Privacy Policy

1. Overview

RAPPORTIQ AI PTY LTD (trading as RapportIQ, referred to here as “RapportIQ”, “we”, “us” or “our”) provides an AI-assisted platform that helps businesses monitor and respond to reviews across third-party platforms (such as Google, Yelp, Facebook, and others), understand local search demand, and reach their own customers. This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, how long we keep it, and the rights you have.

RapportIQ is available to businesses in Australia, New Zealand, the United Kingdom, the United States, Canada and India. Where a specific country’s law gives you additional rights, those rights are set out in the Your privacy rights section. If any term of this policy conflicts with a right you have under a law that cannot be excluded, that law prevails to the extent of the conflict.

2. Who this covers and our role

This policy applies to two groups of people:

• Account users - the business owners, managers and staff who create and use a RapportIQ account.
• End customers - the individuals whose information an account user brings into RapportIQ, for example a reviewer whose public review we read, or a customer whose contact details an owner uploads so that a review request or a reply can be sent.

For most information about end customers, the business is the party that decides why and how the information is used. In privacy law terms the business is the “controller” or “APP entity” and RapportIQ acts as a “processor” or service provider on the business’s written instructions. If you are an end customer and you want your information changed or removed, contact the business directly; we will help that business meet your request.

2.1 Data processing terms

When we process end-customer personal information on your behalf, we act as your processor or service provider, and we do so only to provide the Service and on your documented instructions (which include these terms and our agreement with you). In that role we commit to:

• processing the information only to provide the Service, and not selling it or using it for our own unrelated purposes;
• requiring our personnel and sub-processors to keep it confidential and to be bound by obligations consistent with this policy;
• applying appropriate technical and organisational security measures, as described in the Security section;
• using only the categories of sub-processor described in the Sharing section, and giving you a way to learn of material changes to them;
• assisting you, so far as reasonably possible, to respond to requests from individuals exercising their privacy rights, and to meet your own breach notification and impact assessment duties;
• notifying you without undue delay if we become aware of a personal data breach affecting information we process for you;
• deleting or returning the information at the end of our agreement, except where the law requires us to keep it;
• transferring the information across borders only with the safeguards described in the International data transfers section.

If you require a separate, signed data processing agreement to meet your legal obligations, contact us and we will provide one.

3. The information we collect

We collect the following categories of personal information:

• Account and profile data - your name, business name, email address, phone number, password (stored only as a secure hash), role, and the settings and preferences you choose.
• Business and location data - the details of the business and locations you manage, including public identifiers used to match your listing on third-party platforms.
• Connected platform data - when you connect a third-party platform (such as Google, Yelp, Facebook, and others), we receive the data that platform makes available for the connection, which may include your reviews, ratings, listing information, and the access tokens needed to read reviews and post replies on your behalf. Access tokens are encrypted and are never shown in the app.
• Content you create - reply drafts, notes, campaign and promotion content, and other material you produce in the product.
• Customer contact data you provide - where you upload or enter a customer’s name and phone number or email so that RapportIQ can send a review request or a private message on your behalf. Phone numbers used for messaging are stored in hashed form and the raw number is used only at the moment of delivery.
• Payment data - if billing is enabled for your account, our payment processor collects and processes your card details. We never receive or store full card numbers; we keep only a record of the transaction and subscription status.
• Usage, device and log data - how you interact with the product, along with IP address, browser and device type, and diagnostic logs used to keep the service secure and working.
• Communications - messages you send us, including support requests and survey responses.

We collect most of this information directly from you. Some is collected automatically as you use the product, and some is received from the third-party platforms you choose to connect.

4. How and why we use information

We use personal information to:

• provide, operate, secure and improve the RapportIQ service;
• read your reviews from connected third-party platforms, triage them, draft replies, and, where you have allowed it and the platform permits it, post approved replies on your behalf;
• send review requests and private messages to your customers when you ask us to, and only in a way that complies with the messaging laws that apply to you;
• generate analytics, insights and recommendations for your business;
• manage your account, process payments where billing is enabled, and provide support;
• send you service, security and administrative messages, and, where permitted, product updates you can opt out of;
• detect, investigate and prevent fraud, abuse and security incidents, and comply with our legal obligations.

