Privacy Policy

1. Scope of this policy

This Privacy Policy explains how Reviewslip (“Reviewslip,” “we,” “us,” or “our”) collects, uses, discloses, and protects information in connection with the Reviewslip website, web application, QR review slips, AI drafting tools, dashboards, and related services (collectively, the “Service”). Capitalized terms not defined in this Policy have the meaning given to them in our Terms of Service.

2. Information we collect

A. Information provided by business users

When a business registers or uses a Reviewslip account, we collect:

• Account registration details (name, business name, business email, phone number);
• Business location information and contact details;
• Configuration data (review destination URLs, custom categories, landing page designs, and QR code settings);
• Billing and transaction history (payment details are processed securely directly by third-party payment gateways); and
• Support communications and feedback.

B. Information submitted through end-customer experiences

End-customers interacting with a Reviewslip QR code or link do not need to create an account. When interacting with a Reviewslip experience, we may collect:

• Feedback selections, ratings, categories, or keywords chosen by the customer;
• Text entries or custom descriptions submitted to assist AI drafting;
• Edits made to suggested draft reviews; and
• Any additional information voluntarily submitted through the review portal.

Note for customers: Please do not submit sensitive personal identifiers (such as financial account numbers, passwords, or government ID numbers) into review feedback fields.

C. Automatically collected information

When anyone accesses the Service, we automatically log standard technical data, including:

• IP address and approximate location derived from IP;
• Browser type, device type, operating system, and language settings;
• Date/time stamps, referring/exit URLs, and clickstream data; and
• Diagnostic logs and performance metrics.

3. Cookies and tracking technologies

We and our service providers use essential cookies, local storage, and similar web technologies to ensure the Service functions securely, remember preferences, maintain user sessions, and analyze aggregate traffic patterns. [If applicable, list any specific analytics or advertising technologies you use, e.g. Google Analytics, Meta Pixel: ___.]

You can manage cookie preferences via your web browser settings. Disabling essential cookies may impair core application features.

Do Not Track: Our Service does not currently change its behavior in response to “Do Not Track” browser signals.

Global Privacy Control: Because we do not sell or share personal information for cross-context behavioral advertising, we do not currently process opt-out preference signals such as Global Privacy Control (GPC) as sale/share opt-outs. If our data practices change, we will update this Policy and our opt-out mechanisms accordingly.

4. How we use information

We process collected data to:

• Operate, maintain, host, and deliver the features of the Service;
• Facilitate AI-assisted draft generation requested by users;
• Process subscriptions and manage user billing;
• Authenticate accounts and prevent fraudulent, unauthorized, or abusive activity;
• Provide user support and respond to inquiries;
• Monitor application performance, troubleshoot errors, and optimize usability; and
• Comply with legal obligations and enforce our Terms of Service.

5. AI processing and third-party infrastructure

How AI works: Reviewslip uses third-party artificial intelligence API providers (such as OpenAI) to convert user selections and feedback keywords into readable draft review text.

Data security and model training: Data transmitted to our AI infrastructure partners is encrypted in transit and processed solely to generate real-time draft suggestions. We do not permit third-party AI providers to use your review inputs or feedback data to train public AI models. We may change AI infrastructure providers from time to time; any new provider will be bound by confidentiality and data protection obligations consistent with this Policy.

Advertising: We do not sell or monetize customer review content for targeted advertising purposes.

6. How we share information

We do not sell personal data for monetary gain. We share data only with trusted third parties under the following circumstances:

• Service providers: Cloud host providers, database infrastructure, secure payment gateways, email delivery systems, and AI processing APIs bound by confidentiality and security obligations.
• Legal and protection requirements: When required by law, subpoena, court order, or to protect the safety, rights, or property of Reviewslip, our users, or the public.
• Business reorganization: In connection with a corporate merger, acquisition, financing, asset sale, or bankruptcy proceeding.

We do not share Customer Content across different Business accounts.

7. Legal bases for processing (GDPR / UK GDPR)

If you reside in the EEA or UK, our legal bases for processing personal information are:

• Contractual necessity: To perform our obligations under our Terms of Service.
• Legitimate interests: To secure, operate, and improve our services, provided your privacy rights do not override these interests.
• Legal obligation: To comply with statutory and regulatory mandates.
• Consent: Where explicit consent has been provided (e.g. non-essential cookies).

Where a business subscriber, rather than Reviewslip, determines the purposes and means of processing End-Customer personal data (for example, deciding which customers to invite for feedback), that business subscriber is the data controller responsible for establishing its own lawful basis. See Section 14.

8. International data transfers

Reviewslip and its infrastructure providers may process and store data on servers located in the United States and other regions outside your home jurisdiction. Where required, we use standard contractual clauses (SCCs) or equivalent transfer safeguards approved by applicable regulators, including any mechanisms recognized under Thailand’s Personal Data Protection Act for transferring personal data outside Thailand.

9. Data retention and security

We retain personal information for as long as reasonably necessary to provide the Service, comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. As general guidance:

• Business Account data is retained for the duration of your active subscription and for up to [RETENTION PERIOD] afterward;
• End-Customer feedback, ratings, and draft content submitted through your dashboard is retained for up to [RETENTION PERIOD] unless you request earlier deletion; and
• Automatically collected technical and log data is retained for up to [RETENTION PERIOD] for security and diagnostic purposes.

You may request deletion of specific data as described in Section 10.

Security: We implement administrative, technical, and physical security measures designed to protect data against unauthorized access, loss, or disclosure. However, no internet transmission is completely risk-free, and we cannot guarantee absolute security.

Breach notification: If we become aware of a security incident affecting your personal information, we will notify affected individuals and/or applicable regulators as required by applicable law.

10. Your privacy rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or outdated information;
• Delete (erase) your personal data;
• Restrict or object to certain processing activities;
• Data portability (receive a portable copy of your data); and
• Withdraw consent at any time where processing was based on consent.

To exercise any of these rights, please contact us at info@reviewslip.com. We may verify your identity before processing your request. If you are located in the EEA or UK and believe we have not adequately addressed your request, you also have the right to lodge a complaint with your local data protection supervisory authority.

11. California privacy rights (CCPA/CPRA)

Under the California Consumer Privacy Act (CCPA), California residents have specific rights regarding their personal information:

• Right to know / access: Request disclosure of categories and specific pieces of personal data collected.
• Right to delete: Request deletion of personal information maintained by us.
• Right to correct: Request correction of inaccurate personal data.
• No sale or sharing: Reviewslip does not sell personal information or “share” personal data for cross-context behavioral advertising as defined by the CCPA. Because of this, we do not currently need to honor opt-out preference signals for that purpose; see Section 3.

12. Other U.S. state privacy rights

Residents of certain other U.S. states with comprehensive privacy laws (including, as of this Policy’s last update, Colorado, Connecticut, Virginia, Utah, and others) may have rights similar to those described in Sections 10 and 11, such as the right to access, correct, delete, and port personal information, and to opt out of certain processing. To exercise these rights, contact us at info@reviewslip.com.

13. Thailand Personal Data Protection Act (PDPA) rights

Because Reviewslip is based in Thailand, we also process personal information in accordance with Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“Thai PDPA”). If you are located in Thailand, your rights include:

• The right to be informed of how your personal data is collected and used;
• The right to access and request a copy of your personal data;
• The right to request correction of inaccurate personal data;
• The right to request erasure, destruction, or anonymization of your personal data;
• The right to restrict or object to certain processing;
• The right to data portability; and
• The right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, contact us at info@reviewslip.com. You also have the right to lodge a complaint with Thailand’s Office of the Personal Data Protection Committee (PDPC) if you believe we have not handled your personal data in compliance with the Thai PDPA.

14. Role as data processor and business customer relations

When end-customers interact with a Reviewslip QR code generated by a business subscriber, that business subscriber acts as the primary data controller for their customer interactions, and Reviewslip acts as a data processor. If you are an end-customer seeking to exercise privacy rights regarding data maintained directly by a business subscriber, you should contact that business directly.

Business subscribers who need a written Data Processing Agreement (for example, to satisfy Article 28 of the GDPR) may request one by contacting info@reviewslip.com.

15. Children’s privacy

The Service is strictly intended for individuals aged 18 and older. We do not knowingly collect or solicit personal information from children under 18. If we learn that we have collected data from a child under 18, we will delete it promptly.

16. Updates to this Privacy Policy

We may revise this Privacy Policy periodically. Updated versions will be posted on this page with an updated “Last updated” date. Continued use of the Service after changes are published constitutes acknowledgment of the revised terms.

17. Contact us

For questions, privacy inquiries, or data rights requests, please contact:

Reviewslip
Email: info@reviewslip.com
Address: 108 Moo 8, T. On Tai, San Kamphaeng, Chiang Mai 50130, Thailand