Draft for legal review. This document hasn't been checked by a lawyer yet and may change before KilaReviews launches.

KilaReviews is run by Kila Enterprises Pty Ltd (ABN 64 679 757 405), "we" in this policy. It explains what personal information we handle, why, and your choices. We follow the Australian Privacy Principles in the Privacy Act 1988.

Who this covers

• Businesses that use KilaReviews, and their team members who sign in.
• Their customers: people a business asks for a review, and people who use a business's review page. For this information the business decides what to collect and why; we handle it on the business's behalf.
• People who use our free AI Visibility Checker on kilareviews.io (see the section below).

What we collect

• Account details: name, email address and role, and the business's name, ABN, locations, logo and settings.
• Customer contact details a business adds or imports: name, mobile, email, and how they agreed to be contacted.
• For businesses that connect ServiceM8: details of their completed jobs and the customers on them (see the ServiceM8 section below).
• Google reviews for the business's connected locations, including reviewers' public names and review text, and the replies the business writes; and those locations' Google profile stats (totals such as views and calls, and the searches that showed the profile) and profile health check figures (see Google user data below).
• Review page activity: whether a link was opened, the star rating chosen, whether someone went to Google or to another review site the business lists (such as Facebook or ProductReview), and any private feedback they send (with a name or contact detail only if they give one). We only record which site they chose; what they write there is between them and that site.
• Messages: the review request SMS and emails sent for a business, delivery status, and opt-outs (STOP replies and unsubscribes).
• SMS sender name requests (Pro): the sender name, the business's ABN, legal name, website and street address, why the name is the business's, an authorised contact's name, role, email and mobile, the estimated monthly SMS volume, when and by whom the request was authorised, and the documents uploaded with it: proof of business registration (a screenshot of the Australian Business Register's Contacts tab, which lists the business's officers, or an ASIC company extract) and, only when the authorised contact isn't a listed officer, a Letter of Authorisation and the contact's photo ID (see SMS sender names below).
• Billing: plan, invoices and payment status. Card details are handled by Stripe; we never see or store them.
• Technical data: to limit abuse, review page requests are rate-limited using a one-way hash of the IP address, not the address itself. Error reports are kept without personal details.

How we use it

• To provide KilaReviews: syncing reviews, drafting replies, sending review requests and reminders, showing reports.
• To stop anyone being asked twice, and to respect every opt-out straight away.
• To bill businesses, give support, keep the service secure, and meet our legal obligations.

We don't sell personal information, and we don't use it for advertising.

Google user data

When a business connects its Google Business Profile, we use Google's APIs only to read that business's reviews, post the replies its people approve, and show the business its own profile stats: how many people viewed the profile on Google Search and Maps, calls, website clicks, direction requests and bookings, and the searches that showed it. These stats are about the business, not about individual people (Google gives them as totals). We also read the profile itself (categories, services, description, hours, and when photos and posts were added) to give the business a profile health check; from that we keep only counts, dates, yes or no answers, and the names of its categories, services and service areas, never the description or photos. We keep stats and health check figures only as a copy refreshed from Google each day, and delete any we haven't refreshed within 30 days. When the business asks for an AI draft of its description or services, its current description, services, categories, area and the searches that showed it go to Anthropic to write it (see AI drafts below). We don't use this data for anything else, share it with anyone else, combine it with other businesses' data, or use it to train AI models.

Changes to the profile. KilaReviews changes a business's Google profile only when someone in that business asks it to, after a confirm step showing exactly what will change: an owner can publish a new description, services, opening or holiday hours, or categories, and anyone in the business can add photos or a post. We never change the business name, address or phone number. For each change we keep what the profile said before and what we published, who approved it and when, so it can be undone for 30 days; after 30 days we delete both versions and keep only a one-line summary (such as "New business description"). We email the business's owners straight away about every change. Photos are made smaller in the browser before upload (which also removes the location a phone stores in them) and go straight to Google; a post's photo is held in our storage only until Google has copied it, and at most 2 days. We also keep the location's daily health check score (a number out of 100 we work out ourselves) for 13 months, to show how it changes.

Disconnecting Google removes our access and deletes that location's synced reviews, profile stats and health check figures. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Local ranking map and competitors

For Pro businesses that set it up, we check where a location shows up in Google Maps results across its area: once a month (and when the business asks), DataForSEO searches Google Maps for the keywords the business chooses, at 49 points around the centre and distance it chooses. We keep the results while the account exists: the location's position at each point, and the names, star ratings, review counts and Google categories of the businesses that came first there (public business listings). To find the centre, OpenStreetMap's search receives the suburb or address the business types, and the area is shown on a Google map. No customer information is used.

With it, we compare the location each month with up to 3 competitors from those results: DataForSEO looks up each business's public Google listing and its 50 newest Google reviews. We keep only figures: rating, number of reviews and photos, their Google categories, how many reviews came in recently, and how many got a reply. We don't keep reviewers' names or what they wrote.

