Privacy Policy

Last updated: 2 July 2026

1. Who We Are

ReviewFlow NZ is operated by Bhuwan Kshetri, a sole trader based in Hastings, Hawke's Bay, New Zealand. We provide done-for-you Google review automation services for local small businesses.

For privacy enquiries, contact us at: bk@reviewflow.co.nz or 027 211 5004.

2. What Information We Collect

• Customer contact details — names, email addresses, and phone numbers provided to us by our business clients in order to send Google review requests
• Business client information — names, business names, email addresses, phone numbers, and Google Business Profile details of businesses that use ReviewFlow NZ
• Google Business Profile data — reviews, star ratings, review text, reviewer display names, review timestamps, reply status, and related location and profile information that we access through the Google Business Profile API, only for Google Business Profiles that our clients own or have authorised us to manage on their behalf
• Usage data — basic analytics about how our dashboard and website are used (pages visited, button clicks)
• Communications — any messages or emails you send to us directly

3. How We Use Your Information

• Send automated Google review request messages by email and SMS on behalf of local businesses after a job or service
• Retrieve and display our clients' Google reviews within their ReviewFlow NZ dashboard
• Generate AI-drafted replies to Google reviews on behalf of our clients, which the client (or our team, where the client has authorised this) reviews and approves before posting
• Post approved review replies to Google Business Profiles via the Google Business Profile API
• Provide and improve the ReviewFlow NZ service
• Communicate with our business clients about their account
• Comply with legal obligations under New Zealand law

4. Google User Data and Limited Use

Specifically, information we receive from the Google Business Profile API is used only to provide the user-facing features of ReviewFlow NZ — displaying our clients' reviews in their dashboard and drafting and posting approved replies. Consistent with the Limited Use requirements, information received from Google APIs is not:

• Used or transferred for serving advertisements, including personalised, retargeted, or interest-based advertising
• Sold or transferred to data brokers, information resellers, or any other parties for their own purposes
• Used to train, fine-tune, or improve any generalised or non-personalised artificial intelligence or machine-learning models
• Read by humans, except where the client has approved a specific reply, where necessary for security or to investigate abuse, to comply with applicable law, or where the client has expressly asked us to act on their behalf

AI-drafted replies

To draft a suggested reply to a Google review, the content of that review — which may include the reviewer's display name and the text of their review — is sent to our AI provider (Groq) solely to generate a reply suggestion for that specific review. This data is used only to produce the draft reply shown to our client for approval. We do not use Google user data to train, fine-tune, or improve any AI or machine-learning models, and no reply is posted to Google until it has been approved.

5. Legal Basis — New Zealand Privacy Act 2020

ReviewFlow NZ operates in full compliance with the New Zealand Privacy Act 2020. We collect personal information only when it is necessary for a lawful purpose connected directly to our service. We collect only what is needed, not more.

Customer contact details are collected by our business clients (the tradies and service providers) who have an existing relationship with those customers. We process this data on their behalf as a service provider. Similarly, we access and process Google Business Profile review data on our clients' behalf and at their instruction, for Google Business Profiles they own or are authorised to manage.

6. Who We Share Information With

We do not sell, rent, or trade your personal information. We share data only with the following service providers, solely to deliver the ReviewFlow NZ service:

• Google — to retrieve reviews and post approved review replies to Google Business Profiles via the Google Business Profile API
• Supabase — secure database storage for client and customer data
• Resend — delivery of review request emails
• Twilio — delivery of review request SMS messages
• Groq — generation of AI-drafted reply suggestions (see Section 4)

All third-party providers are used solely to deliver the ReviewFlow NZ service and are not permitted to use your data for their own purposes.

7. How Long We Keep Your Data

We retain customer contact details for as long as a business remains a ReviewFlow NZ client, plus 30 days after account closure. Business client data is retained for the duration of the service agreement plus 12 months for billing and legal compliance purposes.

We do not create permanent copies of Google user data beyond what is needed to provide the service, and we do not retain cached Google data longer than permitted. You may request deletion of your data at any time — see Section 9.

8. How We Protect Your Information

• Encrypted data storage with our database provider
• Access restricted to authorised personnel only
• API keys and credentials stored securely and never shared publicly
• HTTPS encrypted connections on all web properties

9. Your Rights

Under the New Zealand Privacy Act 2020, you have the right to:

• Ask whether we hold personal information about you
• Request access to that information
• Request correction of any incorrect information
• Request deletion of your information (subject to legal retention requirements)
• Opt out of receiving review request messages — simply reply STOP, or click unsubscribe in any email we send

A business client may revoke ReviewFlow NZ's access to their Google Business Profile at any time by disconnecting the integration or by contacting us, after which we will cease accessing their Google data.

To exercise any of these rights, contact us at bk@reviewflow.co.nz. We will respond within 20 working days as required by law.

10. Google Review Compliance

ReviewFlow NZ sends review requests in full compliance with Google's review policies. We do not:

• Offer incentives in exchange for reviews
• Send requests only to customers we believe will leave positive reviews
• Generate, post, or solicit fake reviews
• Gate reviews by screening customers before they reach Google

Every review request is sent to all customers equally, after a genuine transaction or service. Where we post replies to reviews on a client's behalf, we do so only with that client's authorisation.

11. Cookies and Website Analytics

Our website (reviewflow.co.nz) may use basic analytics to understand how visitors use the site. We do not use advertising cookies or track individuals across other websites. No personally identifiable information is collected through our website analytics.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "last updated" date at the top of this page. If we change the way we use Google user data, we will notify affected clients and, where required, seek their consent before the change takes effect. Continued use of ReviewFlow NZ after any changes constitutes acceptance of the updated policy.

13. Complaints

If you believe we have breached the Privacy Act 2020 or mishandled your personal information, please contact us first at bk@reviewflow.co.nz so we can address your concern.

If you are not satisfied with our response, you can make a complaint to the Office of the Privacy Commissioner at privacy.org.nz or by calling 0800 803 909.

© 2026 Bhuwan Kshetri trading as ReviewFlow NZ · bk@reviewflow.co.nz