Last updated: 11 October 2026
Requesting Reviews ("we", "us", "our") operates the requesting.reviews platform and associated messaging services. This Privacy Policy explains how we collect, use, store, and protect personal data when businesses use our platform — usually through the marketing agency that manages their account — to send review requests to their customers via SMS, RCS, email, and WhatsApp, manage their online presence, and run advertising.
We collect the following categories of personal data:
We use personal data exclusively to:
We do not sell, rent, or share personal data with third parties for marketing purposes.
Requesting Reviews's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
3.1 Google OAuth scopes we request
When a user connects their Google Business Profile to Requesting Reviews, we request the following OAuth scope:
https://www.googleapis.com/auth/business.manage — read and manage Google Business Profile data (business information, reviews, posts, photos, insights, Q&A, verifications, and place actions).3.2 Google data we access
With the user's explicit consent, we access the following Google Business Profile data for locations the user manages:
3.3 How we use Google data
We use Google user data only to provide and improve user-facing features of Requesting Reviews, specifically:
3.4 Limited Use compliance
Requesting Reviews's use of Google user data complies with Google's Limited Use requirements. Specifically:
3.5 Storage and security of Google data
Google OAuth access tokens and refresh tokens are stored encrypted at rest in our Supabase Postgres database, protected by row-level security so that only the authorising user and their authorised agency can access them. Google Business Profile data we cache (reviews, insights, business info) is similarly scoped per-user and per-agency.
3.6 Revoking access and deleting Google data
Users can revoke our access to their Google Business Profile at any time by:
Upon revocation, we delete all stored Google OAuth tokens within 24 hours and all cached Google Business Profile data within 30 days. Users may also request immediate deletion of all cached data by emailing hello@requesting.reviews.
Requesting Reviews connects to Meta through Facebook Login for Business. A business chooses exactly which Facebook Pages, ad accounts, pixels and Instagram accounts to share with us, and we only ever access those assets. We adhere to the Meta Platform Terms and Developer Policies.
4.1 Meta permissions we request
ads_management and ads_read — create, edit, pause and report on campaigns, ad sets and ads in the ad accounts the business shares, and send website conversion events to its pixel through the Conversions API.business_management — read the business portfolio and the assets the business has shared with us.pages_show_list, pages_read_engagement and pages_manage_ads — list the business's Pages, read Page details and engagement, and run ads from its Page.pages_manage_metadata and leads_retrieval — receive and read submissions to the business's Lead Ads forms as they arrive.4.2 Meta data we access
4.3 How we use Meta data
We use Meta data only to provide the features the business uses, specifically:
We do not sell Meta data, use it to build profiles of people, use one business's data for any other business, or use it to train generalised AI models.
4.4 Storage and security of Meta data
Meta access tokens are encrypted at rest (AES-256-GCM) and scoped to the business that granted them and the marketing agency it has authorised. Advertising and lead data is stored per business in our Supabase Postgres database, protected by row-level security.
4.5 Retention
Advertising and Page data is kept while the connection is active. Lead Ads submissions become part of the business's own contact records and are kept until the business deletes them or closes its account.
4.6 Revoking access and deleting Meta data
A business can remove our access at any time by:
When access is removed, we delete stored Meta access tokens within 24 hours and cached advertising and Page data within 30 days. To request deletion of any data we hold, follow the steps on our data deletion page or email hello@requesting.reviews.
Businesses using our platform are responsible for obtaining proper consent from their customers before sending review requests. Our platform provides tools including opt-in pages, consent tracking, and one-click opt-out mechanisms in every message. End customers can opt out of receiving messages at any time by replying STOP or using the unsubscribe link provided in each message.
We share personal data only with:
We retain personal data for as long as the business account is active. Customer contact data (phone numbers, email addresses) can be deleted at any time by the business through the platform. When a business account is closed, all associated data is deleted within 30 days, except where retention is required by law.
We implement industry-standard security measures including encryption in transit (TLS), encryption at rest, access controls, and regular security reviews. All data is stored in EU and US data centres operated by our infrastructure providers.
If you are located in the European Economic Area or the United Kingdom, you have the right to:
To exercise these rights, contact us at hello@requesting.reviews.
We use essential cookies required for platform functionality (authentication, session management). We do not use advertising or tracking cookies.
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date.
For privacy-related enquiries, contact us at:
Email: hello@requesting.reviews
Post: Requesting Reviews, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom