Data Processing Addendum
This addendum governs our handling of personal information that we process on your behalf when you use RatingSentinel — the Business Profile data you authorize us to read, the review content within it, and the analysis we derive from it. It forms part of the Terms of Service and will apply automatically to every customer: it applies automatically when you accept the Terms of Service, and there is no separate document to request or agree to. It is published in advance so it can be read before anyone grants us access to a profile.
1. Definitions and precedence
"Customer Data" means personal information we process on your behalf under the Terms of Service, including Google Data. "Google Data" means information obtained from the Google Business Profile APIs on your authorization. "Sub-processor" means a third party we engage to process Customer Data. Terms such as "personal information", "business", "service provider", "sell" and "share" have the meanings given to them by applicable United States privacy law.
If this addendum conflicts with the Terms of Service as to Customer Data, this addendum prevails. The limitations of liability in section 17 of the Terms of Service apply to this addendum.
2. Roles
As to Customer Data, you are the business and we are the service provider (equivalently, you are the controller and we are the processor). We process Customer Data only on your documented instructions, which consist of the Terms of Service, this addendum, your configuration of the service, and the locations you choose to connect.
You are responsible for having the authority to connect each Business Profile and for the lawfulness of your instructions. If an instruction would conflict with applicable law, we will tell you instead of following it, and will pause the affected processing until we have agreed how to proceed.
Review content is published by members of the public on a platform operated by Google. Your rights in it arise from your own relationship with Google, and nothing in this addendum enlarges them.
3. Details of the processing
| Item | Detail |
|---|---|
| Subject matter | Providing review-health and sentiment analysis for the Business Profile locations you connect |
| Duration | The term of your subscription, plus the deletion windows in section 10 |
| Nature and purpose | Reading, caching, analyzing, scoring, aggregating, displaying and reporting. No writing to any Business Profile |
| Categories of personal information | Account and contact details of your personnel; reviewer display names; review text, ratings, timestamps and replies; location identifiers; derived scores, signals and sentiment counts |
| Categories of individuals | Your personnel who use the service; members of the public who have posted reviews on your connected locations |
| Sensitive information | None of the categories that US privacy laws define as sensitive is requested or required. Review text is free text and may contain whatever its author chose to write; we do not seek that out, index it, or use it for any purpose other than the analysis described here. OAuth tokens and account passwords are credentials: they are encrypted separately from everything else and handled as section 6 describes |
4. Our obligations as service provider
We will not:
- sell Customer Data, or share it for cross-context behavioral advertising;
- retain, use or disclose Customer Data for any purpose other than performing the service, or outside our direct business relationship with you;
- combine your Customer Data with personal information we hold for any other customer, or with personal information from any other source except the sources you ask us to connect on your behalf;
- use your Customer Data to train or improve any model, score or method that we then apply to another customer;
- use one customer's data to serve another, or pool Customer Data across customers for benchmarking, industry statistics or any other purpose.
We certify that we understand and will comply with these restrictions. Personnel with access to Customer Data are bound by confidentiality obligations that survive their engagement.
5. Google Data in particular
Google Data is subject to everything in section 4 and, in addition:
- It is used solely to provide the user-facing features visible in your dashboard and the reports you request.
- Everything we fetch from the Business Profile APIs — review text, reviewer display names, location details and performance metrics — is cached only to improve the performance of the application, for no more than 30 calendar days from fetch, and is then deleted automatically. We keep no permanent copy, index or archive of it.
- We hold a single scope, business.manage, and currently use it for read operations only.
- No human reads Google Data except: with your agreement, including when you ask us to look into something on your account; where it is necessary for security purposes, such as investigating abuse; to comply with applicable law; or where the data has been aggregated and is used for internal operations in accordance with applicable privacy and legal requirements.
- Our handling adheres to the Google API Services User Data Policy, including the Limited Use requirements, which are reproduced in section 6 of our Privacy Policy.
- We will never contact a reviewer, and the product provides no means for you to do so through us.
6. Security measures
| Control | Measure |
|---|---|
| Encryption | In transit (TLS) and at rest. OAuth tokens encrypted separately from application data |
| Tenant isolation | Every record scoped to the owning organization at the database layer by PostgreSQL row-level security |
| Verification of isolation | An automated suite attempts cross-tenant reads against every table on every build |
| Access control | Production access is limited to named individuals whose role requires it. Each has an individual account protected by multi-factor authentication; there are no shared logins. Access is logged, and it is removed when someone leaves or no longer needs it |
| Minimization | Review text sent to the sentiment sub-processor is stripped of reviewer names, location names and your identity |
| Backups | Encrypted; deleted data ages out within 7 days. The cache of Content fetched from the Business Profile APIs is held outside the backed-up database and is never captured in a backup |
| Restores | Any deletion already requested is re-applied before a restored system returns to service |
| Change management | All changes are tracked in version control and deployed from the main branch through an automated pipeline; nothing is edited directly on a running system. The automated test suite, including the tenant-isolation checks, must pass before a deploy proceeds. Database changes are applied as migrations, run against a staging environment first, and can be rolled back. Secrets are held in the hosting provider's secret store and never in source code |
We may update these measures, provided the level of protection is not reduced.
