Privacy Policy
Review Ops by Scalable Digital Products Effective October 2026 Last updated: October 2, 2026
This policy explains what information Review Ops collects, how we use it, and the choices you have. Review Ops is a service of Scalable Digital Products ("SDP," "we," "us"). SDP is operated by ONBOARD LLC, Shelburne, Vermont, USA.
Review Ops is a done-for-you service. We draft replies to your Google reviews, you approve them, and we post the approved replies to your Google Business Profile.
1. What we collect
Business and contact info you give us
- Your name, business name, email address, and phone number
- Your Google Business Profile location (name and address as listed on Google)
- Notes you give us about how you want replies to sound
Google Business Profile data (with your permission) When you connect Google, we receive an OAuth refresh token. It lets us act on your Business Profile under the permission you granted (see Section 2). Through that access we read:
- Your reviews: review text, star rating, date, and the reviewer's public display name as Google shows it
- Your existing replies to those reviews
- The basic location details needed to match reviews to your business
What we create
- Draft replies we write for your reviews
- Your Approve or Skip decision on each draft, and when you made it
- Any change requests you send by replying to our emails
- Records of replies we posted to Google
Payment info Stripe, Inc. handles payments. We never see or store your full card number. Stripe gives us a customer ID, your subscription status, and your billing history.
Website usage Our site uses Vercel Web Analytics to count page views and referral sources in aggregate. We don't use advertising or tracking cookies.
2. Google access: what we request and why
When you connect, we ask Google for one OAuth scope:
https://www.googleapis.com/auth/business.manage, which Google shows as "See, edit, create, and delete your Google business listings"
Google offers only this one permission level for Business Profile management. We use it only to:
- Read reviews on the location you connect, so we can draft replies, and
- Post the replies you have approved.
We do not use this access to change your business name, hours, photos, categories, services, or other listing details. We do not delete reviews or replies. We never post a reply you haven't approved.
You can revoke our access at any time at https://myaccount.google.com/permissions. Revoking stops all reading and posting right away. Replies already posted stay on your profile unless you remove them in Google.
3. Google API Services User Data Policy (Limited Use)
Review Ops' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, data we receive from Google APIs:
- Is used only to provide and improve the user-facing features of Review Ops: drafting, approving, and posting review replies.
- Is not transferred to others except as needed to provide those features, to comply with law, or as part of a merger, acquisition, or sale of assets, and only after we get your explicit prior consent.
- Is not used for advertising, including retargeting or personalized ads.
- Is not sold, and is not used to determine creditworthiness or for lending.
- Is not read by people except (a) with your permission, which you give when you connect Google, because our team reads your reviews to write and check your replies, (b) for security or abuse investigations, (c) to comply with law, or (d) when aggregated and anonymized for internal operations.
- Is not used to train generalized AI or machine-learning models.
4. How we use your information
- To draft, revise, and post replies you approve
- To send drafts, receipts, and service notices
- To bill your subscription through Stripe
- To answer support requests
- To keep the service secure and prevent abuse
We do not use your data for advertising, and we do not send you third-party marketing.
5. How we protect it
- Google refresh tokens are encrypted at rest with AES-256-GCM. They are never sent to your browser or exposed in client-side code. Short-lived Google access tokens are not stored.
- All data in transit is encrypted with HTTPS/TLS.
- Only the people who need customer data to run the service can access it.
- Stripe handles payment card data, and we never store it.
No system is perfectly secure. If we learn of a breach affecting your data, we will notify you as required by law.
6. Who we share it with
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
We share data only with the service providers that help us run Review Ops, and only for that purpose:
| Provider | Purpose |
|---|---|
| Google LLC (Google OAuth and Business Profile API) | Connecting your profile, reading reviews, and posting approved replies |
| Stripe, Inc. | Payments and billing |
| Railway Corp. | Hosting our application server and database, where account data, reviews, drafts, and encrypted tokens are stored |
| Vercel, Inc. | Hosting our website and aggregate site analytics |
| Anthropic, PBC and OpenRouter, Inc. | Language-model services that help prepare draft replies and flag sensitive reviews. They receive the review text, rating, and business name needed for a draft. |
| Our email delivery provider | Sending draft replies with Approve and Skip links and other service emails, and receiving your email replies with change requests |
| Telegram | Internal alerts to our team, such as a new subscription or a cancellation, which can include your business name and email address |
We don't use your data to train AI models.
We may also disclose information if the law requires it, to protect our rights or users' safety, or as part of a merger or sale of the business with notice to you.
For data we receive from Google APIs, a transfer as part of a merger or sale happens only with your explicit prior consent.
7. How long we keep it
- Review text and reviewer names we receive through the Google Business Profile API are kept for no more than 30 days. Drafts and posting records are kept while your subscription is active.
- After you cancel: we delete your Google refresh token within 7 days. We delete review text, drafts, and contact info within 30 days, or sooner if you ask.
- Billing records: kept for 7 years for tax and accounting purposes.
- Backups: deleted data may stay in encrypted backups for up to 30 days before it's overwritten.
8. Your choices and rights
You can ask us at any time to:
- Send you a copy of the data we hold about you
- Correct your information
- Delete your data. We'll confirm by email once it's done, within 30 days.
- Stop any non-essential emails
Email support@scalabledp.com from the address on your account. You can also revoke Google access yourself at any time (see Section 2).
Depending on where you live, for example California, state privacy law may give you more rights. These include the right to know, delete, and correct your information, and the right not to be discriminated against for using them. We honor those requests through the same email address.
About reviewers: Review text and reviewer display names are public on Google. We process them only to draft and post your replies. A reviewer who wants their information removed from our systems can email support@scalabledp.com.
9. Children
Review Ops is a business service. It is not meant for anyone under 18, and we do not knowingly collect children's information.
10. Where data is processed
Review Ops is offered to businesses in the United States. Data is stored and processed in the United States.
11. Changes
If we change this policy, we'll update the date above. If a change is material, we'll email active customers before it takes effect.
12. Contact
Scalable Digital Products (operated by ONBOARD LLC) 145 Pine Haven Shores Rd, Ste 1000A, Shelburne, VT 05482 support@scalabledp.com
This policy is governed by the laws of the State of Vermont.