Privacy Policy

This policy covers two groups: the businesses who hold a LocalProof account ("Account owners"), and the end-customers of those businesses who submit feedback through a LocalProof review link.

From Account owners:

• name and email address used to create the account;
• organization and location details you enter (business name, address, phone, website, review links);
• subscription status and billing identifiers. Card details are handled by Stripe and never reach our servers.

From end-customers:

• the name and email address the Account owner supplies in order to send a review request;
• the star rating, written feedback, and name they choose to submit — name and written feedback are both optional;
• whether they chose to also publish their feedback on a public platform.

• to operate the service and show feedback to the business;
• to send review-request emails on the Account owner's behalf;
• to generate suggested reply drafts, where the Account owner asks for one;
• to handle billing, support, and account security.

We do not sell personal data, and we do not use end-customer feedback to advertise to them.

For end-customer data, the Account owner is the data controller and LocalProof acts as a data processor on their behalf. We process that data only on the Account owner's instructions and for the purposes described above. The Account owner is responsible for having a lawful basis to contact their customers.

For Account owner data (the business's own account details), LocalProof is the controller.

We share data with a small number of providers strictly to run the service: Supabase (database and authentication), Vercel (hosting), Stripe (payments), Resend (transactional email), and OpenAI (generating suggested reply drafts from review text).

Account and feedback data is retained for as long as the account is active. If an account is closed, we delete or anonymize its data within 90 days, except where we must keep records longer for legal, tax, or fraud-prevention reasons. An Account owner can delete individual contacts or locations at any time.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, or to object to certain processing. End-customers should contact the business that sent them the review request in the first instance; we will assist that business in responding. You can also contact us directly and we will route the request appropriately.

We use a small number of strictly necessary cookies to keep Account owners signed in and to keep sessions secure. We do not use advertising or cross-site tracking cookies. The public review page does not require a cookie to submit feedback.

Data is encrypted in transit, access to the production database is restricted by row-level security so one business cannot read another's data, and administrative credentials are held server-side only.

Privacy questions or requests: privacy@get-local-proof.com.