This policy explains how [LEGAL ENTITY NAME] (“ReviewScribe”, “we”, “us”) handles personal data when you use our website at reviewscribe.com, your ReviewScribe account, and the ReviewScribe WordPress plugin (“the Plugin”). It also tells store owners which parts of the Plugin handle their own customers’ data, so they can describe it in their own privacy policy.
The short version
- We collect what we need to run your account, sell and deliver licences, and run the feature board.
- We don’t sell your data, and our website doesn’t use analytics, advertising or social-media tracking cookies.
- Reviews your customers leave through the Plugin stay in your WordPress database. We never receive them.
- The free Plugin sends us nothing. A paid licence only sends us its key and your site’s address so we can check it.
1. Who is responsible for your data
[LEGAL ENTITY NAME], a company registered in Bangladesh at 149/A West Monipur, Mirpur-2, Dhaka-1216, is the controller of the personal data described in sections 2 to 4. The Plugin puts us in two different positions, so who is responsible depends on the situation:
| Situation | Who is the controller | Where the data lives |
|---|---|---|
| You browse reviewscribe.com, create an account, buy a licence, post on the feature board or contact support | We are. This policy applies. | Our website and the providers in section 8 |
| The Plugin checks your licence with us | We are, for the licence key, site address and the email you enter | Our licence server |
| Your customers leave reviews through the Plugin on your site | You are. Your own privacy policy applies. | Your WordPress database, on your hosting |
2. Information we collect on our website
2.1 Browsing
When you visit reviewscribe.com, our web server records standard access logs: your IP address, the date and time, the page you asked for and your browser type. We use them to keep the site secure and to fix problems. We don’t use analytics or advertising tools that follow you around the site or across the web.
2.2 Your account
To create an account we ask for your email address and a password. Your password is stored only as a salted one-way hash, so nobody at ReviewScribe can see it. We create a username from your email address. Under My account you can add your first and last name and a profile photo (JPG, PNG or WebP). Your photo and first name are shown in the site header while you’re signed in, and next to anything you post on the feature board or blog.
2.3 Keeping sign-in safe
To stop password guessing and spam sign-ups, we count sign-in, sign-up and password-reset attempts from each device. We store a keyed one-way hash of your IP address for this, never the address itself, and the counters delete themselves after 15 minutes to one hour.
If you forget your password, we email a 6-digit code to your account’s address. We store only a keyed hash of the code. It expires after 15 minutes, and it’s deleted once you use it. A cookie called rs_reset ties the reset to your browser for up to 30 minutes.
2.4 Purchases and licences
Paid licences are sold through [MERCHANT OF RECORD], which acts as merchant of record. It collects your payment details, billing address and tax information, and its own privacy policy covers that. We never receive or store your full card number. From each purchase we receive your name, email address, country, order and tax details, the plan you bought, and your licence key. We also keep the list of websites where you’ve activated your licence, which you can see under My account → Subscription.
2.5 Feature requests, votes and comments
When you post a feature request, vote, or comment on our feature board or blog, we store what you submit, your name, your account and when you posted it. Your name, profile photo (or initials) and your post are shown publicly, and your name may appear among the people who voted for a request. Your email address is never shown. Images you attach to a request are stored on our server and shown with it.
New feature requests are emailed to our team so we can review them before they’re published. To limit spam, we keep a keyed hash of your IP address for one hour after each request. Blog comments also record your IP address and browser, as WordPress does by default.
If you comment without a profile photo, WordPress may show your picture from Gravatar, a service of Automattic Inc. To find it, your browser loads an image from Gravatar’s servers using a one-way hash of your email address.
2.6 Emails from us
We email you about your account and licences: sign-up and password-reset messages, receipts, renewal reminders and security notices. These are part of the service, so you can’t opt out of them while you have an account.
Product news is different. Under My account → Newsletter you can choose to receive Important Updates and the Newsletter & News Updates. Both are off until you tick them, we record your choice with your account, and you can untick them or unsubscribe from any email at any time. We send emails through [EMAIL PROVIDER].
