Privacy policy

GetReviewX is made and sold by TheDevGarden. Where this policy says “we”, “us” or “our”, it means TheDevGarden. Where it says “you”, it means the person or business that buys, installs or runs the plugin.

This policy covers three things:

• •the GetReviewX WordPress plugin, and the data it handles on your site
• •this website
• •the licence, update, download and support services we run for customers

It does not cover what Google does with your data, what your own website does with data you collect through it, or what other plugins on your site do. Those are governed by Google’s privacy policy and by your own.

The quickest way to reach us about anything on this page is [email protected].

GetReviewX is self-hosted software. You install it in your own WordPress site, it runs on your own hosting, and it writes to your own database. There is no GetReviewX account to create, and no dashboard of ours that your reviews appear in.

In practice that means:

• •We do not host, mirror, cache or receive your reviews.
• •We cannot read your database, your posts, your customers or your traffic.
• •If our servers were switched off tomorrow your site would carry on showing the reviews it already has. What would stop is updates, downloads and licence checks.

Most privacy policies for review plugins describe a pipeline that runs through the vendor’s servers. Ours does not, and much of the rest of this page is simply the consequence of that.

Everything below is written to your WordPress database, on your hosting, under your control:

• •Review content synced from your Google Business Profile: the reviewer’s display name, the address of their Google profile photo, the star rating, the review text, the date it was left, your own owner replies, and the addresses of any photos attached to the review.
• •Identifiers for your Google Business Profile account and its locations, so the plugin knows which listing to sync.
• •Your curation choices — the order you dragged reviews into, which ones are pinned, and which ones are hidden.
• •Plugin settings: layout, styling, which reviews a given shortcode or widget shows, and the sync schedule.
• •Your Google OAuth tokens, encrypted at rest. See section 5.
• •Your licence key and whether this site is currently activated against it.
• •Sync records the plugin keeps so you can see when the last sync ran and why one failed.

You can export, edit or delete all of it with the same tools you use for the rest of WordPress. Uninstalling the plugin removes its settings and its stored review content from your site.

Two things are worth being explicit about. First, reviewer names, photos and review text are other people’s personal data. It is Google’s data, displayed under Google’s terms, and the decision to show it on your site is yours — see section 10. Second, reviewer profile photos and review photos are loaded directly from Google’s servers. The plugin never copies them into your media library, so your visitors’ browsers request those images from Google, exactly as they would for any other image embedded from another domain.

Two kinds of request leave your site for ours. Both are about the licence. Neither is about your reviews.

Update checks

Every few hours WordPress asks whether a newer release of GetReviewX exists. That request goes to our update endpoint and carries three things: your site address, your licence key and the plugin version you are running. We reply with the current version number and, if the licence is valid for that site, a download link.

Licence activation and validation

When you enter a key, move a licence to a different site, or release an activation, the same three details are sent so we can record which sites a licence covers and keep to the activation limit for your plan.

That is the entire list. These requests carry no review text, no reviewer names, no Google tokens, no database contents, no customer records, and nothing about the people who visit your site. We could not build a picture of your audience from what we receive, because we receive none of it.

We keep the resulting records — site address, licence key, version, timestamp — to run the licence system, to answer support questions like “why is my site not offering the update”, and to notice a key being used on more sites than the plan allows. We do not sell or rent them, and we do not use them for advertising or profiling.

Separately, if you email us we hold that email: your address, what you wrote, and any logs or screenshots you attached, for as long as it is useful in helping you.

Connecting a Google Business Profile uses Google’s own OAuth consent screen. You sign in to Google — never to us, and never through a form of ours — and you see exactly which permissions are being requested before you approve them. GetReviewX asks for read access to your Business Profile account so it can list your locations and fetch the reviews and replies on them. It does not ask for permission to post, edit or delete anything on Google.

When you approve, Google issues an access token and a refresh token. Both are stored on your own site, encrypted at rest using your WordPress installation’s own secret keys. They are never transmitted to us and we hold no copy. We cannot read your tokens and we cannot act on your Google account.

