Privacy Policy

1.1 Information You Provide

We collect information that you provide when you:

• Create an account (name, email address, password, business information)
• Use our Service (customer data, review request templates, campaign settings)
• Contact us for support (email address, messages, and any information you choose to provide)
• Subscribe to our Service (billing information, payment details)

1.2 Automatically Collected Information

When you use our Service, we automatically collect certain information, including:

• Usage Data: How you interact with our Service, features used, pages visited, and time spent
• Device Information: IP address, browser type, operating system, device identifiers
• Log Data: Server logs, error reports, and diagnostic information
• Cookies and Tracking Technologies: We use cookies and similar technologies to track activity and store preferences

3.1 Service Providers

We may share information with third-party service providers who perform services on our behalf, such as:

• Payment processing (Stripe)
• Email delivery services (Resend)
• SMS messaging services (Twilio)
• Cloud hosting and infrastructure (Vercel, Supabase)
• Analytics, advertising and conversion measurement (Google Analytics, Google Ads, Meta) — see Section 6

These service providers are contractually obligated to protect your information and may only use it for the purposes we specify.

3.2 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

3.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas).

3.4 Protection of Rights

We may share information when we believe it is necessary to protect our rights, property, or safety, or that of our users or others.

3.5 With Your Consent

We may share your information with your explicit consent or at your direction.

5.1 Google

We use Google in two separate ways. They are independent — using one does not grant us access to the other.

Sign in with Google (authentication)

If you create or access your StarFlywheel account using "Sign in with Google", we receive your name, email address, profile picture, and Google account identifier. We use this solely to create and authenticate your StarFlywheel account. We do not receive your Google password, and we cannot access your Gmail, Drive, Contacts, Calendar, or any other Google service through this sign-in.

Google Business Profile (review management)

If you connect a Google Business Profile, you grant StarFlywheel the https://www.googleapis.com/auth/business.manage scope through Google's OAuth 2.0 consent screen. You choose which locations to connect, and you may connect none.

With this authorization we access:

• Your Business Profile accounts and locations — so you can select which locations to manage in StarFlywheel. We store the location identifier, business name, and address.
• Reviews on the locations you connect — review text, star rating, reviewer display name, timestamp, and any existing reply. We store these so your dashboard can display review history, calculate rating trends, and alert you to new reviews.
• The ability to publish replies you write — when you write a reply in StarFlywheel and choose to publish it, we send that reply to Google on your behalf. We never generate, edit, or publish a reply without you initiating it.

We do not access, and the authorization does not permit us to access, your Gmail, Google Drive, Google Ads, Google Analytics, or Google Search Console data.

How we store and protect it. Your Google OAuth refresh token is stored encrypted at rest and is used only to make API requests on your behalf. Review data is stored in our production database in the United States, protected by the measures described in the Data Security section.

How we use it. Google user data is used only to provide the review management features you signed up for — displaying reviews, notifying you of new ones, tracking rating trends over time, and publishing replies you write. We do not use Google user data to serve advertising, and we do not sell it.

Limited Use disclosure. StarFlywheel's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Human access. Google user data is not read by StarFlywheel personnel except in these narrow cases: with your explicit permission (for example, when you ask us to troubleshoot a problem with your account), where necessary for security purposes such as investigating abuse, or where required by law.

How to disconnect. You can disconnect a Google Business Profile at any time in StarFlywheel under Settings → Locations. You can also revoke StarFlywheel's access directly at myaccount.google.com/permissions. Disconnecting stops all future access immediately. To also delete the review data we have already stored, see our Data Deletion page.

5.2 Meta (Facebook)

We use Meta in one way only: as a sign-in option. StarFlywheel does not currently offer a Facebook Page or Instagram connection, and we do not read, post, or manage content on any Facebook Page or Instagram account.

Sign in with Facebook (authentication)

If you create or access your StarFlywheel account using "Continue with Facebook", we request the email and public_profile permissions through Facebook Login. From these we receive your name, email address, profile picture, and Facebook account identifier. We use this solely to create and authenticate your StarFlywheel account.

We never receive your Facebook password. This sign-in does not let us see your friends, posts, messages, photos, or ad accounts, and it does not let us post to Facebook on your behalf. We do not sell this information.

When you register through Facebook, a one-way (SHA-256) hash of your email address is included in the conversion events described in Section 6. The advertising platforms listed there receive that hash, never your address in readable form, and only where you have accepted advertising cookies.

You can revoke StarFlywheel's access at any time under Facebook Settings → Apps and Websites. Because this is how you sign in, revoking it removes your ability to log in with Facebook but does not delete your StarFlywheel account or its data. To delete those as well, see our Data Deletion page.

5.3 Review Platform Data from Public Sources

For review platforms where no official API is available to us, StarFlywheel may retrieve publicly visible review information — such as star ratings, review text, and reviewer display names as they appear publicly — through third-party data providers. This applies only to business profiles you have explicitly added to your StarFlywheel account. We do not collect personal information about reviewers beyond what is publicly displayed alongside their review on the platform itself.

Access and Portability

You can access and download your personal information through your account settings or by contacting us.

Correction

You can update your account information at any time through your account settings.

Deletion

You can delete your account and personal information at any time. See our Data Deletion page for step-by-step instructions, what gets deleted, and how long it takes. We honor deletion requests subject to the legal retention obligations described in the Data Retention section.

Opt-Out

You can opt out of marketing communications by clicking the unsubscribe link in our emails or by contacting us.

SMS Communications. If a business sends you SMS review requests through StarFlywheel, you can opt out at any time by replying STOP to any message. You may also reply HELP for more information. Once you opt out, your consent status is automatically updated and you will not receive further text messages from that business through our platform. Businesses can also manually update your SMS consent status in their customer management dashboard. Standard message and data rates may apply. For more details, see our SMS Consent & Compliance page.

Do Not Track

Our Service does not respond to "Do Not Track" signals. However, you can control cookies through your browser settings.