2.7 Support
When you contact us, we receive your name, email address, your message and anything you attach, such as screenshots, error logs or system reports. Please remove anything sensitive, like passwords or customer details, before you send a system report.
3. Cookies
Our website only uses cookies it needs to work, so we don’t ask for cookie consent. We don’t use analytics, advertising or social-media cookies. You can block or delete cookies in your browser, but you won’t be able to sign in or buy a licence without the essential ones.
| Cookie | What it does | How long it lasts |
|---|---|---|
wordpress_logged_in_*, wordpress_sec_* | Keeps you signed in to your account | Until you close your browser (a sign-in lasts at most 2 days) |
wordpress_test_cookie | Checks that your browser accepts cookies when you sign in | Until you close your browser |
rs_reset | Links a password reset to your browser | 30 minutes |
wp_woocommerce_session_*, woocommerce_cart_hash, woocommerce_items_in_cart | Remembers your cart and checkout | Up to 2 days |
comment_author_* | Remembers your name and email in the comment form, only if you tick the box | 347 days |
wp-settings-* | Remembers screen settings in the WordPress dashboard (our team only) | 1 year |
4. What the Plugin sends to us
4.1 The free version
The free version doesn’t send us anything. Your reviews, settings and customers’ details stay in your WordPress database. The only exception is if you enter a licence key, described next.
4.2 Licence activation and checks
When you activate a licence, the Plugin sends our licence server your licence key, your site’s address and the email address you enter. Afterwards it checks the licence by sending the key and your site’s address. We use this to confirm the licence is valid, keep to the number of sites your plan covers, show your sites under My account and deliver updates.
The Plugin doesn’t send us reviews, or data about your customers or orders.
4.3 Optional usage statistics (planned)
The Plugin doesn’t send us usage statistics today. We plan to add an option to share them, so we can see which features and settings are used most and decide what to improve next. When we add it:
- it will be off until you turn it on, and you’ll be able to turn it off again at any time in the Plugin’s settings
- it will only include which features, widgets and settings are switched on, and how many sites use them, plus your WordPress, WooCommerce, PHP and Plugin versions
- it will never include reviews, reviewer or customer details, or order data
- we’ll update this policy to describe it before it’s released
4.4 Services you connect yourself
Some Plugin features talk to other companies’ services. The data goes straight from your site to that service, never to us, and you choose whether to switch them on:
- AI review summaries (OpenAI). If you add your own OpenAI API key, the Plugin sends the text of a product’s reviews from your site to OpenAI to write the summary. Reviewer names and email addresses aren’t included. This runs under your OpenAI account and OpenAI’s terms.
- Google reCAPTCHA. If you turn it on, Google’s script loads on your review forms and Google receives the visitor’s IP address and how they interact with the form, under Google’s privacy policy.
- Review request emails. These are sent through your own email setup (WordPress mail or the SMTP service you configure).
- Gravatar. Product review lists may show reviewer pictures from Gravatar, which receives a one-way hash of the reviewer’s email address.
- Google Fonts. The Plugin’s settings screens load fonts from Google Fonts, so Google sees the IP address of the person using your WordPress dashboard.
5. Reviews your customers leave on your site
When your customers leave a review through the Plugin, your website collects it and stores it in your WordPress database. Depending on your settings, that can include their name, email address, country, job title, ratings, review title and text, photos, videos, YouTube links and whether they recommend the product. For email review requests, the Plugin also reads the order: the customer’s name and email address, the products, the order status and the billing country (to pick the email’s language).
We can’t see any of this, and it’s never sent to us. As the site owner, you’re the controller. You decide what to collect, you answer your customers’ requests, and you can export or delete their reviews from your WordPress dashboard.
What to mention in your own privacy policy
If you use the Plugin, your privacy policy should explain:
- which review details you collect and why, and how long you keep them
- that you email customers after a purchase to ask for a review, and how they can unsubscribe
- the services you’ve switched on from section 4.4, such as reCAPTCHA, Gravatar or OpenAI
- how customers can contact you to see, correct or delete their reviews
Questions about a review on someone else’s store
If you left a review on a store that uses ReviewScribe, that store holds your data, not us. We can’t see, change or delete it, so please contact the store directly. If you write to us, we’ll point you to them.
