Privacy policy

1. Who we are

ReviewFount is a review collection and Google Profile Optimization service of CALENDAR CUT SOFTWARE, operated by Pardeep Dhaliwal, an Australian sole trader (ABN 14 749 474 221). In this policy, “we”, “us” and “our” mean the operator of ReviewFount. Contact us at [email protected] about this policy or your information.

This policy explains how we handle information on our website, in business accounts and in review invitations. A business using ReviewFount has its own responsibility to tell its customers how it uses their information. We do not act as Google or control information posted on Google.

2. Information we collect

When you enquire or create an account, we collect information you provide, such as your name, email address, business, phone number, industry and message. For a business account, we also store authorised users, business details, location, time zone, branding, Google profile links and account settings.

A business may provide customer names, contact details, completed event information and records of permission to send invitations. We record the source and status of that permission, opt-outs and the history of review requests. Please do not include health information, payment card numbers or other sensitive material in imports or feedback.

For billing, we record business-linked Stripe customer and subscription identifiers, invoice amounts and statuses, payment dates and your billing choices. Stripe’s hosted pages collect and process payment method details. We do not receive or store full card numbers or card security codes.

If you follow an invitation link, we process a secure invitation identifier. If you choose to submit private feedback, we collect the rating, comment and contact permission you submit. We also process technical information needed to run and protect the service, such as IP address, browser information, timestamps, error logs and security events.

3. How we use information

We use information to answer enquiries, authenticate users, operate accounts, provide the agreed services, schedule permitted invitations, honour opt-outs, deliver reports and support customers. We also use necessary records to investigate failures, prevent misuse, maintain security and meet legal obligations.

An email delivery event or an explicit click may be recorded to explain what happened to an invitation. A click on a Google link does not prove a Google review was posted. We do not claim to identify a new Google review from a click alone.

We do not sell customer contact lists. We do not use private review journey visitors to create advertising audiences by default. Optional news or promotional email requires a separate choice and includes a way to unsubscribe.

4. Business customers and their contacts

The business providing a contact record is responsible for having an appropriate basis and any required permission to use that information. A purchase, receipt or uploaded list does not automatically provide consent to send messages. ReviewFount records permission and applies suppression controls; these do not replace the business’s own obligations.

A private response or feedback submission is visible to authorised people at the business and authorised ReviewFount personnel where needed to provide support. It is not posted to Google. We store a thumbs up or thumbs down as a positive or negative response, separately from any older star ratings. The response determines whether the next step offers private feedback or a Google review link.

If an invitation came from a business you recognise, you can contact that business about the underlying purchase or service. You may also contact us to raise concerns about the use of ReviewFount or request that review messages stop.

5. Service providers and overseas processing

We use providers for hosting, database and authentication, email delivery, and SMS where enabled. Our current infrastructure includes Vultr, Supabase, Resend and Cloudflare. Mobile Message may provide SMS for accounts where that channel has been configured. Where online billing is used, Stripe processes hosted checkout, subscriptions, invoices and payments under its own privacy policy at stripe.com/privacy. We disclose only information reasonably needed for each provider’s role.

Some processing or support access may occur outside Australia. Our database project is configured in Sydney, hosting is configured in Melbourne and the email sending domain is configured in the provider’s Tokyo region. Those selections are not a promise that every provider log, backup, network route or support activity stays in that region. Provider arrangements may change as the service develops.

Google receives information under its own policies when you choose to visit Google or use a connected Google feature. We do not ask you to give us your Google password. Authorised Google data is used only for the features and permissions agreed with the business.

6. Cookies and browser storage

We currently use essential cookies and browser storage for authentication, security, theme choice and your cookie preference. These help the website function as designed. We do not currently use marketing cookies.

“Accept all” and “Necessary only” therefore currently permit the same essential storage. Closing the notice does not give permission for optional tracking. You can reopen Cookie preferences in the footer. If optional cookies are introduced, they will be subject to the appropriate notice and consent controls before use.

If you open Stripe’s separate hosted billing pages, Stripe may use cookies or similar technologies under its own policies. We do not load Stripe payment forms or marketing trackers into our public website.

You can block or delete cookies in your browser. Doing so may sign you out or stop parts of the website from working.

7. Security and access

We use access controls, encrypted connections and other practical safeguards appropriate to the service. Accounts are separated by business, with access based on the user’s role. No internet service can guarantee absolute security.

Keep your sign-in details private, use a unique password and remove staff access when it is no longer needed. Tell us promptly if you suspect your account has been accessed without permission.

8. Retention, deletion and opt-outs

We retain information for the service, account administration, security, dispute handling and applicable legal obligations. The period depends on the type of record and why it is needed. We do not promise that deleting a visible record instantly removes every backup or legally required record.

When a contact is erased, identifying details are removed where appropriate, pending outreach is cancelled and invitation access is revoked. We may retain limited suppression evidence so a future import does not accidentally restart messages. These limited records are used for compliance rather than further outreach.

Review invitations include an unsubscribe route. Opening that page does not change your choice; the explicit confirmation action applies the opt-out. Businesses cannot override an opt-out simply by importing the same address again.

9. Your choices and requests

You can ask to access or correct information we hold about you, raise a concern or request deletion by emailing [email protected]. We may need proportionate identity information to protect your information. We may also direct a request to the relevant business where it controls the underlying record.

If a request cannot be completed, we will explain the reason where appropriate. If you are unhappy with how we handle a privacy concern, you can contact the Office of the Australian Information Commissioner at oaic.gov.au. Your available rights depend on the applicable law and circumstances.

10. Changes to this policy

We may update this policy as the service or legal requirements change. The version and update date appear on this page. Material changes will be communicated through an appropriate channel.