Privacy Policy
This Privacy Policy explains how Rhythm Collective, LLC (“we,” “us,” or “our”) collects, uses, and shares information in connection with the Revempo platform and related websites and services (the “Service”). By using the Service, you agree to this Policy. It should be read together with our Terms of Use. The Service is offered only to businesses located in the United States and is intended for use within the United States.
1. Who this applies to
We handle information about two groups: (a) Customers — the businesses and people who hold a Revempo account; and (b) End Users — the customers of those businesses who visit a Review Page and leave a rating or feedback. For End-User Feedback, the Customer who owns the Review Page is the controller of that information, and we process it on the Customer’s behalf as their service provider.
2. Information we collect
Account information. When you register, we collect your name, email address, phone number, business name, business address, U.S. state, and a password, which is managed through our authentication provider. Business configuration. We store the Review Pages you create, including logos, colors, headings, keywords, staff names, links, and settings. Billing information. Payments are processed by Stripe; we receive limited subscription and status details but do not collect or store full payment-card numbers. End-User Feedback. When an End User uses a Review Page, we collect the star rating, the options they select, any private comments they submit, and any contact details they choose to provide. Usage information. We record first-party events such as QR scans, page opens, and review-button clicks, together with basic session data needed to operate and secure the Service and to produce analytics for Customers. We do not use third-party advertising or cross-site tracking technologies.
3. Cookies and similar technologies
We use a small number of first-party cookies and do not use advertising, analytics, or cross-site tracking cookies. Specifically: (a) strictly necessary cookies set by our authentication provider keep you signed in and secure your session — the Service cannot function without them; and (b) a functional cookie remembers a referral code (from a “?ref=” link) for up to 30 days so referrals are attributed correctly. Because we use no advertising trackers, you are not required to consent before using the Service; however, you can accept or decline the functional cookie at any time. . We also honor the Global Privacy Control (GPC) browser signal as a request to decline non-essential cookies.
4. How we use information
We use information to provide, secure, and improve the Service; to create and display analytics; to route End Users to a public review or a private feedback channel as configured by the Customer; to process subscriptions and prevent fraud; to communicate with Customers about their accounts; and to comply with legal obligations. We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use End-User Feedback for our own advertising.
5. How information is shared
We share information with service providers (subprocessors) that help us run the Service, including Supabase (database, authentication, and hosting), Stripe (payment processing), and Vercel (application hosting), each under terms that limit their use of the information to providing services to us. When an End User chooses to post a public review, they are directed to Google, and their interaction there is governed by Google’s own terms and privacy policy. We may disclose information if required by law or to protect our rights, users, or the public. If we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction.
6. We do not sell or share your information
We do not sell your personal information, and we do not share it for cross-context behavioral (targeted) advertising, as those terms are defined under the California Consumer Privacy Act and other U.S. state privacy laws. Because we do not engage in these activities, there is nothing to opt out of in that respect; even so, we honor the Global Privacy Control signal and the functional cookie choice described above. If this ever changes, we will update this Policy and provide the required opt-out controls before doing so.
7. Data retention
We retain account and configuration information for as long as your account is active and as needed to provide the Service, and Feedback and analytics for as long as reasonably necessary for the purposes described here or as directed by the Customer. We may retain certain information as required to comply with legal obligations, resolve disputes, and enforce our agreements.
8. Security
We use reasonable administrative and technical safeguards designed to protect information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9. Your privacy rights and choices
Depending on the U.S. state in which you live, you may have some or all of the following rights with respect to personal information about you: to confirm whether we process it and to access it; to correct inaccuracies; to delete it; to obtain a portable copy; to opt out of any sale, sharing for targeted advertising, or certain profiling (which we do not do); and to appeal a decision we make about your request. These rights are provided under laws including the California Consumer Privacy Act (as amended by the CPRA), the Tennessee Information Protection Act, and comparable comprehensive privacy laws in states such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others, and are subject to the conditions and exceptions in the applicable law.
Customers may access and update most account information directly from the dashboard, and may request deletion of their account by contacting us. To exercise any right, email trevor@rhythmco.com; we will verify your request as required by law and respond within the timeframe the applicable law provides, and you may appeal a denial by replying to our response. We will not discriminate against you for exercising your rights. End Users who submitted Feedback should contact the business whose Review Page they used (that business is the controller of the Feedback), or contact us and we will route the request to that business and assist as their service provider.
10. Children
The Service is intended for businesses and adults and is not directed to children. We do not knowingly collect personal information from children under 13.
11. Third-party links
The Service links to third-party sites, including Google. We are not responsible for the privacy practices of those sites, and we encourage you to review their policies.
12. U.S.-only Service
The Service is offered only to businesses located in the United States and is not intended for use outside the United States. We do not knowingly offer the Service to, or collect personal information from, businesses or individuals outside the United States.
13. Changes to this Policy
We may update this Policy from time to time. When we make material changes, we will update the “Effective” date and version above. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.
14. Contact
Questions about this Policy or your information, or want to exercise a privacy right? Contact Rhythm Collective, LLC at trevor@rhythmco.com.