Privacy Policy

Introduction

DoTell ("we," "us," or "our") operates the website at dotellreviews.com and provides a reputation management platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our Service.

By using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

Information We Collect

Information you provide directly

• Account information — When you register, we collect your email address, password, and optionally your first name, last name, and phone number.
• Business information — Business name, address, phone number, website URL, and social media profile links for businesses you add to the Service.
• Customer contact data — Names, email addresses, and phone numbers of your customers that you upload or enter into the Service for the purpose of sending review request campaigns.
• Communications content — The text of SMS and email messages sent through the Service, including campaign templates and follow-up messages.
• Team invitations — Email addresses of individuals you invite to join your business on the Service.

Information collected from third-party platforms

When you connect a review platform (Google Business Profile, Facebook), we collect:

• OAuth tokens — Authentication credentials that allow us to access your business data on the connected platform. These tokens are stored securely and are never shared with other parties.
• Review data — Reviewer names, profile photo URLs, star ratings, review text, and dates from your connected review platforms.
• Business listing information — Your business name, address, and location identifiers from connected platforms.

Information collected automatically

• Session data — We use session cookies to keep you logged in and remember your preferences (such as your last viewed business). These are essential cookies required for the Service to function.
• Log data — Our servers automatically record information including your IP address, browser type, referring URL, and the date and time of your request. This data is used for security and debugging purposes.

How We Use Your Information

We use the information we collect to:

• Provide the Service — Operate your account, manage businesses, send review request campaigns, and fetch reviews from connected platforms.
• Send communications on your behalf — Deliver SMS and email messages to your customers as part of review request campaigns that you create and authorize.
• Send service-related communications to you — Account verification emails, password reset emails, team invitation emails, and review notifications.
• Maintain and improve the Service — Monitor performance, diagnose technical issues, and develop new features.
• Protect security — Detect and prevent fraud, abuse, and unauthorized access.

We do not use your information to:

• Sell personal information to third parties
• Display advertising or share data with ad networks
• Build profiles of your customers for purposes unrelated to the Service

How We Share Information

We share personal information only in the following circumstances:

Service providers

We use third-party service providers to operate the Service. These providers process data on our behalf and are contractually obligated to use it only for the purposes we specify:

• Postmark or SendGrid — Email delivery provider based on your account configuration. Receives recipient email addresses and message content for campaign emails.
• Twilio — SMS delivery. Receives recipient phone numbers and message content for campaign text messages.
• Google — Review data access via Google Business Profile API. Receives OAuth tokens to fetch reviews on your behalf.
• Meta (Facebook) — Review data access via Facebook Graph API. Receives OAuth tokens to fetch page reviews on your behalf.

Legal requirements

We may disclose personal information if required to do so by law, or if we believe in good faith that such action is necessary to comply with a legal obligation, protect our rights or safety, or investigate potential violations of our terms.

Business transfers

If we are involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will notify you of any such change.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide you the Service. Specifically:

• Account data — Retained until you delete your account.
• Customer contact data — Retained for as long as the associated business account is active. You can delete individual contacts at any time.
• Campaign and message logs — Retained for as long as the associated business account is active to provide you with delivery history and reporting.
• Review data — Retained for as long as the associated business account is active. Reviews are also publicly available on the original platform.

After account deletion, we may retain certain data for up to 30 days in backups before it is permanently deleted. We may also retain anonymized, aggregated data that cannot be used to identify any individual.

Your Rights

All users

Regardless of where you are located, you have the right to:

• Access your personal information that we hold
• Correct inaccurate personal information via your account settings
• Delete your account and associated data by contacting us
• Export your data by contacting us

California residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know — You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete — You may request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Correct — You may request that we correct inaccurate personal information.
• Right to Opt-Out of Sale or Sharing — We do not sell or share (as defined by the CCPA/CPRA) your personal information. Because we do not sell your data, there is no need to opt out.
• Right to Non-Discrimination — We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise any of these rights, contact us at privacy@dotellreviews.com. We will respond to verifiable consumer requests within 45 days.

Categories of personal information collected (CCPA disclosure)

In the preceding 12 months, we have collected the following categories of personal information:

• Identifiers — Name, email address, phone number, IP address, account credentials.
• Commercial information — Transaction amounts and service descriptions (when received via API integrations).
• Internet or electronic network activity — Log data, session information, pages visited within the Service.

We have not sold personal information in the preceding 12 months. We have not shared personal information for cross-context behavioral advertising.

Data Security

We implement reasonable technical and organizational measures to protect personal information, including:

• HTTPS encryption for all data in transit
• Hashed passwords (never stored in plaintext)
• Two-factor authentication (TOTP) available for all accounts
• Role-based access controls for team members
• Session-based authentication with secure cookies

No method of electronic storage or transmission is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Your Customers' Data

When you upload customer contacts and send campaigns through our Service, you are the data controller for that customer data, and we act as a data processor on your behalf. This means:

• You are responsible for obtaining any necessary consent from your customers before adding them to the Service and sending them messages.
• You must comply with all applicable laws regarding commercial communications, including the CAN-SPAM Act (email) and the TCPA (text messages).
• We process your customers' data solely to provide the Service to you and do not use it for our own marketing purposes.

Third-Party Links and Services

The Service may contain links to third-party websites (such as Google Business Profile or Facebook). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

Children's Privacy

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy, want to exercise your rights, or have a privacy-related concern, please contact us at:

• Email: privacy@dotellreviews.com