Template — pending legal review. Last updated: October 11, 2026.

Privacy Policy

This Privacy Policy explains how Voltaire Innovations, Inc., a Delaware corporation with its registered business address at 390 NE 191st St STE 17414, Miami, FL 33179, USA (“we”, “us”), collects, uses and shares information when you use Review Expert, available at review.expert (the “Service”). Review Expert helps teams collect reviews of their own apps from the Apple App Store and Google Play, reply to them, and route them to tools such as Slack, Linear, Microsoft Teams, Zendesk and webhooks.

If you have questions, contact us at hello@review.expert or by mail at Voltaire Innovations, Inc., 390 NE 191st St, STE 17414, Miami, FL 33179, USA. For account data and website data we are the controller; for review data and other content we process on behalf of our customers we act as a processor (see section 3 and our Data Processing Agreement).

1. Information we collect

Information you provide

Account information: your email address, which we use to sign you in with a one-time code, and optional profile details such as your name.
Team data: team and workspace names, the members you invite (their email addresses and roles), the apps you connect, and your settings, such as destinations, filters and reply rules.
App store credentials: the credentials you give us so we can read and reply to reviews on your behalf, such as an App Store Connect API key (issuer ID, key ID and private key) and a Google Play service account, plus the Google Cloud Storage location of your Play Console review exports.
Destination connections: OAuth access and refresh tokens, workspace or channel identifiers, and webhook URLs for the destinations you connect (for example, Slack, Linear, Microsoft Teams or Zendesk).
Replies and content: review replies you write or edit in the Service, and messages you send to us.

Information we get from third parties at your direction

Review data: reviews of your apps that we fetch from Apple and Google using the credentials you provide. These include review text, title, star rating, date, territory or language, app version, the reviewer’s public nickname or display name where the store provides it, and existing developer responses.
Billing information: payments are processed by Stripe. We receive information such as your plan, subscription status, billing contact details, country and tax information from Stripe, Inc. and its affiliates, who act as an independent controller for payment data under their own privacy policy. We never receive or store your full card number.

Information collected automatically

Usage and log data: IP address, browser and device information, pages visited, actions taken in the Service, timestamps, and error and diagnostic logs, including logs of sync jobs and deliveries to destinations.
Cookies: see “Cookies” below.

2. How we use information

To provide the Service: sign you in, sync your reviews, show dashboards, post your replies to Apple and Google, and deliver reviews to the destinations you configure.
To manage subscriptions, trials and billing.
To secure the Service, prevent abuse and debug problems.
To communicate with you about your account, service changes and support requests, and, where permitted, product updates you can opt out of.
To understand how the Service is used and improve it.
To comply with law and enforce our Terms of Service.

We do not sell your personal information, and we do not use your review data or store credentials to advertise to you. We use store credentials only to call the official Apple and Google APIs on your behalf.

AI features. Where you use AI-assisted features (for example, reply drafts, summaries or classification), we send the relevant review text and context to our AI model provider to generate the output. We do not use your content to train our own models, and we use providers whose terms do not permit them to train their models on data sent through their API. AI output may be inaccurate; you are responsible for reviewing it before publishing.

3. Legal bases (EEA/UK users)

Where the EU GDPR or UK GDPR applies, we process personal data: to perform our contract with you (Art. 6(1)(b)) – providing the Service, accounts and billing; for our legitimate interests (Art. 6(1)(f)) – securing, debugging and improving the Service and sending service-related and limited product communications; to comply with legal obligations (Art. 6(1)(c)) – for example tax and accounting records; and with your consent (Art. 6(1)(a)) where required, such as for non-essential cookies or marketing, which you can withdraw at any time. For review data about your app’s users, you are the controller and we act as your processor under our Data Processing Agreement.

