Privacy Policy
Last updated 13 August 2026
Revyo helps a business owner grow their Google reviews. To do that we read their Google Business Profile listings and reviews, and we record what happens when a customer scans their QR code. We never post to Google on anyone's behalf, and we never sell data.
Who we are
Revyo is operated by Keshava Elite Projects. For anything in this policy, including a data request, contact privacy@keshavaeliteprojects.co.in. Under India's Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for the data described here.
Two kinds of people use Revyo
The distinction matters, because we hold very different data about each.
- Business owners sign up, connect their Google Business Profile, and see their reviews in a dashboard.
- Customers scan a QR code at the business and either go to Google to post a review, or send the owner private feedback. They never create an account.
What we collect from business owners
| Data | Why |
|---|---|
| Name and email address | To create and sign you in to your account |
| Password | Stored only as an Argon2 hash. We cannot read it, and nobody at Revyo can recover it |
| Business details you enter | Name, category, city, address and your Google review link — these drive your QR code and public scan page |
| Session cookie | An httpOnly cookie holding an opaque token. The database stores only its SHA-256 hash, so a database leak cannot resurrect your session |
| Password-reset codes | Stored as a hash, valid for a few minutes, single-use, and capped for wrong attempts |
What we access in your Google account
Only with your explicit consent on Google's own screen, and in two separate steps so signing in never requires listing access.
| Google permission | What Revyo does with it |
|---|---|
| Email address and basic profile | Identify you when you choose “Continue with Google”. Nothing else |
| Manage Business Profile (business.manage) | Read the list of your locations so you can choose which one a QR code belongs to, and read that location's reviews so they appear in your inbox |
What we deliberately do not do:
- We never post, edit or delete anything on your Google listing.
- We never post reviews on a customer's behalf — Google's API does not permit third parties to post reviews at all, which is why customers are sent to Google to write their own.
- We never route a customer away from Google because of the rating they gave. Every customer is redirected to Google whatever they scored.
- We never use your Google data to train models, and we never sell or rent it.
Google access and refresh tokens are encrypted at rest with Fernet before they reach the database, and are only ever decrypted in memory on our server. They are never sent to your browser. Revyo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect at any time from your dashboard, which deletes the stored tokens, or revoke access directly in your Google account settings.
What we collect from customers who scan a QR code
| Data | Why |
|---|---|
| The star rating chosen | So the owner can see how they are doing over time |
| A written comment | Stored only when the customer chooses to send private feedback. If they go to Google instead, the comment is theirs and stays on Google — we do not keep a copy |
| A hash of the IP address | To detect abuse and rate-limit the public endpoints. We do not store the address itself |
| The time of the scan | Basic conversion analytics for the owner |
We do not ask a customer for their name, email or phone number, and we do not place advertising or tracking cookies on the scan page.
How long we keep it
- Account and business data: for as long as the account exists, then deleted within 30 days of a deletion request.
- Scan events and feedback: retained while the account is active, because they are the owner's own history.
- Password-reset codes: minutes, then expired and unusable.
- Google tokens: until you disconnect, or the account is deleted.
- Security logs: recorded without passwords, tokens or customer feedback text, and rotated on a short cycle.
Who else sees it
We do not sell personal data. We share it only with the services needed to run Revyo:
| Processor | Purpose |
|---|---|
| Oracle Cloud Infrastructure (Hyderabad, India) | Hosting and database |
| Oracle Cloud Email Delivery | Sending password-reset codes |
| Only the calls you authorise, to read your own listings and reviews | |
| Google Gemini | Generates a suggested review draft from the business name, category, city and star rating. No personal data about the customer is sent, and the customer can edit or ignore the suggestion |
Your rights
Under the DPDP Act you may access, correct, or delete your data, withdraw consent, and nominate someone to act for you. Email privacy@keshavaeliteprojects.co.in and we will respond within 30 days. In your dashboard you can already edit your profile, disconnect Google, and delete a business, which removes its scan history and feedback with it. To close an account entirely, email us and we will confirm once it is done.
If you are not satisfied with our response you may complain to the Data Protection Board of India.
Children
Revyo is a tool for business owners and is not directed at children. We do not knowingly collect data from anyone under 18.
Changes
If we change how we use data we will update this page and its date, and for anything significant we will email account holders rather than rely on you noticing. See also our Terms of Service.