Privacy Policy
Last updated: 3 September 2026
1.Who we are
Trading as Quiet Review, a sole proprietor in South Africa.
- Email: support@quietreview.com
2.Two roles, and why it matters
If you are a business using Quiet Review, we are the responsible party for your account information — your name, email, business details and settings. We decide how it is processed, and this policy explains how.
If you are a customer who left feedback for a business, that business is the responsible party for your feedback. They decide how it is used; we hold it on their behalf. Contact them directly, or email us at support@quietreview.com and we will pass your request to them.
3.What we collect
From businesses using the Service
- Name and email address
- Business name, Google review link and Google place identifier
- Configuration settings — routing preferences, brand colours, custom headline, notification addresses
- Any banner image you upload
- If you sign in with Google: your name, email and profile picture from Google
From customers using a review page
- The star rating given
- If voluntarily provided: a written message, and optionally a name, email address or phone number
- A randomly generated visitor identifier used only to count unique visitors. It contains no personal information and is not used for advertising or tracking across other websites.
Automatically
- IP addresses, stored only as a salted one-way hash, used to limit abuse. We never store raw IP addresses.
- Essential cookies to keep you signed in.
Images. Any banner you upload is re-encoded before storage, which removes all embedded metadata — including GPS coordinates that phone photographs commonly carry.
Payment details are collected and stored by Paystack, not by us. We never see or store card numbers.
4.Why we process it
| Purpose | Basis |
|---|---|
| Providing the Service to your account | Performance of our contract with you |
| Processing subscription payments | Performance of our contract with you |
| Service and security notices (payment failures, password resets) | Our legitimate interests, and legal obligation |
| Limiting abuse of review pages | Our legitimate interests |
| Storing customer feedback and showing it to the business | On that business’s instruction |
| Contact details a customer voluntarily provides | The customer’s consent, given at submission |
| Product update emails | Your consent — opt-in, withdrawable at any time |
5.Who we share it with
- Supabase — database hosting and authentication
- Paystack — payment processing
- Resend — sending transactional email
- Vercel — application hosting
- Google — only in that a high rating opens Google’s own review page. We never send Google any private feedback, contact details or account information.
We do not sell personal information.
We may disclose information where legally required, or to protect our rights or someone’s safety.
6.Where your information is stored
Our infrastructure providers process and store data outside South Africa, including in the European Union. We rely on section 72(1)(a) of POPIA: these providers are bound by contractual terms that uphold principles for lawful processing substantially similar to those required under POPIA, including on onward transfers.
7.How long we keep it
- Account and review data — while your account is active.
- After you delete your account — removed within 30 days, including uploaded images. This cannot be undone.
- Abuse-prevention hashes — 30 days.
- Records required by law for tax or accounting — as long as the law requires.
8.Your rights
Under POPIA you may:
- Ask what personal information we hold about you
- Ask us to correct information that is wrong
- Ask us to delete information we no longer have grounds to keep
- Object to processing based on our legitimate interests
- Withdraw consent where you gave it
- Complain to the Information Regulator
Email support@quietreview.com. We respond within a reasonable period and in any case as the law requires.
If your request concerns feedback you left for a business, we pass it to that business, since they decide what happens to it.
Information Regulator (South Africa)
POPIAComplaints@inforegulator.org.za
enquiries@inforegulator.org.za
27 Stiemens Street, Braamfontein, Johannesburg
9.Cookies
We use only what is necessary to run the Service:
- Session cookies in the dashboard, to keep you signed in
- A visitor identifier on review pages, to count unique visitors
We use no advertising cookies, no marketing cookies and no third-party tracking.
Most browsers allow you to block or delete cookies, though disabling essential ones will prevent you signing in.
10.Security
- Encrypted connections (HTTPS) throughout
- Authenticated access controls
- Database-level row security, so an account can only reach its own data
- Salted hashing of IP addresses instead of storing them
- Uploaded images re-encoded to strip embedded metadata
No system is perfectly secure. If a breach occurs that is likely to harm you, we will notify you and the Information Regulator as POPIA requires.
11.Children
The Service is not directed at children and we do not knowingly collect their personal information.
12.Changes
We may update this policy and will tell you by email or in the app if the changes are significant.