Your reviews, your accounts, handled with care
ReviewComet connects through each review site's official API, asks only for the permissions it needs, and keeps every access token encrypted. This page sets out how we protect your account and your data.
Security in every part of the product
What protects your account, your connected review sites and the reviews that arrive from them, in plain words.
Account security with 2FA, recovery codes and sessions that end on their own.
- Turn on 2FA with an authenticator app. You get 10 recovery codes, each good for 1 use.
- Passwords are stored as salted hashes. Repeated failed sign-ins slow the next attempt down.
- You are signed out after 24 hours without activity. A new password signs out every other browser.
- Or sign in with Google, Microsoft or Facebook. We never see that password.
Access and roles so each person sees only what their work needs.
- 4 roles: Owner, Administrator, Manager and Moderator, each with its own limits.
- Limit any person to specific locations instead of all of them.
- On agency accounts, owners and administrators can require 2FA for staff or for everyone.
- The activity log shows who did what to a review, and when.
Review site permissions through the official APIs, never through your password.
- Every connection uses the review site's official API. Nothing is scraped and no browser is automated.
- We never receive the password of a connected account.
- Access tokens are encrypted with AES-256-GCM and never shown back to you or your team.
- Only an owner or administrator can disconnect a review site, and its token is deleted when they do.
Data and privacy with encryption, separation between customers, and hosting in western Europe.
- TLS 1.2 or better in transit, encryption at rest, and a second layer of encryption for access tokens.
- Every query is scoped to a location, so one customer cannot read another's data.
- Our database and file storage are hosted in western Europe. AI requests may be served from the United States.
- Strictly necessary cookies only. No ad cookies, no third-party analytics, no tracking pixels.
AI safeguards that keep the AI on your side of the conversation.
- Every review is read as text, never as instructions to follow.
- Replies are checked on the way out. One that names the AI, calls itself a bot or repeats your instructions is held for a person.
- Your content is not used to train AI models.
- AI runs only for the features you turn on, and each one can be switched off.
Payments handled by Stripe, with no card needed to start.
- Card payments run through Stripe. Full card numbers never touch our servers.
- We keep only the card brand and the last 4 digits, to show on your billing page.
- The 7-day FREE trial needs no credit card.
- Invoices are kept for 7 years, because tax law requires it.
The permissions we ask for, and why
Each review site shows a consent screen when you connect it. These are the permissions on Facebook's screen, and what each one is for.
| Permission | What it is for |
|---|---|
pages_show_list | Lists the Pages you manage, so you can pick which ones to connect. |
pages_read_engagement | Reads your Page's details and posts, which Facebook ties to the reviews on it. |
pages_read_user_content | Reads the reviews (recommendations) people leave on your Page. |
pages_manage_engagement | Posts your replies to reviews as your Page. |
pages_manage_metadata | Subscribes your Page to updates, so new reviews arrive within seconds. |
business_management | Meta requires it alongside the Page permissions. |
You can remove our access at any time in the review site's own settings, and collection stops at once.
Google, Trustpilot, App Store, and Google Play are coming soon. Each one is listed here with its permissions when it connects.
Your data, under your control
You decide how long reviews are kept, you can take a copy with you, and you can have it deleted.
Set how long reviews stay
Each location sets how long it keeps reviews, from 30 days to 24 months, 12 months by default. The privacy policy lists how long we keep everything else.
Take a copy
Export your reviews to CSV, up to 50,000 per file. For a full copy of your account, ask us and we answer within 1 month.
Have it deleted
Delete a review record, disconnect a review site, or delete your account from Settings. People who wrote a review can ask us to remove our copy of it too.
GDPR terms included
Our data processing addendum applies to every customer with no signature needed, and commits us to tell you about a breach within 48 hours.
The documents behind this page
- Privacy policyWhat we collect, why, who processes it and for how long.
- Data processing addendumOur processor terms, security measures and sub-processors.
- Deleting your dataEvery route to deletion, including for people who wrote a review.
- CookiesThe strictly necessary cookies we set, and what each one does.
- System statusWhether everything is running right now, and any incident updates.
Questions security teams ask us
Do you sell or share our data?
Is our content used to train AI models?
Where is our data stored?
Do you store our social media passwords?
Can we turn the AI off completely?
Can our security team review ReviewComet?
What happens if there is a breach?
How do we report a security issue?
See it on your own reviews with your data in safe hands
Connect your Facebook Page, turn on 2FA, and invite your team with the roles they need.
7-day FREE trial, no credit card required. Nothing is charged unless you add a card.