Privacy Policy

Data Controller

StarReview (sole proprietorship)
Fabian Weinhappl
Schönenbergstrasse 10
9543 St. Margarethen, Switzerland
Email: hello@starreview.ch

1. Data We Collect

We collect the following personal data:

• Name and email address (upon registration via Google sign-in)
• Google Business Profile data (location information, reviews, review texts, reviewer name)
• Social reply generator data for the selected business location: pasted review text, optional one-time context, selected platform and listing metadata, saved platform profile context and reply policy notes, generated replies, copied or selected variant metadata, and usage or credit metadata
• Payment information (processed by our payment processor, we do not store credit card data)
• Usage data (login times, features used)
• Customised replies (to improve the response style, “Style Memory”)
• When sending review requests via SMS: phone numbers of your end customers (used solely to send the request you initiated, no marketing)

2. How We Use Your Data

We use your data exclusively for the following purposes:

• Creating personalised replies to your Google reviews
• Creating manual copy-back replies for pasted reviews from other platforms for the selected business location, and showing the related social reply history and credit usage
• Managing your account and subscriptions
• Weekly and monthly summaries via email
• Notifications for negative reviews (1-2 stars)
• Style Memory: when you adjust a reply, the system learns your style for future suggestions in your account
• Improving our services

We do not train external AI models with your data. Your reviews, replies, and Style Memory entries stay in your account and are not used to train or fine-tune third-party AI models.

3. Data Sharing

We do not sell your data or share it with third parties for marketing purposes. The following service providers process data on our behalf:

• Google Business Profile API, to retrieve reviews and publish replies
• AI service provider, review texts are processed to generate reply suggestions, without permanent storage
• Payment processor, for secure payment processing (PCI-DSS compliant)
• Email service provider, for sending notifications
• Hosting, operation of our platform in EU data centres

StarReview's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. For more details, see our Google API disclosure.

4. Data Retention

Your data is stored as long as your account is active. After account deletion, all personal data is irrevocably deleted within 30 days. Anonymised data may be retained for statistical purposes.

Per-item approval is the default: you approve the exact text before StarReview sends it. That remains the case unless you have switched on automatic publishing in your settings; where you have switched it on, content that meets the conditions you set and passes StarReview's safety checks is published without a separate approval from you. Some replies are still held for your approval, including where a safety check does not pass. Switching on automatic publishing is your own decision, and you stay responsible for the content of everything published on your behalf under it. Content published through StarReview to your own platforms is your content and your responsibility. This does not change StarReview's own obligations for how it operates and secures the service and how it processes your data. In data-protection terms, you are the controller of the content published on your instruction, and StarReview processes it on that instruction. StarReview's erasure obligation is limited to what StarReview holds.

If StarReview definitively confirms that a review was deleted or invalidated on Google before a reply was published, StarReview marks the review as no longer visible and removes it from active approval and publishing queues. That status change does not delete StarReview's stored copy of the review.

If you delete your StarReview account, StarReview deletes the personal data it holds, as described above. StarReview does not, on its own initiative or as part of a data-erasure request, retract, delete or alter content already published to a provider with your approval. Erasing StarReview's records does not unpublish that content; it remains your content in the provider's system. You may explicitly instruct StarReview through the product to delete your own reply that was published through StarReview to Google, and StarReview carries out that instruction.

Social reply profiles and pasted social reply history are stored for the selected business location until you delete the history entry manually or the related business location or account is deleted. Pasted social review text is stored as history, not as reusable business knowledge.

5. Cookies and Analytics

StarReview sets as few cookies as possible. For web analytics we use a privacy-friendly tool that sets no cookies and collects no personal data. A session cookie is used solely for sign-in (strictly necessary). If you arrive via a marketing link with campaign parameters (utm), we set one cookie (sr_ft, 90 days) to attribute where your visit came from, but only after you consent in the cookie banner. If you decline, this cookie is not set.

6. Data Processing Location & International Transfer

Your account and review data is stored in EU data centres.

Our AI service provider for reply generation processes review texts in the USA. This international data transfer takes place on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and equivalent safeguards under the revised Swiss Federal Act on Data Protection (nFADP). Review texts are processed in real time and not permanently stored by the AI provider.

7. Your Rights (nFADP + GDPR)

Under the Swiss Federal Act on Data Protection (nFADP) and the EU GDPR, you have the right to:

• Access your stored data
• Rectify inaccurate data
• Delete your data
• Data portability
• Withdraw your consent
• Restrict processing
• Lodge a complaint with the competent data protection authority, in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in EU member states, the relevant national supervisory authority

The right to deletion applies to personal data StarReview holds. It does not require StarReview to retract content already published to a third-party platform.

8. Legal Basis

The processing of your data is based on the Swiss Federal Act on Data Protection (nFADP) of 1 September 2023 and, where applicable, the EU General Data Protection Regulation (GDPR).

9. Automated Decision-Making

Reply suggestions are generated algorithmically. With automatic publishing enabled, replies are published without renewed manual review in each individual case, but always based on your explicit setting per star rating or per content category you have explicitly enabled (for example short, clearly positive reviews in a specific language). By default, every reply requires your manual approval. So that StarReview only suggests such an automation when it matches your approval behaviour, StarReview continuously performs automated checks on which reviews and reply drafts meet the criteria of a content category; only minimised check results (codes, no review texts) are stored. This is not a decision producing legal or similarly significant effects within the meaning of Art. 22 GDPR or Art. 21 nFADP, but the publication of content you have explicitly authorised in advance. You can deactivate auto-publishing at any time.

10. Contact

For questions regarding data protection, please contact us at:

hello@starreview.ch