Privacy Policy

1. About Review Hunter

This Privacy Policy explains how UMT GROUP LLC ("Review Hunter," "we," "us," or "our") collects, uses, discloses, stores, protects, and deletes information in connection with Review Hunter websites, online stores, software dashboards, NFC/QR review products, customer feedback pages, messaging tools, AI features, and authorized third-party integrations (the "Services").

Review Hunter provides online reputation and customer-feedback tools for local businesses, such as restaurants, salons, healthcare practices, hospitality businesses, and other service providers. Features may include review links, NFC/QR cards, permission-based SMS and WhatsApp messages, private feedback, performance analytics, and — when available and authorized — Google Business Profile review management.

This Policy covers information that we collect directly and information processed on behalf of businesses using our Services.

2. Company and Contact Information

The operator of Review Hunter is:

UMT GROUP LLC
2348 83rd St, Apt 3
Brooklyn, NY 11214
United States

Brand and Service: Review Hunter
Privacy and Support: support@lc.review-hunter.com
Phone: +1 (917) 719-1239

3. Business Users and End Customers

A Business User is a business owner, team member, or authorized representative who uses Review Hunter. An End Customer is a person who receives a review request, scans an NFC/QR product, opens a review page, or provides feedback to a Business User.

Business Users generally decide why and how they use their customers' information to request reviews or resolve feedback. Review Hunter processes that information to provide the selected services under the Business User's instructions, subject to applicable law and this Policy. End Customers usually do not need to create a Review Hunter account.

For information we collect for our own website operations, sales, support, security, and account administration, UMT GROUP LLC determines the applicable processing purposes.

4. Information We May Collect

4.1. Account and user information

• Name, email address, phone number, and account identifiers.
• Authentication information, protected password representations, account status, and sign-in records.
• Support requests, settings, and communication preferences.
• Browser, device, IP address, session, and security log information.

4.2. Local business information

• Business name, physical location, contact information, and review-platform links.
• Location, branding, team, review collection, messaging, and card settings.
• NFC/QR product identifiers, activation data, and card-specific performance records.
• Information provided by Business Users to configure or manage their accounts.

4.3. End Customer information

• Name, phone number, and email address, where provided by a Business User or End Customer.
• Customer feedback, ratings, complaints, replies, and relevant conversation history.
• Message delivery, interaction, consent, and opt-out status.
• Context supplied by the Business User to provide the selected feedback service, such as the location or time of a visit or service.

Business Users must have a lawful basis and any required consent to collect, upload, and use End Customer information. Review Hunter is not designed to receive unrelated or excessive customer data.

4.4. NFC, QR, and review-page activity

When a person taps an NFC card, scans a QR code, or opens a review page, we may process the card or link identifier, associated business, time of access, visit or interaction events, and technical information needed to operate and analyze the page. A public review submitted directly to Google or another third-party platform is subject to that platform's own privacy practices.

4.5. Website, purchasing, and billing information

We may collect website usage data, cart and order information, shipping and billing contact details, product selections, subscription status, payment status, transaction IDs, and invoice information. Payment-card details are generally handled by the payment processor rather than stored in full by Review Hunter.

5. How We Use Information

We use the information described above as needed to:

• Provide, maintain, and secure Review Hunter websites, storefronts, dashboards, and accounts.
• Register, activate, and manage NFC/QR review products and business locations.
• Deliver authorized customer-feedback and review-request messages.
• Present review links, private feedback forms, analytics, and reporting.
• Support integrations and review-management features authorized by the Business User.
• Generate suggested AI replies or perform separately authorized AI actions, when supported.
• Process purchases, subscriptions, invoices, and customer support requests.
• Detect spam, fraud, security incidents, misuse, and technical failures.
• Meet applicable legal obligations and enforce service terms.

We do not use Google Business Profile user data to build advertising audiences or for advertising profiling. See Sections 9–15 for the more specific restrictions governing Google data.

6. SMS, WhatsApp, and Customer Communications

Review Hunter may enable Business Users to send customer feedback or review requests using SMS and WhatsApp through supported communications providers. Data processed for this purpose may include the recipient's phone number, sender identifiers, template or message text, replies, timestamps, delivery and error status, and opt-out or consent records.

Consent and messaging rules

Business Users are responsible for obtaining and maintaining any consent required for SMS and WhatsApp communications; following applicable laws and platform messaging policies; supplying accurate sender information; and honoring requests to stop receiving messages. Review Hunter may apply sending limits, template controls, and abuse-prevention measures.

