Privacy Policy

1. Who We Are

Rightly Rated (“we”, “us”) operates an independent consumer review platform. This policy explains what personal data we collect when you use our site, why we collect it, who we share it with, and the rights you have over it.

2. Information We Collect

We collect the following categories of data:

• Account data — name, email address, and password (stored as a salted hash, never in plain text).
• Reviewer contributions — written reviews, star ratings, photos, and proof-of-purchase evidence (e.g. receipts) you choose to submit.
• Business account data — for claimed business profiles, verification details, team member invitations, and reply content.
• Location data — if you use the “Nearby” feature, we request your device’s coordinates via your browser to sort results by distance. This is used only for that request and is not stored against your account.
• Technical and usage data — IP address, browser type, device information, and interaction logs, used to operate our fraud-prevention engine and secure the platform.

3. Cookies and Local Storage

We use a single essential, httpOnly session cookie to keep you signed in — it cannot be read by page scripts and is not used for advertising or cross-site tracking. Your dark/light theme preference is stored in your browser’s local storage and never leaves your device. We do not run third-party advertising trackers or analytics pixels.

4. How We Use Your Data

Your data is used to publish verified consumer reviews, compute objective RightScore™ ratings, notify businesses of new feedback, operate fraud-detection and content-moderation systems, and respond to support requests. We never sell your personal data to third parties, and payment or subscription status never influences whose reviews are shown or how they’re scored.

5. Who We Share Data With

We use a small number of service providers to operate the platform, each acting under contract and only for the purpose described:

• Cloudflare R2 — stores uploaded files (review photos, business logos, receipt evidence).
• Resend — sends transactional email (sign-up verification, claim and moderation notices). We do not use it for marketing email without separate consent.
• An AI provider(configurable; disclosed per deployment) — when AI review summaries or translation are enabled, the relevant review text is sent to that provider solely to generate the summary or translation. It is not used to train the provider’s models on our behalf beyond their standard API terms.

We disclose data to law enforcement only when legally compelled to do so, and to a business you’ve reviewed only to the extent needed for legitimate dispute resolution (e.g. verifying a claimed purchase).

6. Public Visibility

When you publish a review, your display name, star rating, review text, and any photos you attach are visible publicly. Private proof-of-purchase files (such as receipt photos) are shared only with our moderation team and, where relevant to verifying a dispute, the business you reviewed — never published publicly.

7. Data Retention

We retain account and review data for as long as your account is active, or as needed to comply with legal obligations, resolve disputes, and enforce our agreements. Deleting your account removes your personal profile data; published reviews may be retained in de-identified form to preserve the integrity of a business’s review history, consistent with our commitment that businesses cannot have negative feedback erased on request.

8. Your Rights (GDPR & CCPA)

Depending on where you live, you may have the right to access, correct, delete, or export a copy of your personal data, object to or restrict certain processing, and withdraw consent at any time. You can exercise most of these directly from your Account Settings; for anything else, contact us using the details below and we’ll respond within the timeframe required by applicable law.

9. Children’s Privacy

Rightly Rated is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Security

We use industry-standard measures — encrypted connections, hashed passwords, and access-controlled infrastructure — to protect your data. No system is perfectly secure, and we cannot guarantee absolute security, but we investigate and respond promptly to any suspected incident.

11. International Data Transfers

Your data may be processed in a country other than your own. Where this involves a transfer out of the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses with our service providers.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by an updated “Last updated” date above, and where required by law we’ll notify you directly.

13. Contact Us

Questions about this policy or a request regarding your data can be sent to privacy@rightlyrated.com.