Privacy Policy

1. Introduction

This Privacy Policy explains what information X18Reviews collects, how it is used, when it may be shared, and the choices you have. It is written to be read, not skimmed: if anything here is unclear, contact us and we will explain it in plain terms.

A large part of this policy concerns data X18Reviews receives from Google on your behalf. In short: X18Reviews only accesses Google Business Profile data for profiles you are already authorized to manage, only after you explicitly connect your Google account, and only to provide the features you ask for. X18Reviews does not sell Google user data, does not use it for advertising, and does not use it to train generalized artificial-intelligence models.

2. Who operates X18Reviews

X18Reviews is a software product operated by X18, run by Leeor Meirovitz in Melbourne, Victoria, Australia. References in this policy to “X18Reviews”, “we”, “us”, or “our” mean the operating entity. X18Reviews is an independent product: it is not affiliated with, sponsored by, or endorsed by Google.

3. Scope of this policy

This policy applies to the X18Reviews web application and to the public pages of the X18Reviews website. It does not apply to Google’s own products and services — including Google Business Profile itself — which are governed by Google’s own privacy policies and terms.

4. Information you provide to us

When you create an X18Reviews account, we collect the information you enter directly:

• Your name.
• Your business email address.
• A password, which is stored in hashed form — we never store or see your password in plain text.

We also receive information you choose to send us directly, for example when you contact support by email.

5. Google Business Profile data

What we receive

If — and only if — you choose to connect your Google account, X18Reviews may access the following categories of Google Business Profile data:

• Basic Google account information used to identify the connection.
• The list of business locations and profiles your Google account is authorized to manage.
• Business information for those profiles, such as the business name and address.
• Google reviews for those profiles, including star ratings and review text.
• Replies to those reviews.
• Supported profile performance information, where available.

How we receive it

Access happens exclusively through Google’s official APIs, using an OAuth authorization that you grant on Google’s own consent screen. The only Google permission X18Reviews requests is the Google Business Profile management scope (https://www.googleapis.com/auth/business.manage). X18Reviews can only ever see profiles your Google account is already authorized to manage — connecting X18Reviews never grants you, or us, access to any business you could not already manage in Google directly.

Why we receive it

We use Google Business Profile data solely to provide the features you request in the product:

• Showing you the business profiles connected to your account.
• Displaying your Google reviews in one place.
• Helping you draft replies to reviews, including AI-assisted drafts you request.
• Publishing the review replies you deliberately choose to publish.
• Displaying supported profile and performance information.
• Generating neutral review links and QR codes for the profiles you manage.

For more detail written in plain language, see Google Data & Permissions.

6. AI-assisted functionality

X18Reviews can generate a suggested draft reply to a review when you ask it to. This is drafts only: nothing is ever published automatically. You review the draft, edit it as you see fit, and it is only published when you deliberately click Publish.

To generate a draft you request, the text of the relevant review may be processed by an AI service provider (OpenAI) acting on our behalf, solely to create that draft. Google user data is not used to train generalized or shared AI or machine-learning models.

7. How we use information

We use the information described above to:

• Create and maintain your X18Reviews account.
• Provide, operate, and secure the features you request.
• Respond to your support requests.
• Communicate with you about your account and important service changes.
• Comply with legal obligations.

We do not use your information for purposes unrelated to providing and improving the service you signed up for.

8. How information may be shared

We do not sell your personal information. We share information only:

• With service providers who process it on our behalf to run the product — for example our hosting and database infrastructure providers (Vercel and Supabase) and, for AI-assisted drafts you request, the AI service provider described above. Service providers are only permitted to process the data as needed to provide their service to us.
• When required by law, legal process, or a governmental request, or to protect the rights, safety, or property of X18Reviews, our users, or others.
• In connection with a business transfer, such as a merger or acquisition — in which case this policy’s commitments regarding Google user data continue to apply to that data.

9. Our commitments for Google user data

X18Reviews’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including applicable Limited Use requirements.

10. Storage and caching of Google API content

Content received from the Google Business Profile API — such as reviews and business information — is treated as temporarily cached data, not as a permanent archive. Where applicable, such cached content is retained for up to 30 calendar days before being refreshed or removed. The authoritative copy of your Business Profile data always remains with Google.

Different categories of data follow different retention rules:

• A. Google API content (reviews, business information, performance data): temporarily cached as described above — up to 30 calendar days where applicable — and removed when you disconnect Google or delete your account.
• B. X18Reviews account information (your name, business email, hashed password): retained for as long as your account exists.
• C. Your settings and preferences within X18Reviews: retained for as long as your account exists.
• D. Billing records, if paid plans are ever introduced: retained as required by tax and accounting law, which can extend beyond account deletion.

11. Data retention

We keep information only as long as it is needed for the purposes described in this policy. When you delete your X18Reviews account, we delete the associated data described above, except where we are legally required to retain specific records (for example, billing or tax records) — in which case we retain only what the law requires, only for as long as it requires.

12. Deleting your data

You can request deletion of your X18Reviews account and associated data at any time. The full process — including what is deleted and what disconnecting Google does and does not do — is described on the Data Deletion page. Deleting your X18Reviews account never deletes your Google Business Profile or your Google reviews: those live with Google and remain untouched.

13. Revoking Google access

You can disconnect your Google account from X18Reviews at any time, in either of two ways:

• From the settings area inside X18Reviews.
• From your Google Account’s third-party access page, where you can revoke X18Reviews’ access directly with Google.

Disconnecting stops X18Reviews’ access to your Google Business Profile data. It does not delete your Google Business Profile, your reviews, or anything else in your Google account.

14. Security

We use reasonable administrative, technical, and organizational measures designed to protect information — including transport encryption for data in transit and access controls limiting who can reach production systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; we work to protect your information and to respond appropriately if an issue arises.

15. International processing

X18Reviews is operated from Australia. Information is processed and stored by our service providers, which may be located outside Australia — for example, our database infrastructure is hosted in the European Union. Where information is transferred across borders, we take steps designed to ensure it remains protected consistent with this policy.

16. Cookies

X18Reviews uses cookies that are necessary to operate the service — for example, to keep you signed in. We do not currently use third-party advertising or analytics cookies; if that changes, this policy will be updated first.

17. Children’s privacy

X18Reviews is a business tool and is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it.

18. Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the “Last updated” date above and, where appropriate, notify you through the service or by email. Continued use of X18Reviews after an update means the updated policy applies.

19. Contact

Questions about this policy or about your data can be sent to privacy@x18reviews.com. X18Reviews is operated from Melbourne, Victoria, Australia.