About the connect broker

So that you do not have to create your own Google Cloud project and paste API credentials into WordPress, one step of the connect flow — exchanging the single-use code Google hands back for a token — is performed by a small service we run at connect.getreviewx.com. It exists for that exchange and nothing else. It keeps no long-term copy of any token, it never syncs anything on your behalf, and no review data passes through it. Once the exchange is done the token is on your site and the broker is out of the picture until you connect again.

How to revoke access

• •In WordPress: GetReviewX → Settings → disconnect the Google account. The stored tokens are deleted from your site.
• •In your Google account: myaccount.google.com/permissions → choose GetReviewX → Remove access. This works even if you no longer have the website.

After revoking, the plugin can no longer sync. Review content already cached on your site then expires under the retention rule in section 6.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google’s Business Profile API terms cap how long its content may be cached at 30 days. GetReviewX gives itself a margin and uses 25.

Every stored review carries a timestamp. A scheduled job refreshes reviews from Google and purges anything older than 25 days that has not been re-fetched. This happens automatically. It is not a setting you can raise: keeping stale Google content on your site for longer would breach Google’s terms and put your access at risk.

While the plugin is connected and syncing normally you will not notice it. Reviews are refreshed well inside the window, so what your visitors see stays current. If syncing stops — you revoke access at Google, you delete the connection, or the site is offline for a long stretch — the cached content ages out and is removed within 25 days.

Your curation choices are not review content. The order you set, and which reviews you pinned or hid, are your own settings and are kept until you change them.

Dodo Payments is the merchant of record for GetReviewX. They, not we, sell you the licence, take the payment, calculate and remit the tax for your country, issue the invoice, and run the portal where you manage or cancel a subscription.

We never see your card number, expiry date, security code or bank details. Those are entered on Dodo Payments’ own checkout and never touch our systems.

What we receive back is what a licence needs: your name, your email address, the country or tax region on the order, the plan you bought, the licence key issued, and whether the subscription is active, cancelled or refunded.

Dodo Payments handles your payment data under its own privacy policy and its own legal obligations, including the record-keeping periods tax authorities require. Your invoices live in their portal, which you can reach from your account page.

getreviewx.com is a marketing site. It has no accounts, no logins and no comment forms.

• •No analytics. We do not run Google Analytics or any other analytics product here.
• •No advertising, no tracking pixels, no session recording, no A/B testing tools.
• •One third-party request: the site loads its typeface from Google Fonts. As with any file served from another domain, your browser tells Google your IP address and user agent when it fetches the font. Nothing else about your visit is shared, and no cookie is set for it.
• •Our hosting provider keeps ordinary server logs — IP address, time, URL requested, user agent — for a short period, to keep the site up and to deal with abuse. They are not used to build profiles of visitors.

The licence-key box on the account page sends your key to our download endpoint so it can be checked and the ZIP returned. It is not kept as a sales lead, and we will not email you because you used it.

The plugin sets no cookies for your visitors. It does no fingerprinting, no analytics, no session tracking and no ad-tech of any kind. Somebody who reads reviews on your site is not counted, profiled or identified by us — we do not know they were there.

Inside wp-admin, WordPress sets its own login and session cookies for whoever is administering the site. Those belong to WordPress and are part of every WordPress install. They are not set, read or extended by us.

This website sets no cookies at all. That is why there is no cookie banner on it: there is nothing to ask you about.

Data protection law separates the controller, who decides why and how personal data is used, from the processor, who handles it on the controller’s instructions. For a self-hosted plugin the split is unusual, and it is better to be straight about it than to claim a tidier arrangement than exists.

For the reviews on your site, you are the controller. You chose to connect a Google Business Profile, you choose which reviews to display and where, and the data sits on infrastructure you control. We are not your processor for that data, because it never reaches us. We are the supplier of software you run yourself.

The practical consequences follow you: telling your own visitors what your site does with personal data, answering a reviewer who contacts you about their data where the law requires it, and keeping your site secure.

For the data we hold, TheDevGarden is the controller. That is update checks, licence and activation records, the order details Dodo Payments passes to us, and support correspondence. This policy is our notice to you about that data.

