Privacy Policy

Introduction

StarForm LLC, operating as SnappyRatings ("we", "our", "us"), respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, and protect your data when you use the SnappyRatings platform.

Information We Collect

Business account information

• Name and business name
• Email address and phone number
• Username and login credentials (password stored as a one-way hash)
• Billing information (collected at checkout and stored by Stripe; we do not store your full payment card details — see the Payments section below)
• Review destination URLs you configure (Google, Yelp, Facebook, TripAdvisor, Trustpilot, or any other platform)
• Business location names and their associated review URLs (Growth plan)
• Custom "from name" for email outreach and custom invitation message body
• Consent timestamps (terms agreement and communications consent recorded at signup)
• Subscription and plan status
• Custom review landing page settings (uploaded logo, custom tagline, platform ordering/visibility preferences)
• Website embed widget configuration (if used)
• Webhook endpoint URLs and HMAC signing keys, and integration API keys (stored only as a one-way hash) — if you enable webhooks or the integration API (Growth plan)
• Staff account usernames and display names (Growth plan; staff sign in with a username and password — we do not collect staff email addresses)

QR scan data

• IP address of the device that scanned the QR code
• User agent (browser/device type)
• Timestamp of the scan

Used solely to power scan count analytics in your dashboard. Not sold or shared with third parties.

Private feedback submissions

• Text content of any private feedback submitted by a customer via your review landing page
• Timestamp of the submission

Private feedback is stored solely for your internal review and is not shared with any third party.

Email & SMS invitation data

• Customer email addresses and phone numbers submitted by the business — manually, by file upload, or programmatically through our integration API — for sending review invitations
• Delivery status and follow-up timestamps for each invitation
• Email unsubscribe records — when a recipient unsubscribes, their email is added to a suppression list to prevent future outreach

Platform-generated communications

• Transactional emails — account verification, password reset, billing notifications
• Weekly performance digest — a summary of scan activity, invitation stats, and top-performing channel (can be disabled in dashboard settings)
• Onboarding emails — helpful tips sent at day 3, day 7, and day 30 after account activation
• Milestone notifications — sent when your account reaches notable scan or invitation milestones (e.g. 10, 50, or 100 scans)

How We Use Information

We use personal data to:

• Provide and maintain the Service
• Process payments via Stripe
• Send account, billing, and onboarding notifications
• Send email and SMS review invitations on behalf of businesses (where the business has provided customer contact details)
• Send automated follow-up review invitations (if the business has enabled this feature)
• Send weekly performance digests and milestone notifications to business account holders
• Maintain an email suppression list to honor unsubscribe requests from invitation recipients
• Store and display private feedback submissions to the account owner
• Deliver webhook notifications to configured endpoints when QR scan or email open events occur
• Render the website embed widget on your website with your configured review links
• Manage staff account access to your dashboard
• Improve security and functionality
• Prevent fraud or abuse

We do not sell personal information.

Payments

Payments are processed through Stripe. We do not store full payment card details or billing addresses on our servers — this information is collected and stored by Stripe and is subject to Stripe's own privacy practices. Stripe retains billing name and address for invoice and tax purposes on our behalf.

Third-Party Services

We use the following third-party services to operate the platform. Each has its own privacy policy governing how it handles data:

• Stripe — Payment processing, subscription billing, and affiliate payouts via Stripe Connect
• Resend — Transactional and invitation email delivery
• Infobip — SMS message delivery
• Google Analytics — Aggregate website usage analytics (anonymized)

We do not sell your personal information to any of these or any other third parties.

Email, SMS & Integrations

All plans include email and SMS review invitation tools. When a business uses these features:

• Customer contact details (email addresses and phone numbers) provided by the business are used solely to send review invitations on that business's behalf
• SnappyRatings acts as a Data Processor for this contact data — it is not used for any other purpose, shared with third parties, or retained beyond what is necessary to deliver the invitations
• Businesses are responsible for ensuring they have obtained proper consent from their customers before submitting contact details for outreach
• Email recipients may unsubscribe at any time using the unsubscribe link included in every invitation email. Unsubscribed addresses are added to a per-business suppression list and will not receive future outreach from that specific business through the platform
• SMS messages are delivered via third-party carriers; standard messaging rates may apply for recipients

Integration API (Growth plan)

Businesses on the Growth plan can connect their own software (such as a CRM, booking system, Zapier, Make, or custom code) to send review invitations through our integration API. Customer contact details submitted this way are processed exactly as described above — solely to deliver the requested invitation, and only where the business has obtained proper consent. API keys are stored only as a one-way hash, and a business can revoke or regenerate its key at any time.

