Privacy Policy

For your account details (name, email, workspace, billing), we decide how the information is used and are responsible for it.

For data we import from your store accounts, including reviews written by people who use your apps, we act on your behalf as a service provider (a “processor” under GDPR). Our Data Processing Agreement covers that data. People who left a review of your app should contact you, the app developer, about it.

• Account: your name, email address and password (stored as a secure hash by our sign-in provider).
• Workspace and team: workspace name, team members' names, email addresses and roles, and invitations.
• Store credentials: your App Store Connect API key (issuer ID, key ID, private key, vendor number, app ID) and your Google Play service-account key. Keys are encrypted and can only be read by our servers.
• Store data: what Apple and Google provide for your app: downloads, installs, uninstalls, sessions, crashes, ratings, sales and subscription reports, finance reports, and customer reviews. Reviews include the reviewer's public nickname, country, rating and text.
• Billing: plan and subscription status, and a Stripe customer reference. Stripe holds your card details; we never see or store them.
• Technical: server logs kept by our hosting provider, including IP address, browser and the pages requested, used to run and secure the service.

• To sync your store data, calculate metrics and show your dashboards.
• To send emails you need: sign-in, password reset, team invitations and billing notices.
• To bill your subscription.
• To keep the service secure, investigate problems and answer support requests.

We do not sell personal information, use it for advertising, or combine your store data with other customers' data to build benchmarks.

On the Pro plan, ReveIQ writes a daily summary of your app's numbers and, when you ask, plain-language explanations of your store reports, using DeepSeek's language model. We send DeepSeek aggregated metrics only: counts, rates, averages and dates, broken down by labels such as app version, device model, Android or iOS version and country. We do not send names, email addresses, review text, reviewer details or credentials. DeepSeek processes this data in the People's Republic of China. AI summaries are not available on the Free plan.

We use these service providers to run ReveIQ. Each only receives what it needs for its purpose.

We also disclose information when required by law, to protect our rights or users' safety, or as part of a merger or sale of the business, in which case this policy continues to apply.

Our database is in Canada. Data is also processed in the United States by our hosting, billing and email providers, and aggregated metrics are processed in China for AI summaries. Where the law requires it, we rely on contractual safeguards such as Standard Contractual Clauses for these transfers.

Data is encrypted in transit (TLS). Store keys are encrypted at rest and can only be read by our servers. Each workspace's data is isolated by database access rules, and only owners and admins can disconnect stores or delete data. No system is perfectly secure; we will notify you of a breach affecting your data as the law requires.

• Account and workspace data: while your account is open.
• Store data and keys: until you disconnect the store or use Delete all data in Settings, which removes them immediately from the live database.
• Closing your account: email us and we delete your account and workspace within 30 days.
• Deleted data may remain in encrypted backups until those backups expire.
• Billing records: as long as tax and accounting law requires.

Depending on where you live (including under Canada's PIPEDA, the EU and UK GDPR, and US state laws such as the CCPA), you can ask to access, correct, delete or export your personal information, withdraw consent, or object to how we use it. Email harin.shah@outofbox.solutions; we reply within 30 days. You can also complain to the Office of the Privacy Commissioner of Canada or your local data protection authority.

We use cookies that keep you signed in and remember which store you last viewed, and your browser's local storage for display preferences such as collapsed sections. We do not use advertising or analytics cookies.

ReveIQ is a business tool and is not intended for anyone under 16.

We will post changes here and update the date above. For significant changes, we will also email account owners before they take effect.

Out of Box Solutions, operator of ReveIQ. Privacy questions and requests: harin.shah@outofbox.solutions.