This privacy policy explains how the Kiyoh Review Manager application collects, uses, stores, and protects data when you connect your review and social channels. It describes the data we process, why we process it, how long we keep it, and how you can revoke access or request deletion.
1. Google My Business data
When you connect your Google My Business account through Google OAuth, the application requests permission to read and reply to your business reviews. The OAuth access token and refresh token we receive are stored encrypted in our database. We use these tokens to sync your Google My Business review data, which is then stored and displayed inside the application so you can read and respond to reviews.
2. Google API Services Limited Use disclosure
The Kiyoh Review Manager application's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only use Google user data to provide and improve the review management features you have requested, and we do not transfer or use this data for advertising, sell it, or use it for any purpose unrelated to the application's review management functionality.
3. Facebook data
When you connect your Facebook account through Facebook OAuth, we access data through the Facebook Graph API. This includes Facebook Page access tokens, which are stored so the application can read and reply on your behalf, and your Facebook reviews and recommendations, which are stored and displayed inside the application.
4. AI sub-processing (OpenAI)
To generate suggested review responses and to analyze review sentiment, the application sends review content to OpenAI as a third-party sub-processor. This data is processed only to return AI-generated responses and analysis to you. Review content sent to OpenAI is not used to train OpenAI's models.
5. Account data
For each business user we store account data needed to authenticate you and operate the application. This includes your email address, a securely hashed password, and login timestamps.
6. Review invite data
When you send review invitations to your customers, we process the contact data required to deliver those invitations. This includes your customers' email addresses and names.
7. Social mention data
To help you track your online reputation, the application collects publicly available social mention data about your business from Instagram, Twitter, LinkedIn, Trustpilot, and Hellopeter.
8. Data retention and deletion
We retain data for as long as your account or the relevant integration remains active. We do not run automatic expiry, and retention is therefore based on the lifecycle of your account and integrations:
- Google and Facebook OAuth tokens are removed when you disconnect the relevant integration on the Settings page.
- Facebook reviews are deleted immediately when you disconnect the Facebook integration.
- Google My Business review data is retained until you delete your account or send us an emailed deletion request. Disconnecting Google My Business clears your tokens but does not remove previously synced review data.
- Account data, review invite data, and social mention data are retained until you delete your account or send us an emailed deletion request.
To request deletion of any of your data, email us at [email protected].
9. Revoking access
You can revoke the application's access to your connected accounts at any time. From inside the application, open the Settings page and use the Disconnect button on the relevant integration card (Google My Business or Facebook).
You can also revoke access directly with the provider, independently of the in-app disconnect. For Google, visit your Google Account permissions page and remove the application's access. For Facebook, open your Facebook Business Integrations settings and remove the application.
10. Contact
For any privacy inquiries, contact us at [email protected].