Privacy Policy

1. Introduction

This Privacy Policy explains how Review Boosters (hereinafter “we”, “us”, or the “Provider”), the operator of the website https://review-boosters.org, collects, uses, discloses, and protects personal data in connection with the Website and the review-solicitation and reputation-marketing services we provide (the “Services”). The Provider is operated from Georgia by an individual entrepreneur registered with the LEPL National Agency of Public Registry; full legal-entity details (registered name, identification number, and registered address) are disclosed on written request to [email protected], or where required by Applicable Law to a competent supervisory authority.

This Policy is written to comply with the Law of Georgia on Personal Data Protection (adopted 14 June 2023, in force from 1 March 2024), Regulation (EU) 2016/679 (“GDPR”) where applicable, the UK Data Protection Act 2018 and UK GDPR where applicable, and the California Consumer Privacy Act as amended by the CPRA (“CCPA/CPRA”) where applicable.

Please read this Policy carefully. If you do not agree with it, you must not use our Services.

2. Data controller

The data controller responsible for your personal data is:

• Review Boosters, the operator of https://review-boosters.org.
• Operator status: an individual entrepreneur registered in Georgia with the LEPL National Agency of Public Registry. Full legal-entity details are disclosed on written request to the contact email below or, where required by Applicable Law, to a competent supervisory authority.
• Contact email (general and privacy): [email protected]

We have not appointed a Data Protection Officer, as we do not meet the thresholds set out in Article 37 GDPR or Article 33 of the Law of Georgia on Personal Data Protection. For questions about this Policy or about how your personal data is handled, please contact us at the address above.

3. Our role: controller or processor?

Depending on the category of personal data, we act in one of two capacities:

• Controller — for personal data of visitors to our Website, of our Clients (including their representatives and account holders), and of people who contact us directly. This Policy describes that processing in full.
• Processor — for personal data that our Clients upload to the Services about their own End Customers (typically name, email address, phone number, order reference, language). In that case the Client is the controller, and we process that data only on the Client’s documented instructions under the Data Processing Addendum incorporated into our Terms of Service. If you are an End Customer and wish to exercise your rights, please contact the business that invited you to leave a review; we will assist that business as required by law.

4. Personal data we collect

4.1 Information you provide directly

• Account data: full name, business name, email address, phone number, billing address, tax or VAT identification number, position/role.
• Authentication data: password (stored only as a salted hash), two-factor-authentication tokens.
• Payment data: we do not store full card numbers, bank account numbers, or other sensitive payment credentials. Payments are processed by Keepz, a payment service operated by JSC Credo Bank (Georgia); we receive only confirmation of a successful payment, the masked or tokenised payment-instrument reference, and the metadata necessary to allocate the payment to your account (date, amount, currency, transaction ID).
• Communications: messages you send us via email, chat, support tickets, or forms, including any attachments.

4.2 Information collected automatically

• Technical data: IP address, browser type and version, device identifiers, operating system, approximate geolocation derived from IP, referring URL, time zone, and language preferences.
• Usage data: pages viewed, features used, click paths, session duration, campaign performance metrics.
• Cookies and similar technologies: see Section 10.

4.3 Information we receive from third parties

• Review Platforms: when you connect your Trustpilot, Reviews.io, Google, or similar account, we receive account identifiers, API tokens, and review data.
• Payment providers: confirmation of successful payment, basic KYC signals.
• Analytics and fraud-prevention vendors.

4.4 Data we do NOT intentionally collect

We do not intentionally collect special categories of personal data within the meaning of Article 9 GDPR (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data). Please do not upload such data to the Services.

5. Why we process personal data and our legal basis

Under GDPR and the Law of Georgia on Personal Data Protection, we must have a lawful basis for each processing activity. The table below summarises the main purposes, the data used, and the lawful basis we rely on.

Where we rely on legitimate interests, we have conducted a balancing test and concluded that our interests do not override your fundamental rights. You have the right to object to such processing at any time (see Section 9).

6. Who we share personal data with

We share personal data only with the following categories of recipients, always under appropriate contractual safeguards:

• Sub-processors and service providers: cloud hosting, email delivery (e.g. SendGrid, operated by Twilio Inc.), SMS delivery, analytics, customer-support tooling, error-monitoring, and payment processing (Keepz, operated by JSC Credo Bank, Georgia). A current list of sub-processors is available at https://review-boosters.org/subprocessors.
• Review Platforms: when you or your Client instruct us to submit invitations or publish Reviews to Trustpilot, Reviews.io, Google, or similar platforms.
• Professional advisers: lawyers, accountants, auditors, insurers, under duties of confidentiality.
• Public authorities: where disclosure is required by a binding court order or statutory obligation (tax authorities, the Personal Data Protection Service of Georgia, law-enforcement agencies acting on a lawful basis).
• Purchasers in a corporate transaction: if we undergo a merger, acquisition, or sale of assets, personal data may be transferred, subject to the acquirer continuing to honour this Policy or giving you notice.