Opting out

For supported SMS messages, recipients can generally reply STOP to opt out and HELP for assistance. WhatsApp recipients may use the applicable WhatsApp controls or the opt-out method stated in the message. Opt-out records may be retained to prevent additional messages.

Message content and metadata may be processed by the communications provider to deliver messages and satisfy its technical and legal requirements. Recipients should refer to the relevant provider's privacy terms for information about its independent practices.

7. Private Feedback and Customer Complaints

If an End Customer chooses to send private feedback through a Review Hunter page, we may collect their rating, comments, selected issue categories, name, email, phone number, and any other information they voluntarily provide.

We process this information to make the feedback available to the relevant Business User, enable follow-up, and support customer service workflows. The business may receive the feedback and contact details provided for that purpose.

Private feedback is an additional option and must not be used to prevent someone from posting an honest public review. The availability of public review options should not depend on whether the customer rated the business positively or negatively.

8. Google Business Profile Integration — Availability and Authorization

Review Hunter is preparing support for connecting eligible Google Business Profiles and managing reviews through authorized Google APIs. These integration features may not yet be available to all customers. The descriptions below apply if and when a particular feature becomes available, a Business User enables it, and Google grants the necessary access.

Where supported, a Business User connects a Google account through Google's official OAuth 2.0 authorization process. The user chooses whether to authorize Review Hunter and can review the requested permissions in Google's consent interface.

9. Categories of Google User Data

If a Business User authorizes Google Business Profile integration, Review Hunter may access the following categories, limited to what is needed for enabled features:

9.1. Google account and Business Profile identifiers

• Google account identifiers and Business Profile account IDs.
• Account or location access information necessary to display profiles the authorized user may manage.

Purpose: identify the authorized connection and allow the user to select the correct business or location.

9.2. Business locations

• Business Profile location ID, business name and address.
• Location identifiers and review links, where supplied by Google's APIs, such as placeId, mapsUri, or newReviewUri.

Purpose: associate an authorized Google location with the correct business in Review Hunter, display connected locations, and power requested review features.

9.3. Review and reply information

• Review identifier, star rating, review text, and available reviewer display information.
• Review creation and update timestamps.
• Existing business replies and related timestamps.

Purpose: display and synchronize reviews; help the Business User draft, review, publish, edit, or delete their own replies, subject to granted permissions; and provide enabled AI-assisted response features.

9.4. OAuth permissions and credentials

• Authorized OAuth scopes, access tokens, refresh tokens, expiration information, and technical integration state.
• Connection time, last successful sync, disconnection, and error/status records.

Purpose: securely maintain an authorized connection, perform allowed Google API requests, and diagnose integration issues.

Where applicable, the requested scope may include https://www.googleapis.com/auth/business.manage. We will request only scopes required for the features the Business User chooses to enable.

10. How Google User Data Is Used

Authorized Google user data is used only to provide or improve visible, user-requested Review Hunter functions, including:

• Connecting a Google Business Profile and displaying authorized accounts and locations.
• Retrieving and showing reviews and authorized location information.
• Synchronizing review status and displaying business replies.
• Drafting, publishing, editing, or deleting review replies at the Business User's direction.
• Generating AI-assisted review replies when the user invokes that feature.
• Automatically publishing replies only after the Business User separately and explicitly enables that action.
• Maintaining integration security, diagnostics, and access controls.

Review Hunter will not use Google user data for a new, materially different purpose without updating applicable disclosures and obtaining consent where required.

11. Google API Services — Limited Use and Restricted Sharing

Use of information received through Google API Services is subject to the Google API Services User Data Policy, including its Limited Use requirements where applicable, and the Google Business Profile API policies.

Google user data:

• Is used only to provide or improve appropriately disclosed, user-facing features or for other uses Google expressly permits.
• Is not sold, licensed to data brokers, or provided to information resellers.
• Is not used to target, personalize, or retarget advertising, or to build advertising profiles.
• Is not used to determine creditworthiness or make lending decisions.
• Is not transferred to third parties except as needed for a permitted user-facing feature with required consent, security, legal compliance, or another transfer expressly permitted by Google.

Human access

Employees and contractors do not routinely read Google user data. Human access is limited to cases allowed by Google's policies, such as where a user gives affirmative agreement for support to inspect specific data, where access is necessary for security or abuse investigation, where legally required, or where appropriately aggregated/de-identified data is used for permitted internal operations. Authorized personnel are subject to appropriate confidentiality and access restrictions.

12. Storage and Retention of Google Business Profile API Content

We do not use the Google Business Profile APIs to build an independent, permanent database of Google Business Profile content for use outside the authorized integration.