AI drafts

To draft replies we send Anthropic (the maker of Claude) only the business and location name, the reviewer's first name, the rating and the review text, plus the business's reply settings. A person at the business approves every reply before it's posted.

To draft a Google profile description or services list, we send Anthropic the business and location name, its area, its Google categories, its current description and services, the searches that showed its profile (totals from Google, not anyone's details), its ranking map keywords, and anything the owner types in for the draft. No customer information is sent. We keep the draft until the owner removes or replaces it.

AI Visibility Checker

Our free AI Visibility Checker shows a business what AI assistants (such as ChatGPT, Gemini, Perplexity and Google's AI) say when people ask for a business like theirs.

When you run a check, we collect:

• Business details: the business you choose from Google (its name, address, phone, website, opening hours, category, rating and number of reviews) or the details you enter, and the services you ask us to check.
• Your first name, email address and, if you give it, your mobile number.
• Your marketing choice: whether you ticked "Send me tips to improve my AI visibility" (it's unticked unless you tick it). If you tick it, we keep a record of your consent: the wording you agreed to, when, and the IP address it came from.
• Technical data: the web address you arrived from and any campaign tags on it (such as utm_source), whether you open your report again, download its PDF or click through to KilaReviews, and a one-way hash of your IP address to limit how many checks can be run.

We use this to:

• run the check and email you your report (you asked for it, so this email is always sent);
• if you ticked the box, send you a few short tips over the following month, including a repeat check after 30 days;
• let our team follow up about KilaReviews; and
• prevent abuse (we limit how many checks can be run, and use Cloudflare Turnstile to tell people from bots).

The providers involved, each for its own part:

• Google Places (finding the business and nearby competitors).
• DataForSEO and SearchAPI (asking ChatGPT, Gemini, Perplexity and Google's AI the questions), and OpenAI (asking ChatGPT directly when DataForSEO can't). They receive the questions, which name the services and the suburb, not your name or contact details.
• Anthropic (suggesting services, writing the questions and reading the answers). It receives the business details and answers, not your contact details.
• Resend (emailing your report and tips), Twilio (text alerts to our own team about new enquiries) and Cloudflare (Turnstile).

Your report is at a private web address that only you (and anyone you share it with) can open; it isn't listed in search engines. Information from the checker, including your contact details and consent record, may also be shared with Kila Enterprises' own internal systems, which we use to manage enquiries. It isn't sold or shared with anyone else.

You can unsubscribe from the tips at any time with the link in every tips email, or by emailing us. We keep the details of a check for 24 months and then delete them, unless you become a KilaReviews customer, in which case they stay with your account. You can ask us to delete them sooner by emailing hello@kilareviews.io.

ServiceM8

A business can connect its ServiceM8 account so that when a job is marked completed, KilaReviews asks that customer for a review. KilaReviews developed this integration; it isn't made or supported by ServiceM8. The business chooses to connect it, and confirms that the people on its jobs are its own customers, whom it may contact.

When a business connects ServiceM8, we read from its ServiceM8 account:

• The account's company name and time zone.
• For each completed job: the job number, when it was completed, its category and the postcode of the job address (to pick the right location).
• The job contact and the client's contacts on that job: their names, mobile numbers and email addresses.

We only read. We never create, change or delete anything in ServiceM8, and we don't read job descriptions, notes, quotes, invoices, prices, payments, photos, staff details or anything else not listed above.

We use this only to:

• send the customer the business's review request, at the time the business chose, by SMS or email;
• skip people who shouldn't be asked: those who opted out, were asked in the last 90 days, or appear to have reviewed the business already; and
• show the business a log of each job received and what happened to it.

What we keep:

• The customer as a contact in the business's KilaReviews account (name, mobile and email), recorded as coming from a ServiceM8 job, with the review requests sent to them.
• A job log: the job number, the customer's name, the location, and what happened (sent, waiting, or skipped and why).
• The connection: the account's name and time zone, and the access ServiceM8 gives us, stored encrypted. The job address postcode and category are used to choose a location and not stored.

ServiceM8 data isn't sold, used for advertising or marketing, used to train AI models, or shared with anyone except the providers we need to send the messages and run KilaReviews (Twilio, Resend, Supabase and Vercel; see "Who we share it with"). It's stored in Sydney, Australia.

Disconnecting. A business can disconnect at any time in KilaReviews (Settings > Integrations), or turn KilaReviews off in ServiceM8. Disconnecting in KilaReviews deletes our access straight away, stops ServiceM8 sending us jobs, and cancels requests still waiting for approval; if it's turned off in ServiceM8, we stop the next time we try to read from it (within the hour). Requests already scheduled for a later time are still sent unless the business cancels them on its Send requests page. Contacts and the job log stay in the business's KilaReviews account, so it keeps its history and opt-outs keep being respected, until the business deletes a contact (which also removes their name from the job log) or closes its account, when we delete its data within 30 days. A customer can stop requests at any time with the opt-out link or by replying STOP. Help: kilareviews.io/help/servicem8.

