Draft for legal review. This document hasn't been checked by a lawyer yet and may change before KilaReviews launches.

KilaReviews is run by Kila Enterprises Pty Ltd (ABN 64 679 757 405), "we" in this policy. It explains what personal information we handle, why, and your choices. We follow the Australian Privacy Principles in the Privacy Act 1988.

Who this covers

• Businesses that use KilaReviews, and their team members who sign in.
• Their customers: people a business asks for a review, and people who use a business's review page. For this information the business decides what to collect and why; we handle it on the business's behalf.

What we collect

• Account details: name, email address and role, and the business's name, ABN, locations, logo and settings.
• Customer contact details a business adds or imports: name, mobile, email, and how they agreed to be contacted.
• Google reviews for the business's connected locations, including reviewers' public names and review text, and the replies the business writes.
• Review page activity: whether a link was opened, the star rating chosen, whether someone went to Google, and any private feedback they send (with a name or contact detail only if they give one).
• Messages: the review request SMS and emails sent for a business, delivery status, and opt-outs (STOP replies and unsubscribes).
• Billing: plan, invoices and payment status. Card details are handled by Stripe; we never see or store them.
• Technical data: to limit abuse, review page requests are rate-limited using a one-way hash of the IP address, not the address itself. Error reports are kept without personal details.

How we use it

• To provide KilaReviews: syncing reviews, drafting replies, sending review requests and reminders, showing reports.
• To stop anyone being asked twice, and to respect every opt-out straight away.
• To bill businesses, give support, keep the service secure, and meet our legal obligations.

We don't sell personal information, and we don't use it for advertising.

Google user data

When a business connects its Google Business Profile, we use Google's API only to read that business's reviews and post the replies its people approve. We don't use this data for anything else, share it with anyone else, or use it to train AI models. Disconnecting Google removes our access and deletes that location's synced reviews. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

AI reply drafts

To draft replies we send Anthropic (the maker of Claude) only the business and location name, the reviewer's first name, the rating and the review text, plus the business's reply settings. A person at the business approves every reply before it's posted.

Who we share it with

Only the service providers we use to run KilaReviews, each for its own part:

• Supabase (database and sign-in), with data stored in Sydney, Australia.
• Vercel (hosting).
• Twilio (SMS) and Resend (email).
• Stripe (payments).
• Anthropic (AI reply drafts).
• Google (reviews and replies, for businesses that connect).
• Sentry (error reports, without personal details).

Supabase stores our database in Sydney, Australia, and our app runs on Vercel in Sydney. Vercel, Twilio, Resend, Stripe, Anthropic, Google and Sentry may also process information in the United States, and Stripe in Ireland. We choose providers with strong security, and limit what we send each of them to what it needs.

Keeping and deleting it

• Businesses can export their contacts, reviews and private feedback at any time, including after cancelling.
• Businesses can delete a contact at any time, for example when a customer asks; their past requests stay in reports without their details.
• Anyone can stop review requests with the opt-out link in a request, by replying STOP, or by unsubscribing from an email.
• We keep a business's data while its account exists, including after it cancels, because its review page keeps working. When a business asks us to close its account, we delete its data within 30 days.
• We keep billing records for 5 years, as tax law requires.

Access, correction and complaints

You can ask for access to, or correction of, personal information we hold about you by emailing hello@kilareviews.io. If a business sent you a review request, you can also contact that business directly. If you're not happy with how we handle a privacy complaint, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

Changes

We'll update this policy when our practices change, and show the date it was last updated at the top.