REVIEWS · DATA & PRIVACY APPENDIX
What Reviews
reads, and why.
The company policies below apply to everything Retrics runs. This page is the part that is specific to this product — the data it touches, and who else sees it.
BUILDING
ReviewsBUILDING
RUNS ONreviews.retrics.ai
CUSTOMER GRAPHPlanned for the shared graph
DATA FLOW DECLAREDYes
THIS PAGE IS THE URL THIS PRODUCT’S APP LISTING SUBMITS
WHERE IT STANDS
The work is real. The door is not open yet.
THE DATA FLOW
Five questions, answered plainly.
WHAT IT READS
- Orders and their line items from Shopify — to know who bought what, and who can honestly be asked about it
- The customer's name and email on that order, to send the request and to sign the review with a display name
- The visitor's IP and browser at the moment a review is submitted, to rate-limit abuse — never kept as itself
WHAT IT STORES
- The review itself: rating, the sanitised text, the display name, the order reference proving the purchase, and any incentive, disclosed
- Photos and video submitted with a review
- The request: which order line, which channel, when it was sent and opened — and the recipient's email and name, until an erasure clears them
- A per-merchant do-not-email list, held as hashes
HOW IT IS PROTECTED
- The Shopify access token is encrypted with AES-256-GCM before it is stored — never written down in plain text
- Every table is fenced off per merchant by the database itself, rather than by application code remembering to filter
- The do-not-email list holds a SHA-256 of the address and never the address, so a stolen copy is a list of digests rather than a mailing list
- The abuse limiter stores a keyed hash of IP and browser and cannot be reversed to a person
- Review text is stripped to plain words with no markup and no links the moment it arrives, because it is rendered into the merchant's own storefront
- A question a shopper types into the ask box is never written down — what is counted is the topic it was routed to, from a fixed list we define, so there is no store of shopper-typed text to leak
- Photos carried over from another review platform are fetched onto our own storage through a check that refuses private and internal addresses, so a link in an uploaded file cannot reach anything behind our network
- If personal data is ever exposed, the merchants affected are told without undue delay and within 72 hours of us confirming it — what happened, whose data, what we have done, and what they may need to do
- Shopify is notified in the same window, because a merchant's obligation to their own customers depends on hearing it from us first
- An incident is triaged the moment it is confirmed: the access path is closed before anything else, then the blast radius is established from the audit trail rather than from memory
- What we learn is written down and published as a change to this page, so the fix outlives the incident — every protection listed above was added this way
- Test data never mixes with a real merchant's: demo and fixture rows are marked as such, fenced by the same per-merchant database isolation as everything else, and removable in a single statement
- There is no bulk export of personal data. What leaves is narrow and named — the review request to the delivery provider, review TEXT to the summariser, and the merchant's own reviews to feeds they switch on; nothing else, and never to an advertising platform
- Access to stored data is limited to the operator, encrypted in transit and at rest, and every consequential action is written to an audit trail that a merchant can export
HOW LONG IT IS KEPT
- A shopper's email address and name are erased from the request record 30 days after it was sent, by an hourly job — what remains is a one-way hash, kept only so we never email someone who opted out
- Abandoned photo uploads and the photos on rejected reviews are deleted every hour — the file first, then the record, and nothing at all if storage cannot be reached
- A customer erasure request from Shopify clears that shopper's email and name from the request record, and redacts the audit entries naming them
- An opt-out outlives everything else on purpose: forgetting one means emailing somebody who said no
WHO ELSE SEES IT
- Resend delivers the review request, so it receives the shopper's email address and the message
- Anthropic receives review text to summarise themes — the words a shopper chose to publish, never their name, email or order
- Published reviews appear on the merchant's own storefront, which is the point of them; search engines read them there rather than receiving them from us
- No advertising platform receives anything from Reviews
AND THE COMPANY POLICIES IT SITS UNDER
These apply to everything Retrics runs.
They are linked rather than repeated here. Twelve copies of the same policy is twelve things that drift apart.
Privacy →Subprocessors →Data processing addendum →Data rights →Data deletion →Security →Terms of service →
THIS APPENDIX IS MAINTAINED WITH THE PRODUCT · EDITING IT CHANGES NOTHING ELSE