Where the UK GDPR or the EU GDPR applies to the data we hold, we rely on:

• •Contract — issuing and validating licences, serving updates and downloads, and providing support. We cannot deliver what you bought without it.
• •Legitimate interests — keeping activation records so plan limits mean something and shared keys can be spotted, short-lived server logs that keep the service available and secure, and knowing which plugin versions are still in use so we know what to keep supporting.
• •Legal obligation — records connected to payment and tax, which are kept by Dodo Payments as merchant of record.

We do not rely on consent for anything described here, and we run no behavioural advertising. If that ever changes we will ask you first rather than assume.

• •Licence and activation records: for the life of the licence, and for a period afterwards so a renewal, a refund or a dispute can be dealt with.
• •Update-check records: kept only while they are useful for diagnosing update and licence problems, then discarded.
• •Support email: kept while the conversation is still useful in supporting you, then deleted.
• •Orders and invoices: held by Dodo Payments for as long as their tax and accounting obligations require.

The data on your own site is not on this list, because it is not ours to keep or delete. It lasts as long as you keep it, subject to the 25-day rule in section 6.

The list is short on purpose.

• •Dodo Payments, as merchant of record: checkout, invoicing, tax, subscriptions and refunds.
• •Our hosting and CDN provider: serves this website, the update and download endpoint, and the connect broker.
• •Our email provider: carries support email between you and us.

None of them receives review content or Google tokens, because we have none to pass on.

The data that reaches us is small — a site address, a licence key, a version number, an email address — but it may be processed in a country other than the one you live in, because the providers above operate internationally.

Where personal data protected by the UK or EU GDPR is transferred outside the UK or the EEA, we rely on an adequacy decision where one covers the destination, and otherwise on standard contractual clauses with the provider concerned.

Review content and Google tokens cross no border because of us. They stay in the database on the server you chose, in the region you chose.

The strongest thing we do for your security is not hold your data. There is no review archive of ours to breach and no token store of ours to leak.

• •OAuth tokens are encrypted at rest on your site, using your installation’s own secret keys.
• •The plugin asks Google for read access only — the least it can work with.
• •Traffic between your site, our endpoints and Google is over HTTPS.
• •The connect broker keeps no long-term secret belonging to you.

No system is perfectly secure, and the part of this that lives on your server is genuinely yours to protect: keep WordPress and PHP updated, use strong administrator passwords, and keep backups.

If you think you have found a security problem in GetReviewX, email [email protected] and we will treat it as a priority. Please give us a chance to fix it before publishing details.

If you are in the UK or the EU you have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to how we use it, and to receive it in a portable form. You also have the right to complain to a supervisory authority — the Information Commissioner’s Office in the UK, or your national data protection authority in the EU. Comparable rights exist in a number of other countries, and we apply the same process to everyone who asks, wherever you are.

To use any of them, email [email protected] from the address you bought with, or tell us the licence key concerned so we can find you. There is no charge, and we will reply within one month.

One honest limit

If your request is about a review of you displayed on somebody’s website, we cannot action it directly. We do not hold that data and we cannot reach into a customer’s site. The people who can are the owner of the website showing it, and Google, where the review actually lives. If you tell us which site it is, we will pass your request to the licence holder where we can identify them.

If you are in California

We do not sell or share personal information as those terms are used in the CCPA, and we offer no financial incentives in exchange for data. You can still ask what we hold and ask us to delete it, at the same address.

GetReviewX is a business tool sold to website owners. It is not directed at children, it is not marketed to them, and it is not intended for anyone under 16. We do not knowingly collect personal data from under-16s.

If you believe a child has given us personal data — through a support email, for instance — write to [email protected] and we will delete it.

We will update this page when the product changes or when we have got something wrong. The date at the top is the one that counts.

If a change is material — new data collected, a new purpose for existing data, or a new provider handling it — we will say so at the top of this page and email current licence holders. We will not quietly widen what we collect and rely on you re-reading the page.

Email [email protected]. If the question is about your account, include your licence key or the email address you bought with so we can find you quickly.

For what you get when you buy a licence, and the rules that go with it, see the terms.