Webhooks (Growth plan)

If a business configures a webhook, we transmit event notifications to the HTTPS endpoint it specifies. Depending on the event, these notifications may include customer contact details (for invitation events) or the content of private feedback submissions. Because the receiving endpoint is controlled and operated by the business, that business is solely responsible for the security and lawful handling of any data delivered to it. Each payload is signed with an HMAC signature so the recipient can verify authenticity, and webhooks can be disabled at any time.

Review Destination URLs & Multiple Locations

The review destination URLs you configure (Google, Yelp, Facebook, TripAdvisor, Trustpilot, or any other URL) are stored on our servers and used solely to redirect customers when they scan your QR code or visit your review link. If you configure multiple destinations, customers are shown a platform chooser page to select their preferred platform. If you use the multiple locations feature (Growth plan), each location's name and destination URL is stored separately.

We do not control or store any data from destination pages — that is governed by the respective third-party platform (e.g. Google, Yelp, Facebook, TripAdvisor, or Trustpilot) the URL belongs to.

Data Retention & Deletion

We retain information as long as necessary to provide services, meet legal obligations, and resolve disputes.

Subscription cancellation: When you cancel your subscription, your account remains active until the end of the current billing period, after which it becomes inactive. Your account data (scan history, invitation logs, locations, and settings) is retained so you can reactivate at any time by resubscribing. Cancelling a subscription does not, by itself, delete your data.

Closing your account: To permanently delete your data, use the "Delete account" option in your dashboard settings. This immediately and irreversibly deletes your account and all associated data — scan history, invitation logs, locations, private feedback, staff accounts, and settings. A minimal record (business name, email, and plan) is archived for legitimate business and legal purposes and automatically purged within 90 days.

Deletion requests: You may also request deletion of your personal data at any time by emailing support@snappyratings.com. We will fulfill verified deletion requests within 30 days. Note that affiliate account records may be retained in a limited archived form to satisfy tax reporting obligations (e.g. IRS 1099 requirements) even after deletion of your business account.

Email unsubscribe records are retained indefinitely to honor suppression requests and prevent future unwanted outreach.

Data Security & Breach Notification

We implement reasonable technical and organizational safeguards to protect your personal information, including encrypted data transmission (HTTPS), password hashing, and access controls. However, no method of transmission over the internet is 100% secure.

In the event of a data breach that is reasonably likely to result in harm to affected individuals, we will notify affected users without undue delay and, where required by applicable US federal or state breach notification laws, within a reasonable time of becoming aware of the breach. Notification will be sent to the email address associated with your account.

Cookies

We use the following cookies:

• Session cookie (strictly necessary): Keeps you signed in to your account. Expires after 8 hours. The Service cannot function without this cookie.
• Google Analytics cookies (_ga, _ga_*): Used to understand aggregate website traffic and usage patterns (e.g. which pages are visited most). These are analytics cookies set by Google. No personally identifiable information is sent to Google through these cookies.

You may disable cookies in your browser settings. Disabling the session cookie will prevent you from signing in. Disabling analytics cookies will not affect your use of the Service.

US Privacy Rights

The Service is intended solely for use within the United States. We do not direct the Service to users outside the United States.

Children's Privacy

The Service is not intended for individuals under 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy periodically. When we do, we will revise the "Last Updated" date at the top of this page. Continued use of the Service after changes are posted constitutes your acceptance of the updated policy. For material changes, we will notify you via email or an in-dashboard notice.

Affiliate Program Data

If you participate in the SnappyRatings affiliate program, we collect and process the following information:

• Your name and email address (used to create your affiliate account and send commission notifications)
• Your referral activity, including which customers signed up using your code and commission amounts earned
• Your Stripe Connect account ID and payout status (for processing commission payments — actual bank account details are stored and managed by Stripe, not SnappyRatings)

This data is used solely to operate the affiliate program, calculate and pay commissions, and comply with tax reporting obligations (including IRS 1099-NEC reporting for US-based affiliates paid $600 or more in a calendar year). It is not sold or shared with third parties except as necessary to process payouts via Stripe.

Affiliate account records may be retained in a limited archived form after account closure to satisfy applicable tax reporting obligations, even if you request deletion of your business account.

Contact Information

If you have questions about this Privacy Policy or how we handle your data, please reach out:

StarForm LLC (operating as SnappyRatings)
Email: support@snappyratings.com