take effect. Continued use of ReVloom after the effective date of an updated policy constitutes your acceptance of the changes.

Questions or concerns about this Privacy Policy or your data? Contact us at hello@revloomapp.com. We aim to respond within 3 business days.