Privacy Policy
This page describes how ReviewFlow currently works. Unconfirmed information is explicitly marked for validation before commercial use.
Provisional Early Access draft — not a final document or a declaration of legal compliance. “To confirm” and “To validate” items must be resolved before starting personal-data processing. Free use does not remove these obligations.
Responsibility and contact
ReviewFlow is the service brand, not the identity of a confirmed company. Contact: reviewflow.geral@gmail.com. To confirm before collecting personal data: the controller’s full name or legal name, contact details and an appropriate address for notices. No incorporated company, business tax number, activity code or tax registration is assumed. A natural person can be a controller; the actual identity must be confirmed. Tax details and business obligations require a separate assessment.
ReviewFlow and restaurant roles
To validate for each purpose: the restaurant may be controller for feedback it solicits to manage its establishment; ReviewFlow may be processor when acting exclusively on its instructions. The ReviewFlow operator may be an independent controller for commercial enquiries and account management. These roles are not definitively assigned: actual decisions about purposes and means determine them. Where processing on the restaurant’s behalf occurs, conclude a binding GDPR Article 28 agreement before that processing. The restaurant must identify itself to customers and provide the applicable privacy information at collection; this generic page does not replace that notice.
Customer feedback
The service collects a 1–5 star rating, selected topics, optional comment and other-topic text, restaurant and feedback-point identifiers, a unique submission identifier and timestamp. No name, email or phone is requested. Free text may contain personal information: do not include it. Feedback lets the restaurant view opinions and calculate indicators, trends, alerts and reports. The separate demo does not store responses.
Restaurants and accounts
The service stores account and authentication data, profile, restaurant name and identifier, address when supplied, NFC/QR points, settings and subscription status. Administration may store contacts and follow-up notes. Google presence data and review counts are entered manually; there is no automatic Google API connection. Purposes: service access, configuration, management of the commercial relationship and consultation by the authorized restaurant.
Contact requests
The form stores name, restaurant name, email, optional phone and message, timestamp and follow-up status. Data is used to respond to information or demo requests and follow up on the enquiry. Access and updates are restricted to authorized administration. After storage, the code attempts an email notification containing the request details to reviewflow.geral@gmail.com through the configured email service, using the request identifier to avoid duplicate notifications. A sending failure does not delete the request. The sender domain notify.reviewflow.pt remains under verification in this audit: sending and delivery are not confirmed. Visitors do not receive an automatic confirmation email.
Authentication, invitations and recovery
Administration creates access; public restaurant signup is closed. Email, account identifiers, credentials handled by the authentication service, sessions and information needed for invitations or password recovery are processed. Invitations may be emailed or provided as a link by administration when sending fails. Access links and codes are confidential. To confirm: actual token and session lifetimes, authentication logs and technical recipients. Email delivery or sending availability is not presumed while configuration is pending.
Dashboard, reports and Google
The dashboard presents feedback, indicators, trends and alerts to the authorized restaurant. PDFs are generated in the browser and downloaded by the user; they may include selected comments and service data. Downloaded copies are outside ReviewFlow’s direct control and must be protected by the restaurant. Google review and presence tracking is manual: there is no automatic API lookup or transmission of feedback to Google. External links to Google open a service with its own terms and practices.
Recipients and technical services
The code uses Lovable Cloud for hosting, data and authentication and a managed email service configured for notify.reviewflow.pt. Notifications go to the commercial mailbox reviewflow.geral@gmail.com. Sora and Manrope load through Google Fonts, with requests to Google Fonts/Google Static that may transmit IP addresses and connection metadata. Visual assets are served from the addresses configured in the images and error-capture mechanisms exist; technical logs may include usage context. All published traffic has not been verified. To confirm: contracted legal entities, subprocessor list, processing agreements, data transmitted, locations, support access and any transfers outside the EEA and safeguards. No claim is made that all data stays in the EU or that a particular transfer occurs without verification.
Sessions, preferences and storage
Language preferences, authentication sessions, feedback attempt/completion identifiers and reading-position restoration are used. See the Cookies and Similar Technologies Policy for local storage, session storage and cookies. No explicit advertising or audience-analytics integration was identified in the inspected code; this does not rule out additional technologies on published hosting. No optional-technology consent mechanism exists. To validate: necessity of each mechanism, actual durations and any consent required before non-essential technology.
Legal bases — to confirm for each purpose
Before collecting personal data, identify and document a legal basis for responding to enquiries; commercial follow-up; accounts, invitations and support; security and logs; customer feedback and people mentioned in comments. The restaurant must determine the basis for processing it controls. Contract or pre-contractual steps, legitimate interests, consent or legal obligations are possibilities to assess against the facts, not bases assigned by this draft. Where legitimate interests are relied on, document necessity and balancing; where consent is needed, ensure validity and withdrawal. Do not infer consent simply from submitting feedback or automatically assign a contractual basis to a company’s representative.
Retention and deletion — to confirm
No automated time-based deletion process or documented retention periods were identified. The 30-day Early Access period is not a retention period and does not trigger automatic deletion. Set periods or criteria for enquiries, accounts, feedback, comments, Google data, invitations, emails, logs and backups, including end-of-pilot handling and responsibility for PDF copies. The schema provides cascading deletion for some restaurant-related data, but that is not a complete deletion procedure or evidence of backup deletion. Requests need a controlled procedure, still to be defined, subject to applicable limits and obligations. Indefinite retention is not authorized.
Security and incidents
The implementation uses authentication, restaurant-scoped access, data-access policies, server-side administrator checks, validation and anti-abuse measures on the contact form and submission identifiers to prevent duplicate feedback. The contact table does not allow public reading or writing; authorized administration uses protected operations. These measures are not certification, a comprehensive audit or a guarantee against incidents. Report suspected incidents to reviewflow.geral@gmail.com with the affected service and time observed, without passwords or unnecessary personal information. Before the pilot, define and validate: response owner, escalation, breach assessment, documentation and legally required notifications to the restaurant, authority and individuals.
Rights and requests
Depending on processing and applicable law, access, rectification, erasure, restriction, objection and portability rights may apply; consent may be withdrawn without affecting prior lawful processing. Contact reviewflow.geral@gmail.com to route requests; for feedback processed on a restaurant’s behalf, requests should go to the restaurant controller, assisted by ReviewFlow where applicable. Complaints may be submitted to Portugal’s CNPD. To validate: proportionate identity verification, responsible people and procedures within statutory deadlines. There is no automated rights portal. No automated decision with legal or similarly significant effects was identified: indicators are for restaurant interpretation.