6. Why we use your data
Where data protection laws such as the GDPR or UK GDPR apply, we rely on these legal bases:
| What we do | Legal basis |
|---|---|
| Create and run your account, sell and deliver licences, check licences, send updates and answer support | Contract |
| Publish your feature requests, votes and comments | Contract (you choose to post them) |
| Protect sign-in, limit spam, keep server logs, prevent fraud and licence abuse | Legitimate interests in keeping our services safe |
| Send Important Updates and the newsletter | Consent, which you can withdraw at any time |
| Receive optional usage statistics from the Plugin, once that option exists (section 4.3) | Consent, which you can withdraw at any time |
| Keep orders, invoices and tax records | Legal obligation |
7. How long we keep it
- Account: while your account is open. When you ask us to close it, we delete or anonymise your account data within 30 days.
- Orders, invoices and licence records: as long as tax and accounting law requires, currently [6] years.
- Feature requests, votes and comments: while the feature board is online. If you close your account, we delete them or remove your name from them.
- Sign-in and spam counters: 15 minutes to one hour. Password-reset codes: 15 minutes.
- Support conversations: [24] months after the conversation ends.
- Server logs: [30] days.
- Newsletter choices: until you unsubscribe or close your account.
8. Who we share data with
We don’t sell your personal data, and we don’t share it for advertising. We only share it with providers who process it for us under contract, and only what they need:
- [MERCHANT OF RECORD] takes payments, issues invoices and refunds, and handles sales tax as merchant of record.
- [HOSTING PROVIDER] hosts our website, databases and licence server.
- [EMAIL PROVIDER] sends our account and newsletter emails.
- Gravatar (Automattic Inc.) provides comment pictures for people without a profile photo (see 2.5).
We may also disclose data when the law requires it, to protect our rights or someone’s safety, or to a buyer if our business is sold. If our business is sold, this policy keeps applying to your data.
9. International transfers
We’re based in Bangladesh, and our providers may process data in other countries, including the United States. Bangladesh and some of those countries don’t have an adequacy decision from the European Commission or the UK. When we transfer personal data from the EEA, the UK or Switzerland, we use the European Commission’s Standard Contractual Clauses, with the UK Addendum where needed, or another approved safeguard. You can ask us for a copy.
10. Your rights
Depending on where you live, you can ask us for a copy of your data (also in a portable format), and ask us to correct it, delete it, or restrict or stop how we use it. Where we rely on your consent, you can withdraw it at any time. You can change your name, photo, email, password and newsletter choices yourself under My account. For anything else, including closing your account, email help@reviewscribe.com. We’ll reply within one month.
If you’re in the EEA or the UK, you can also complain to your local data protection authority. If you’re a California resident, you have the rights to know, delete, correct and opt out of the sale or sharing of your data. We don’t sell or share personal data as California law defines those terms.
11. Security
We protect your data with HTTPS, salted password hashing, short-lived hashed reset codes, limits on sign-in attempts, access only for the people who need it, and regular updates and backups. No system is completely secure. If a breach affects your data, we’ll tell you, and the authorities where the law requires it.
12. Children
ReviewScribe is made for businesses and isn’t meant for children. You must be at least 16 to create an account, and we don’t knowingly collect data from children.
13. Changes to this policy
When we change this policy, we update the “Last updated” date at the top of the page. If a change is significant, we’ll also email account holders before it takes effect.
14. Contact us
[LEGAL ENTITY NAME]
Registered address: 149/A West Monipur, Mirpur-2, Dhaka-1216, Bangladesh
Contact address: Tingkat Bawah, Bangunan Persatuan Pelajar, University Teknologi Malaysia, 81310 Skudai, Johor, Malaysia
Phone: +60 11-1443 7370
Email: help@reviewscribe.com