If limited caching of content delivered by the Google Business Profile APIs is needed to improve the performance of an enabled feature, such content is handled according to Google policy: securely stored, not impermissibly manipulated or aggregated, and kept for no more than 30 calendar days. After that period, the cached content is refreshed from Google or deleted and no longer used.

This rule also applies to review links and location information to the extent Google classifies them as API Content. Data the Business User enters directly and data subject to independent legal-retention requirements may have different retention rules.

13. Google OAuth Tokens and Security

OAuth access and refresh tokens are confidential. Our intended controls include encrypted storage, protected transmission, least-privilege access, restricted access by authorized systems, and avoiding the recording of unredacted tokens in application logs.

Tokens are used only for authorized Google API operations. When an authorized integration is disconnected or a token is no longer needed, Review Hunter stops using it and revokes or deletes it as technically applicable, subject to relevant security and backup processes.

14. Disconnecting Google and Requesting Google Data Deletion

Once the Google Business Profile integration is made available, Business Users will be able to disconnect it using the available integration controls or by contacting support@lc.review-hunter.com. Users may also revoke third-party access in their Google Account settings.

After disconnection, Review Hunter will stop future authorized synchronization and publishing operations for the disconnected connection, including enabled automatic AI replies; invalidate or delete unnecessary tokens; and remove Google API cache and connection data no longer required for a lawful purpose.

For a verified deletion request, Google user data no longer required for service delivery or a legal obligation will be deleted or irreversibly de-identified from active systems within 30 days. Unneeded access and refresh tokens will be revoked and removed without undue delay. Residual data in protected backups may persist only until the applicable routine backup-rotation period expires and is not used to restart a disconnected integration.

15. AI-Generated Google Review Replies and Authorized Actions

Review Hunter has developed functionality for AI-assisted review replies; customer availability depends on Google API access and activation of the applicable integration.

When offered and enabled, the Business User may ask Review Hunter to prepare a suggested response based on review text, rating, relevant business context, and prior replies. Any automated publishing feature is off unless the Business User makes a separate, explicit choice to enable it.

Before enabling automated publication, we will explain that Review Hunter may retrieve new reviews, transmit the minimum necessary information to an AI service provider when permitted, generate a reply, and publish that reply to the Business User's Google Business Profile. The Business User will be able to disable automated replies.

Review Hunter will act only within the Google permissions and consent granted by the Business User and will not claim that a generated reply was personally written by a human where that would be misleading.

16. Honest Reviews and Platform Policies

Review Hunter aims to support authentic feedback and complies with applicable platform rules. Business Users may not use our Services to:

• Prevent customers from leaving negative reviews or make public review opportunities depend on a favorable rating.
• Require a positive review or offer incentives only in exchange for positive feedback.
• Impersonate customers, post fabricated reviews, or artificially manipulate public ratings.
• Otherwise violate Google Maps' user-contributed content policies or the rules of another review platform.

Review Hunter's private feedback option is offered to help businesses resolve issues, not as a replacement for a customer's choice to write an honest public review.

17. Other Artificial Intelligence Features

Where enabled, AI may be used for generating suggested review replies, assisting customer conversations, summarizing feedback, and supporting related user-facing functions. AI processing may be provided by third-party technology providers, which may include OpenAI or Google Gemini if configured for the relevant feature.

Depending on the enabled function, limited relevant context may be provided to the AI provider, such as review text and rating, the business name, a conversation history, or response instructions. We seek to minimize personal data and share Google user data with an AI provider only where doing so is required for an authorized user-facing feature and permitted by Google's policies.

Google user data is not sent to AI providers for advertising or retargeting. Details of an AI provider's own processing practices are governed by the applicable service arrangement and disclosures.

18. Purchases, Subscriptions, and Payment Processing

Review Hunter sells NFC/QR products and may offer paid software subscriptions and usage-based messaging. We may process customer names, billing and delivery addresses, purchased products, subscription configuration, invoices, amounts, currency, payment status, refunds, and transaction references.

Payments may be processed by third-party payment service providers, including Stripe where configured. Payment-card information is processed by the applicable payment service provider under its own terms and privacy notice; we generally receive limited information needed for order management, accounting, fraud prevention, and customer support.

19. Cookies, Analytics, and Advertising Tools

Review Hunter websites may use cookies and similar technologies for security, sign-in sessions, shopping cart functions, analytics, and — where enabled — advertising measurement. Providers may include Google Analytics, Google Ads, Meta Pixel, or other services actually configured on the website.