Legal bases (United Kingdom, European Economic Area and similar regimes). Where UK or EU data protection law applies, we rely on: the performance of our contract with you to provide the service; our legitimate interests in operating, securing and improving the service and in keeping it free of abuse, balanced against your rights; your consent where we ask for it (for example certain marketing or non-essential cookies), which you can withdraw at any time; and compliance with a legal obligation. Where you bring end-customer data into RapportIQ, you are responsible for having a lawful basis to do so.

5. How we use AI to process information

RapportIQ uses artificial intelligence to read reviews, score them, draft replies and produce insights. AI processing runs through a specialist AI sub-processor under contract to us. That processing is subject to important limits:

• we do not permit your data or your customers’ data to be used to train third-party foundation models;
• published replies and other actions that speak for your business are governed by human-in-the-loop guardrails, so higher-risk items are always held for a person;
• AI output can be wrong or incomplete, so you remain responsible for reviewing anything before it is published.

Our full approach, including the specific guardrails and how to keep your account fully manual, is set out in the AI Policy.

6. Google user data and Limited Use

When you connect a Google account, RapportIQ accesses Google user data through Google APIs solely to provide and improve the features you have asked for, such as reading your business reviews and posting replies you have approved.

RapportIQ’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we use Google user data only to provide or improve user-facing features that are prominent in the RapportIQ experience;
• we do not transfer Google user data except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to users;
• we do not use Google user data for serving advertising, and we do not sell it;
• we do not allow humans to read Google user data unless we have your affirmative consent for specific messages, it is necessary for security purposes or to comply with applicable law, or the data has been aggregated and anonymised.

You can disconnect a connected account at any time in your settings, which revokes our ongoing access.

7. How we share information

We do not sell your personal information. We share it only as follows:

• Third-party platforms you connect - to read your reviews and, where you allow it, to post approved replies, we exchange the necessary data with the platforms you connect (such as Google, Yelp, Facebook, and others).
• Service providers (sub-processors) - we use a small set of vendors under contract to run the service, each limited to what they need:
  • an AI provider, to run triage, drafting and insights;
  • a messaging provider, to deliver SMS and messaging-app requests;
  • an email delivery provider, to send account and notification emails;
  • a payment processor, to handle billing where it is enabled;
  • a cloud hosting and infrastructure provider, to store and serve data.
  We keep this list current and will give you a way to learn of material changes.
• Professional advisers and authorities - where we are required to by law, or to establish, exercise or defend legal claims, or to protect the rights, safety and property of RapportIQ, our users and the public.
• Business transfers - if we are involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, subject to this policy.

8. International data transfers

RapportIQ operates from Australia and uses cloud infrastructure and sub-processors that may store or process personal information in countries other than the one you are in, including Australia, the United States, and other locations where our providers operate. Data protection laws in those countries may differ from your own.

When we transfer personal information across borders we take steps required by the law that applies to you, which may include standard contractual clauses (for the EEA and the UK, including the UK International Data Transfer Addendum), contractual protections consistent with Australian Privacy Principle 8 and New Zealand Information Privacy Principle 12, and equivalent safeguards under Canadian and Indian law. You can ask us for more detail about the safeguards we use.

9. How long we keep information

We keep personal information for as long as needed to provide the service, meet our legal, accounting and reporting obligations, and resolve disputes. Retention periods vary by the type of data and the reason we hold it.

Where a third-party platform’s terms require a shorter period, we honour it. For example, where a platform requires it, the text of a review is deleted within 24 hours of retrieval and only aggregated, de-identified metrics are kept after that. When you close your account, we delete or de-identify your personal information within a reasonable period, except where we must keep certain records to comply with law.