7. Sub-processors
By accepting these terms you agree to our use of the companies listed below.
We use each of them under their own published terms for business customers, including their data processing terms. We read those terms before adding a provider, and we do not use one whose terms conflict with what we have promised you here.
| Sub-processor | Purpose | Data involved | Location |
|---|---|---|---|
| Render | Application, database and queue hosting | All Customer Data | United States |
| OpenAI (gpt-4o-mini) | Aspect sentiment analysis | Review text only, stripped of reviewer names, location names and your identity. Not used to train OpenAI models; retained by OpenAI for up to 30 days for abuse monitoring | United States |
| Sentry | Diagnosing failures | Technical logs; no review content | United States |
| Resend | Service email and scheduled reports | Recipient name and email; report contents | United States |
| Stripe | Subscription billing | Billing contact and payment details | United States |
We will update this table and notify account holders by email at least 30 days before a new sub-processor begins processing Customer Data. If you reasonably object on data-protection grounds within that period, you may terminate the affected part of the service and receive a pro-rata refund of prepaid fees.
8. Requests from individuals
If one of your personnel contacts us about their own data, we will tell them we received the message and pass it to you, since the decision is yours.
Reviews are different. Google gives us only the display name shown on the review, and we have no way to confirm that someone contacting us wrote it. We will explain what we hold and for how long, but we will not change or remove review content on the strength of a claim we cannot verify, and we will not pass such a request to you, because that could identify a reviewer to the business they reviewed.
A review can be edited or deleted only by its author or by Google. Once it is removed there, it leaves our cache within 30 days without anyone needing to ask us.
We will help you answer any request you receive directly, at no charge.
9. Requests from authorities
If we receive a request from a government or law enforcement agency for Customer Data, we will not disclose it unless we are compelled by valid legal process. We will notify you before disclosing anything, so that you have the chance to challenge the request, unless we are legally barred from telling you. Where we are barred, we will tell you as soon as we are permitted to. Where we are able to, we will ask the agency to make its request to you directly rather than to us.
10. Security incidents
If Customer Data is lost, destroyed or altered, or is disclosed to or accessed by someone who should not have it, we will tell you. We will do that without undue delay, and in any event within 72 hours of becoming aware of it.
The notice will tell you what happened, when, which categories of data were affected and roughly how much, what the likely consequences are, and what we have done or plan to do about it.
If you then have to notify anyone — your own customers, your personnel, or a regulator — we will give you what you need for that, including answers to reasonable follow-up questions.
11. Deletion and return
| Event | What we delete | By when |
|---|---|---|
| Cached Google content ages out | Review text, reviewer display names, location details and performance metrics | 30 calendar days from fetch |
| You disconnect a location | That location's cached text, derived scores and signals; sync stops | 24 hours |
| You revoke access in your Google account | Token discarded; treated as a disconnection; you are notified | 24 hours of detection |
| Your subscription ends | Export window, then all Customer Data; our Google access is revoked | Export for 30 days, deletion within 7 business days after |
| You ask us to delete sooner | All Customer Data | 7 business days |
| Backups | Deleted data ages out of encrypted backups. Content fetched from the Business Profile APIs is never in them | 7 days |
A backup is a point-in-time snapshot of the whole database and cannot have one customer's rows removed from it. Deletion therefore happens immediately in the live system, and the deleted data remains only in encrypted backups until those backups expire on the rotation above. Backups are not used operationally, access to them is restricted, and if we restore from a backup we re-apply every deletion already requested before the system returns to service. The cache of Content fetched from the Business Profile APIs is excluded from backups entirely, so none of that Content is ever in a backup to begin with.
You can export your derived analysis from the dashboard at any time during the subscription. We retain no copy after the windows above, except records we are legally required to keep.
There is one exception. Review text already submitted to the sentiment sub-processor is held by that provider under its own retention policy — currently up to 30 days for abuse monitoring — and we cannot delete it on your instruction, because we do not hold it. It is not used to train models, and it is submitted stripped of reviewer names, location names and your identity.
12. Demonstrating compliance
On request, no more than once in any twelve-month period, we will provide the information reasonably necessary to demonstrate compliance with this addendum, including a completed security questionnaire and a description of our controls. If that is genuinely insufficient for your regulatory obligations, we will discuss an audit carried out by an independent assessor you appoint, at your cost, on reasonable notice, during business hours, and without access to other customers' data.
13. Location of processing
Customer Data is currently processed in the United States, and we do not make international transfers. If we begin serving customers in another country, or processing Customer Data outside the United States, we will update this addendum and notify you before we do so.
14. Term
This addendum takes effect when you accept the Terms of Service and continues until all Customer Data has been deleted in accordance with section 11. Sections 4, 5, 8, 9, 10, 11 and 12 survive termination for as long as we hold any Customer Data.
15. Contact
RatingSentinel
privacy@ratingsentinel.com