Depending on settings and applicable consent requirements, such technologies may collect IP addresses, device and browser information, pages viewed, interaction events, referring URLs, and cookie identifiers. Browser or consent tools may permit you to manage nonessential cookies.

20. Email Communications

We may use an email delivery provider, such as SendGrid where configured, to send transactional messages, service notices, support replies, receipts, and other permitted communications. Information shared may include the recipient's email address, name if needed, message content, and delivery status.

Where marketing emails are sent, we provide any legally required opt-out mechanism. Service-related messages may still be sent when needed to operate an account or complete a transaction.

21. How Information Is Shared

We do not sell personal information. We may disclose limited information to:

• Business Users: the business responsible for a review request or private feedback, to deliver the selected service and address customer issues.
• Service providers: providers of hosting, security, messaging (including SMS/WhatsApp), email, analytics, payment processing, support, and AI functions, only where necessary for the relevant service.
• Connected platforms: Google and other review platforms when users authorize or choose interactions governed by those platforms.
• Authorities or other parties: when disclosure is required by law, needed to protect rights and safety, or permitted in a legitimate corporate transaction subject to applicable requirements.

Depending on the features actually enabled, providers may include AWS or Hetzner for hosting, Twilio or comparable messaging providers, OpenAI or Google for AI features, Stripe for payments, and SendGrid for email. The exact providers used may vary by feature and over time.

Additional limitations apply to Google user data as described in Section 11 and to mobile opt-in information as described in Section 6.

22. International Processing and Transfers

UMT GROUP LLC is based in the United States. Our infrastructure and service providers may process information in the United States or in other countries in which they operate. Based on our service configuration, hosting and processing may include European locations as well.

Where cross-border transfers are subject to applicable requirements, we use reasonable contractual, technical, and organizational protections appropriate to the information and processing involved.

23. Retention of Information

We retain information for as long as reasonably needed to provide the applicable service, meet business and legal obligations, resolve disputes, maintain security, and prevent abuse.

• Google Business Profile API Content: limited cache retained no longer than 30 calendar days, when caching is permitted and necessary.
• Google user data on verified deletion requests: deleted or irreversibly de-identified from active systems within 30 days when not otherwise required by law.
• Message suppression records: may be kept as needed to honor opt-outs and avoid unwanted future messages.
• Billing and transaction records: may be retained for applicable tax, accounting, and legal periods.
• Other account and operational records: retained for the applicable business purpose and deleted or de-identified when no longer needed.

Where a shorter retention period is required by platform terms or law, that more restrictive period applies.

24. Backups and Information Security

We use reasonable technical and organizational measures intended to protect information from unauthorized access, alteration, loss, disclosure, and misuse. These measures may include encrypted communications, access controls, system monitoring, and protected backups.

Information removed from active systems may remain temporarily in routine backups until the relevant backup rotation ends. Such residual data is not used for normal application processing. No information system can guarantee absolute security.

25. Privacy Rights and Data Requests

Depending on where you live and the laws that apply, you may have rights to request access to personal information, correction, deletion, portability, information about disclosures, or to exercise other applicable privacy choices. We do not sell personal information.

For privacy requests, email support@lc.review-hunter.com. We may take reasonable steps to verify identity or authority before responding. We aim to process verified requests promptly and within applicable legal deadlines; the 30-day active-system deletion approach described in this Policy applies where appropriate, but statutory response periods may differ.

California and other U.S. state privacy rights

Residents of California and other states with applicable privacy laws may have additional rights, subject to eligibility and legal exceptions. We will not discriminate against users for properly exercising applicable privacy rights.

End Customers may also contact the local business that originally collected or supplied their data; the business may need to authorize certain changes to data processed on its behalf.

26. Children's Privacy and Sensitive Information

Review Hunter is intended for businesses and business representatives, not for children. We do not knowingly solicit personal information from children under 13. If you believe information about a child has been provided without appropriate authorization, please contact us so we can investigate and take the necessary steps.

Users and End Customers should avoid submitting sensitive personal information (such as medical details, financial account numbers, government identifiers, or other highly sensitive content) in public reviews or free-text feedback unless it is truly necessary and legally appropriate.

27. Changes to This Privacy Policy

We may update this Privacy Policy as our Services, integrations, data practices, service providers, and legal obligations change. We will post the revised version and update the "Last updated" date. Where applicable law or Google policies require additional notice or renewed consent for a new use of Google user data, we will provide it before beginning that use.

28. Contact Us

If you are an End Customer asking about a particular business's messages or customer records, you may also contact that business directly.