Privacy Policy
1. Who we are
GetReviewX is a WordPress plugin published by TheDevGarden (“we”, “us”, “GetReviewX”). TheDevGarden is the data controller for the getreviewx.com website and for the small amount of account and licensing data described in section 6.
Contact: [email protected]. Postal address and any statutory representative details are listed in section 16.
2. How to read this policy — two very different roles
GetReviewX is self-hosted software. Almost everything it does happens on a WordPress server that you control, not on ours. That makes the split below the single most important thing on this page:
| Where | What lives there | Who controls it |
|---|---|---|
| Your WordPress site | Google reviews, reviewer names, avatar URLs, review photos, your OAuth tokens, your curation choices, plugin settings | You. We have no access to it. |
| Our servers | Your licence key, the site URLs it is activated on, the plugin version those sites report, and your billing record held by our payment provider | Us, as controller. |
We never receive your review data. Review text, reviewer names, avatars, photos, ratings, owner replies and your curation choices are fetched by your server directly from Google and stored in your own WordPress database. They are not transmitted to GetReviewX or TheDevGarden at any point, under any plan.
If you are a visitor to a website that uses GetReviewX and you have a question about a review displayed there, contact that website’s operator. They are the controller of that content. If your concern is with the review itself as published on Google, Google is the place to raise it.
3. What the plugin stores on your site
When you connect a Google Business Profile location, GetReviewX creates its own tables in your WordPress database and caches the following review content there:
- Reviewer display name as Google returns it, or an anonymity flag when the reviewer is anonymous.
- Reviewer profile photo URL (the URL only; the image is served from Google, we do not copy it).
- Star rating (1–5).
- Review text as written by the reviewer.
- Media URLs for photos or videos attached to the review.
- The business owner’s reply and when it was last updated.
- The review’s source URL and identifier, its publication date and its last-updated date.
- Timestamps recording when your site fetched the review and when the cache entry expires.
It also stores your own configuration: which locations are connected, your sync interval, your display defaults, and your curation state (order, pinned reviews, hidden reviews). Curation state is your data, not Google’s, and is kept in a separate table.
Cached review content expires after a maximum of 25 days and is deleted by a scheduled purge. This keeps the plugin inside Google’s content-caching limits. Reviews that still exist on Google are re-fetched at your next sync; reviews Google no longer returns simply disappear from your site.
Uninstalling the plugin through the WordPress plugins screen removes its tables and options from your database. Deactivating it does not.
Because this data sits on your server, you are the controller of it for the purposes of the UK GDPR, the EU GDPR and comparable laws, and your own site’s privacy notice should account for it.
4. Google account access and tokens
Connecting a location uses Google’s OAuth 2.0 flow. You sign in to Google directly — we never see your Google password — and grant read access to your Business Profile information and reviews.
- The resulting access token and refresh token are stored on your own WordPress site, encrypted at rest using your site’s own WordPress salts as the key material.
- Those tokens are never transmitted to GetReviewX or TheDevGarden. We have no copy of them and no way to act on your Google account.
- Your server calls Google’s API directly. There is no proxy or relay operated by us in that path.
- The plugin requests read-only access to review and location data. It does not request permission to post, edit or delete reviews, and it does not read your Gmail, Drive, Calendar or contacts.
You can revoke access at any time from the plugin’s settings screen, or from Google’s Third-party apps & services page. Revoking stops future syncs immediately. Already-cached reviews remain in your database until you disconnect the location, uninstall the plugin, or the 25-day expiry purges them.
5. Google API Services User Data Policy — Limited Use
GetReviewX’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- Data obtained from Google APIs is used only to provide the review-display features the site owner installed the plugin for.
- It is not transferred to us, to advertisers, to data brokers, or to any other third party.
- It is not used for advertising, for building user profiles, or for credit assessment.
- No human at TheDevGarden reads it, because it never leaves the site owner’s server.
6. What is sent to us
One request travels from your WordPress site to our infrastructure: the update and licence
check, which runs on WordPress’s normal update schedule against
updates.getreviewx.com. It transmits exactly:
| Field | Example | Why |
|---|---|---|
| Licence key | GRX-XXXX-XXXX-XXXX |
To confirm the site is entitled to download an update. |
| Site URL | https://example.com |
To count and manage activations against your licence’s site limit. |
| Plugin version | 1.0.0 |
To decide whether a newer release applies to you. |
| User-agent header | GetReviewX/1.0.0; https://example.com |
Sent automatically by the plugin’s HTTP request; carries the same two facts. |
Our server also records the standard request metadata any web server records: the requesting IP address, the timestamp and the response status. These logs are used for abuse prevention and debugging and are deleted within 30 days.