4. How we share information

We share information only as needed to run the Service:

Hosting, database and authentication: Hetzner Online GmbH, which hosts our servers, including our self-hosted Supabase (Postgres) database and authentication, in data centers in the EU (Germany or Finland).
Payments: Stripe, as our payment processor, for checkout, subscriptions, invoices, tax calculation and fraud prevention.
AI provider: Anthropic (Claude), in the United States, which processes review text you choose to use with AI features. OpenAI may be used as an alternative provider only where that option is enabled.
Email delivery: sign-in codes are sent by our self-hosted Supabase Auth; other service emails are sent over SMTP through Resend (US), our planned transactional email provider.
Destinations you connect: Slack, Microsoft, Zendesk, Linear or your webhook endpoints receive review content you choose to route to them. These are recipients chosen by you, and their own terms and privacy policies apply once data reaches them.
Apple and Google: we call their APIs with your credentials to read reviews and post your replies.
Legal and safety: when required by law, or to protect the rights, property or safety of our users, us or others.
Business transfers: in connection with a merger, acquisition or sale of assets, subject to this policy.

Our current subprocessors are Hetzner Online GmbH (hosting, database and authentication, EU), Stripe (payments), Anthropic (AI features, US), OpenAI (alternative AI provider, US, only where enabled) and our transactional email provider, Resend (US, planned). An up-to-date list, including locations, is available on request at hello@review.expert, and we will notify customers of new subprocessors as described in our Data Processing Agreement.

5. Data retention

We keep account, team and review data for as long as your account is active. If you disconnect an app or destination, we stop using the related credentials or tokens and delete them within 30 days. After you delete your team or close your account, we delete or anonymize your data within 30 days, and backups are overwritten within a further 30 days. Usage and log data is kept for up to 90 days unless needed to investigate a security incident. Billing and invoice records are kept for as long as tax and accounting law requires (generally up to 6 years for Spanish and 7 years for US purposes).

6. Security

We use reasonable technical and organizational measures to protect your data. Our servers, database and authentication are hosted by Hetzner in the EU (Germany or Finland), our database uses row-level security that isolates each team’s data, and traffic is encrypted in transit with HTTPS/TLS. Store credentials and access tokens are stored encrypted, and access is limited to what is needed to operate the Service. No method of transmission or storage is completely secure, and we do not currently hold third-party security certifications. Please tell us about suspected vulnerabilities at hello@review.expert.

7. Your rights and choices

EEA/UK. You have the right to access, correct and delete your personal data, to receive it in a portable format, to restrict or object to processing (including at any time to direct marketing), to withdraw consent, and not to be subject to decisions based solely on automated processing with legal or similarly significant effects (we make no such decisions).

California and other US states. California residents have rights under the CCPA/CPRA to know what personal information we collect, use and disclose, to delete and correct it, to limit use of sensitive personal information, and not to be discriminated against for exercising those rights. In the past 12 months we collected the categories described in section 1 (identifiers, commercial information, internet activity and professional information) for the purposes in section 2, and disclosed them to service providers for business purposes only. We do not sell or “share” personal information for cross-context behavioral advertising. You may use an authorized agent. Residents of other US states with comparable laws have similar rights.

To make a request, email hello@review.expert. We may need to verify your identity. We respond within one month (EEA/UK) or 45 days (California), which may be extended where the law allows. If we process data on behalf of one of our customers (for example, review data about an app’s users), we will refer your request to that customer. You may also lodge a complaint with your local data protection authority, such as the Spanish Agencia Española de Protección de Datos (aepd.es).

8. Cookies

We use cookies and similar technologies that are needed to keep you signed in, remember preferences such as theme and selected plan, and keep the Service secure. If we add analytics or marketing cookies, we will update this policy and ask for consent where required. You can control cookies in your browser settings, but blocking essential cookies will prevent sign-in.

9. International transfers

We are a US company operated from Spain. Our primary hosting is in the EU (Germany or Finland), but some providers, such as Stripe, Anthropic (and OpenAI where enabled) and destinations you connect, may process data in the United States and other countries. For transfers outside the EEA/UK, we rely on the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission’s Standard Contractual Clauses (and the UK Addendum) together with supplementary measures where needed.

10. Children

The Service is a business tool and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and update the “Last updated” date, and we will notify account owners by email of material changes.

12. Contact

Voltaire Innovations, Inc.
390 NE 191st St, STE 17414, Miami, FL 33179, USA
hello@review.expert