ServiceM8 handles the data in its own system under its own privacy policy.

SMS sender names

On the Pro plan, a business can ask for its name to be the sender of its review request SMS. Since 1 July 2026, sender names in Australia must be on the SMS Sender ID Register kept by the Australian Communications and Media Authority (ACMA). When an owner asks, and authorises us to apply on the business's behalf:

• We look the ABN up on the Australian Business Register (ABN Lookup) to check the business's legal and business names, and keep what it returned with the request.
• We give Twilio, our SMS provider, the details in the request: the sender name, ABN, legal name, website, street address, why the name is the business's, the authorised contact's name, role, email and mobile, the estimated volume, a sample message, and the uploaded documents. Twilio passes them to the mobile networks and ACMA, who use them to check and record the registration. ACMA contacts the authorised contact to confirm the request with myID.
• Uploaded documents are stored privately in Sydney, Australia. Only KilaReviews staff who submit registrations can open them, through links that expire after an hour. We delete them 30 days after the registration is approved or rejected, or when the account is closed if that's sooner. Twilio keeps its copy under its own privacy policy. We don't ask for photo ID when the authorised contact is listed as an officer.
• We keep the rest of the request and its progress while the business's account exists, so we can show where it's up to and resubmit it if it's rejected. ACMA keeps the register under its own privacy policy.

Who we share it with

Only the service providers we use to run KilaReviews, each for its own part:

• Supabase (database and sign-in), with data stored in Sydney, Australia.
• Vercel (hosting).
• Twilio (SMS) and Resend (email).
• Twilio, the mobile networks and ACMA (sender name registrations, for Pro businesses that ask for one; see above), and the Australian Business Register (ABN Lookup).
• Stripe (payments).
• Anthropic (AI reply and profile drafts, and the AI Visibility Checker).
• Google Places, DataForSEO, SearchAPI, OpenAI and Cloudflare (the AI Visibility Checker; see above).
• Google Analytics, Google Tag Manager, Google Ads, Microsoft Clarity and Meta, on our website and sign-up pages (see below).
• Google (reviews and replies, and the profile changes, photos and posts a business approves, for businesses that connect).
• DataForSEO, OpenStreetMap and Google Maps (the local ranking map, for businesses that set it up; see above).
• ServiceM8 (completed jobs and their customers, read for businesses that connect; see above).
• Sentry (error reports, without personal details).

Supabase stores our database in Sydney, Australia, and our app runs on Vercel in Sydney. Vercel, Twilio, Resend, Stripe, Anthropic, OpenAI, Google, Microsoft, Meta, SearchAPI, Cloudflare and Sentry may also process information in the United States, Stripe in Ireland, DataForSEO in the European Union, and OpenStreetMap in the United Kingdom and Europe. We choose providers with strong security, and limit what we send each of them to what it needs.

Cookies and analytics

Our website (kilareviews.io) and our sign-up pages use the tools below, which set cookies or similar technology in your browser. They help us understand how people use the site and measure our advertising.

• Google Analytics: which pages are visited, roughly where visitors are from, and which steps people take, such as starting an AI visibility check or signing up. We don't send it your name or contact details.
• Google Tag Manager: loads and manages the other tools on the site.
• Microsoft Clarity: how people use the pages (clicks, scrolling, and recordings of visits), with what you type in forms hidden, so we can fix confusing parts of the site.
• Meta Pixel and Meta Conversions API: measure our Facebook and Instagram ads and help show them to people likely to be interested. When you start an AI visibility check or sign up, our server also tells Meta, including your email address in scrambled (hashed) form, so Meta can match it to an account without seeing it.
• Google Ads: measures our Google ads in the same way, including your email address in hashed form when you start an AI visibility check or sign up.

Inside the KilaReviews app, on businesses' review pages and on the printable report, we don't use these tools. Google, Microsoft and Meta handle what they receive under their own privacy policies.

You can opt out at any time:

• Block or delete cookies in your browser's settings (the site still works).
• Install the Google Analytics opt-out browser add-on.
• Turn off personalised ads in your Google ad settings and your Meta (Facebook and Instagram) ad settings.

Keeping and deleting it

• Businesses can export their contacts, reviews and private feedback at any time, including after cancelling.
• Businesses can delete a contact at any time, for example when a customer asks; their past requests stay in reports without their details.
• Anyone can stop review requests with the opt-out link in a request, by replying STOP, or by unsubscribing from an email.
• We keep a business's data while its account exists, including after it cancels, because its review page keeps working. When a business asks us to close its account, we delete its data within 30 days.
• We keep billing records for 5 years, as tax law requires.

Access, correction and complaints

You can ask for access to, or correction of, personal information we hold about you by emailing hello@kilareviews.io. If a business sent you a review request, you can also contact that business directly. If you're not happy with how we handle a privacy complaint, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

Changes

We'll update this policy when our practices change, and show the date it was last updated at the top.