10. How we protect information

We use technical and organisational measures appropriate to the risk, including encryption of connected-platform credentials at rest, encryption in transit, hashing of passwords and of customer phone numbers, access controls, and logging. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to meet our breach notification duties.

If we become aware of a data breach that is likely to cause serious harm or meets the notification threshold that applies to you, we will notify the relevant regulator and affected individuals as required, for example under the Australian Notifiable Data Breaches scheme, the New Zealand Privacy Act 2020, the UK and EU GDPR, applicable United States and Canadian breach laws, and India’s Digital Personal Data Protection Act.

11. Cookies and similar technologies

We and our providers use cookies and similar technologies, such as browser local storage, to run the website and app. We group them as:

• Strictly necessary - required to sign you in, keep the Service secure, and remember essential settings. These cannot be switched off.
• Functional - remember your preferences so the Service works the way you expect.
• Analytics - help us understand how the product is used so we can improve it, in a limited and privacy-conscious way.

Where the law requires consent for non-essential cookies (for example under the UK Privacy and Electronic Communications Regulations and EU rules, and comparable consent expectations elsewhere), we ask for your consent before those cookies are set, and you can change your choice at any time. You can also control cookies through your browser settings; blocking some cookies may affect how the Service works. Because there is no common industry standard, we do not currently respond to browser “Do Not Track” signals, but where the law requires it we honour recognised opt-out preference signals, such as Global Privacy Control for applicable United States state privacy rights.

12. Your privacy rights

Subject to the law that applies to you, you can ask us to give you access to the personal information we hold about you, correct it, delete it, restrict or object to certain processing, and receive a copy in a portable form. To make a request, contact us using the details at the end of this policy. We will verify your identity and respond within the time the law allows. You will not be treated unfairly for exercising a right.

12.1 Australia

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You may request access to and correction of your information. If you are not satisfied with how we handle a privacy issue, you may complain to us first and then to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

12.2 New Zealand

We handle personal information in line with the Privacy Act 2020 and the Information Privacy Principles. You may request access to and correction of your information, and you may complain to the Office of the Privacy Commissioner at privacy.org.nz.

12.3 United Kingdom and European Economic Area

If UK or EU data protection law applies to you, you have the rights of access, rectification, erasure, restriction, objection, and data portability, and the right to withdraw consent where we rely on it. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing without a lawful basis and appropriate safeguards. You may complain to your supervisory authority, including the UK Information Commissioner’s Office (ICO) at ico.org.uk.

12.4 United States (including California)

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. Depending on your state (for example California under the CCPA as amended by the CPRA, and comparable laws in Virginia, Colorado, Connecticut, Utah and other states), you may have the right to know the categories and specific pieces of personal information we collect, to request deletion or correction, to opt out of any sale or sharing and of certain profiling, and to limit the use of sensitive personal information. You may designate an authorised agent to act for you, and you will not be discriminated against for exercising these rights.

12.5 Canada

We handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, Quebec’s Law 25. You may request access to and correction of your information and withdraw consent subject to legal and contractual limits. You may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to the Commission d’accès à l’information du Québec where Law 25 applies.

12.6 India

We handle personal data in line with the Digital Personal Data Protection Act 2023 and applicable rules. As a Data Principal you may request access to and correction or erasure of your data, nominate another person to exercise your rights, and raise a grievance with us using the contact details below. Where required, you may also approach the Data Protection Board of India.

13. Children

RapportIQ is a product for businesses and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

14. Third-party platforms and links

The third-party platforms you connect, and any websites we link to, have their own privacy practices that we do not control. When you connect a platform or follow a link, that third party’s privacy policy governs its handling of your information. We encourage you to read it.

15. Changes to this policy

We may update this Privacy Policy from time to time. When we make a material change we will update the “Last updated” date and, where the law requires, notify you. Your continued use of RapportIQ after an update means you accept the revised policy.