No review content, no reviewer information, no Google tokens, no WordPress user accounts and no site content are included in that request. If you never enter a licence key, the check still runs so that WordPress can tell you an update exists, and it sends only the site URL and plugin version.
If you buy a licence, our payment provider records the information you give it at checkout: name, email address, billing country and the tax identifiers required for invoicing. We receive your name, email and licence status. We never see or store your card number.
If you email support, we hold that correspondence — your email address and whatever you choose to include, such as a site URL or a diagnostics report — for as long as needed to resolve the issue and for up to two years afterwards as a support history.
Our lawful bases are: performance of a contract (licensing, updates, support) and legitimate interests (preventing licence abuse, keeping the update service running, and defending legal claims).
7. The getreviewx.com website
This marketing site is static. It sets no cookies, runs no analytics script, embeds no tracking pixels, and has no comment form or newsletter sign-up. It loads a web font from Google Fonts; that request reveals your IP address and user agent to Google as a technical consequence of fetching the file, and Google states that it does not use Google Fonts requests to build advertising profiles. Nothing else on the page contacts a third party.
Our host records standard server logs (IP address, timestamp, requested path, user agent) for security and capacity purposes.
8. Service providers
We use a small number of processors, each limited to the purpose listed:
- Cloudflare — hosting and delivery of this website and the update service, and its request logs.
- Dodo Payments — checkout, payment processing, invoicing and licence-key issuance. Dodo acts as merchant of record and is a controller of your billing data under its own privacy policy.
- Our email provider — delivery and storage of support correspondence and transactional email.
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
9. Retention
| Data | Held by | Kept for |
|---|---|---|
| Cached Google review content | Your site | Maximum 25 days, then purged automatically |
| Curation state (order, pins, hidden flags) | Your site | Until you change it or uninstall the plugin |
| Google OAuth tokens | Your site, encrypted | Until you disconnect or uninstall |
| Licence record and activated site URLs | Us | Licence term plus 12 months |
| Update-service request logs | Us | 30 days |
| Support correspondence | Us | Up to 2 years after the ticket closes |
| Invoices and tax records | Payment provider and us | As required by tax law, typically 6–10 years |
10. Cookies
getreviewx.com sets no cookies at all — not analytics, not advertising, not preference cookies. There is no consent banner because there is nothing to consent to.
The plugin sets no front-end cookies on your visitors either. Inside wp-admin it relies on WordPress’s own authentication cookies and nonces, which WordPress sets for any logged-in administrator regardless of this plugin.
11. Your rights
Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent where consent is the basis. To exercise any of these against data we hold, email us at [email protected]. We respond within 30 days and do not charge for a first request.
For data held on a site running the plugin, the site’s operator is the controller and must handle the request — we cannot reach into a customer’s database. Site operators: the plugin’s admin screens let you hide any individual review and disconnect a location, and uninstalling removes the cached data entirely.
If you are in the UK or EEA and think we have handled your data badly, you may complain to your national supervisory authority. We would rather you told us first.
12. Security
All traffic to getreviewx.com and updates.getreviewx.com is served over HTTPS. OAuth tokens are encrypted at rest on the customer’s site. Licence-vendor API credentials are held as server-side secrets and are never exposed to a browser or to plugin code. Access to our systems is limited to the people who need it.
No system is perfectly secure. The security of the WordPress installation the plugin runs on — its hosting, its updates, its administrator passwords — is the site owner’s responsibility.
13. Children
GetReviewX is a business tool and is not directed at anyone under 16. We do not knowingly collect personal data from children. If you believe a child has given us data, tell us and we will delete it.
14. International transfers
Our infrastructure and processors may store or process data outside your country, including in the United States. Where personal data leaves the UK or EEA, transfers rely on the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or an adequacy decision, as applicable to the provider concerned.
15. Changes to this policy
We update this page when the product changes. The effective date at the top always reflects the current version. Material changes — anything that widens what we collect or what we do with it — will be announced by email to licence holders at least 14 days before they take effect.
16. Contact
Email: [email protected]
Company: TheDevGarden —
thedevgarden.com
Postal address: available on request and listed on our company page.
For privacy questions specifically, put “Privacy” in the subject line and we will route it accordingly.