We do not sell personal data, and we do not “share” personal data for cross-context behavioural advertising within the meaning of the CCPA/CPRA.

7. International data transfers

Georgia is recognised by the European Commission as having its own comprehensive data-protection framework. Where personal data is transferred from the European Economic Area, the United Kingdom, or Switzerland to Georgia or to any other country that does not benefit from an adequacy decision, we rely on one or more of the following safeguards:

• Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), together with the UK Addendum where applicable;
• an adequacy decision, where available;
• supplementary technical, contractual, and organisational measures, based on a transfer-impact assessment.

You may request a copy of the relevant safeguards by contacting us at [email protected].

8. How long we keep personal data

We retain personal data only as long as necessary for the purposes for which it was collected, including to comply with legal, accounting, or reporting requirements. Typical retention periods:

• Account data: for the duration of your subscription plus up to twenty-four (24) months after termination.
• Billing and invoicing records: six (6) years, in line with Georgian tax and accounting legislation.
• Support communications: up to thirty-six (36) months after the last interaction.
• Server logs and technical data: up to twelve (12) months.
• Marketing-consent records: until you withdraw consent plus three (3) years for evidentiary purposes.
• End Customer personal data (processed on behalf of a Client): for the duration of the Client’s contract with us, plus up to thirty (30) days after termination, unless the Client requests earlier deletion.

Where data is no longer needed, we either delete it securely or anonymise it so that it can no longer be linked to you.

9. Your rights

Subject to the conditions of Applicable Law, you have the following rights:

• Right of access — to obtain confirmation of whether we process your personal data and, if so, to receive a copy.
• Right to rectification — to have inaccurate or incomplete data corrected.
• Right to erasure (“right to be forgotten”) — to have your data deleted where one of the grounds in Art. 17 GDPR / Art. 14 of the Georgian Law applies.
• Right to restriction of processing — to limit how we use your data in certain circumstances.
• Right to data portability — to receive your data in a structured, commonly used, machine-readable format.
• Right to object — including to processing based on legitimate interests and to direct marketing (an absolute right in the latter case).
• Right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects.
• Right to withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.
• Right to lodge a complaint with a supervisory authority (see Section 13).

California residents additionally have the rights to know, to delete, to correct, to opt out of sale/sharing, and to non-discrimination under the CCPA/CPRA. Because we do not sell or share personal data for cross-context behavioural advertising, no opt-out is required for that purpose.

To exercise any of these rights, contact us at [email protected]. We will respond within thirty (30) days, extendable by up to sixty (60) days for complex requests. Exercising your rights is free of charge unless the request is manifestly unfounded or excessive.

10. Cookies and similar technologies

Our Website uses the following categories of cookies and similar technologies:

• Strictly necessary cookies — essential to operate the Website (authentication, load balancing, security). These do not require consent.
• Analytics cookies — help us understand how visitors use the Website (e.g. Google Analytics 4, operated by Google Ireland Limited). Set only with your consent.
• Functional cookies — remember preferences such as language. Set only with your consent.
• Marketing cookies — used to measure the effectiveness of our advertising. Set only with your consent.

When you first visit the Website, you can accept or reject non-essential cookies through our cookie banner. You can change your preferences at any time via https://review-boosters.org/cookie-settings or by adjusting your browser settings. Rejecting non-essential cookies does not affect your ability to use the Services.

11. How we protect personal data

We implement technical and organisational measures appropriate to the risk, including:

• encryption in transit (TLS) and at rest for sensitive data;
• access controls, least-privilege principles, and multi-factor authentication for privileged accounts;
• regular backups and disaster-recovery testing;
• vulnerability monitoring, logging, and incident-response procedures;
• contractual obligations of confidentiality for personnel and sub-processors.

Despite these measures, no method of transmission or storage is completely secure. If we become aware of a personal-data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within seventy-two (72) hours and, where legally required, inform affected individuals without undue delay.

12. Children

The Services are intended for business users only and are not directed at children under the age of sixteen (16). We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us and we will promptly delete it.

13. Complaints and supervisory authorities

If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with a supervisory authority, in particular:

• Personal Data Protection Service of Georgia — personaldata.ge — [email protected] — +995 32 2 421 000.
• If you are in the EEA — the data-protection authority of your country of residence or place of work. A list is available at edpb.europa.eu.
• If you are in the United Kingdom — the Information Commissioner’s Office (ICO) — ico.org.uk — +44 303 123 1113.

14. Automated decision-making and profiling

We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing. We may use automated rules to detect fraud or abuse; any resulting action (for example, suspension of an account) is subject to human review upon request.

15. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or Applicable Law. The “Last updated” date at the top shows when it was last changed. If we make material changes, we will notify you by email or a prominent notice on the Website at least fifteen (15) days before they take effect.

16. Contact

Questions, requests, and complaints regarding this Policy should be sent to:

• Review Boosters
• Email: [email protected]
• Website: https://review-boosters.org
• Operator: an individual entrepreneur registered in Georgia. Full legal-entity details are disclosed on written request to the contact email above.