US Privacy Notice

Last updated: 31 May 2026

This notice describes how Review Mitra ("we", "us") collects and processes personal information of users located in the United States, and explains your rights under the California Consumer Privacy Act as amended by the CPRA ("CCPA"), the Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, and other US state privacy laws.

1. Who is the controller / business

For data you provide directly to Review Mitra (your merchant account, billing info, support requests), Review Mitra is the Business / Controller. For data the merchant collects from their own customers using our platform (customer phone numbers, review text), the merchant is the Business / Controllerand Review Mitra is the Service Provider / Processor.

2. Categories of personal information we collect

Identifiers: name, email, phone, IP address.
Commercial information: plan purchased, billing history.
Internet/network activity: pages viewed, device, browser, referrer.
Geolocation: approximate (city/country) from IP only.
Inferences: review volume, usage tier.

We do not knowingly collect Sensitive Personal Information as defined by the CPRA.

3. How we use it

To deliver the service, bill you, send transactional emails, prevent fraud and abuse, comply with law, and improve the product in aggregate. We do not use your information for targeted advertising or profiling that produces legal effects.

4. Sale or sharing of personal information

We do not sell personal information for money, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA. There is therefore no "Do Not Sell or Share My Personal Information" action required, but you may still exercise the rights below.

5. Your rights

Depending on your state of residence you have the right to:

Know what personal information we hold about you;
Access and receive a portable copy;
Correct inaccurate information;
Delete your information (subject to legal retention);
Opt out of sale, sharing, or targeted-advertising processing (not applicable here — see §4);
Be free from retaliation for exercising any of the above.

To exercise these rights, email samiirh@gmail.com with the subject line "US privacy request" and the state you reside in. We will verify your identity using the email on file and respond within 45 days (extendable once by 45 days as permitted by CCPA).

6. Authorized agents and appeals

California, Virginia, Colorado, and Connecticut residents may use an authorized agent. We require written authorization signed by you. If we deny a request, you may appeal by replying to our decision email; we will respond within 45 days.

7. Children

Our service is not directed to children under 16. We do not knowingly collect personal information from minors, and we do not sell or share minors' data.

8. Data retention

Account data is retained while your account is active and for up to 3 years thereafter for tax/audit and fraud purposes. Customer data uploaded by merchants is retained per the merchant's instructions and deleted within 30 days of a merchant's verified deletion request, subject to legal hold.

9. Security

We use industry-standard administrative, technical, and physical safeguards including encryption in transit, encryption at rest for sensitive fields, role-based access control, and audit logging. No method of transmission over the internet is 100% secure.

10. Changes & contact

We may update this notice from time to time. The "Last updated" date at the top reflects the latest revision. Contact: samiirh@gmail.com.

This notice is provided in good faith and is not legal advice. Consult a US-licensed attorney for advice specific to your situation.