Privacy policy

1. The short version

We collect the minimum needed to run the service, we never sell personal information, your customer lists remain yours, and every marketing message we send includes a working opt-out that takes effect immediately.

2. Roles under POPIA

For your account details, PeakReviews is the responsible party. For the customer contacts you upload, your business is the responsible party and PeakReviews acts as an operator, processing that data only on your instructions to deliver the service.

3. What we collect

• Account data: your name, email address and password (stored as a salted hash).
• Business data: business name, industry, city, phone numbers, Google listing details.
• Customer contacts you add: name, WhatsApp number, and consent status.
• Reviews: public Google reviews of your business, and the reply drafts you create.
• Usage data: message delivery statuses from WhatsApp, and website analytics and measurement data (see "Analytics and advertising on our website" below).

4. What we use it for

Only to run PeakReviews: sending the review requests you trigger, tracking their delivery, monitoring your public reviews, drafting replies, sending you summaries, and billing. We do not sell personal information, share customer lists between businesses, or use your data for advertising.

5. Who processes data on our behalf

Delivering the service involves these processors:

• Meta (WhatsApp Business Platform): delivers review request messages to your customers.
• Google: provides your business listing details and public reviews.
• Paystack: processes subscription payments. We never see or store card numbers.
• Anthropic and OpenAI: generate reply drafts from review text. Reviews are public content; we do not send customer contact details to AI providers.
• Supabase and Vercel: database and hosting infrastructure.

Some of these providers store data outside South Africa (currently in the EU and US). POPIA permits such transfers where the recipient is bound by comparable protections, which these providers commit to contractually.

5.1 Analytics and advertising on our website

Our own website (peakreviews.co.za) uses Google Analytics and the Meta (Facebook) pixel to measure visits and to show ads for PeakReviews to people who visited this site, plus Vercel Analytics and Cloudflare Insights (cookieless). These tools apply to visitors of our website only: the customer contacts you upload to PeakReviews are never shared with any advertising platform. You can opt out of Meta's ads in your Meta ad preferences, and of Google Analytics with Google's browser opt-out add-on.

6. Consent and opt-outs

Review requests may only be sent to customers who agreed to hear from the business. Consent is recorded per contact. Every message footer explains that replying STOP opts the customer out; opt-outs take effect immediately and permanently block further messages to that contact.

7. Retention and deletion

Data is kept while your account is active. Delete a contact and it is removed immediately. Close your account and all your data (business, contacts, requests, drafts) is deleted with it. Billing records are retained as required by tax law.

8. Security

Data is encrypted in transit (TLS) and at rest. Passwords are hashed, access to production systems is restricted, and API keys are stored outside the codebase. No system is perfectly secure; if a breach affects your data we will notify you and the Information Regulator as POPIA requires.

9. Your rights

Under POPIA you may request access to, correction of, or deletion of your personal information, and you may object to processing. Email us and we will respond within a reasonable time. If you are unhappy with how we handle it, you can complain to the Information Regulator (inforegulator.org.za).

10. Contact

Privacy questions and data requests: [email protected]. We will update this policy as the product evolves and note the effective date above.