Privacy Policy

Who we are

REKommend is a review-management platform operated by REK Marketing & Design (“REK,” “we,” “us”). We sell the service to small business clients (“clients”) who use it to request and manage Google reviews from their own customers (“end customers”).

This policy explains what we collect from both groups, why we collect it, and who we share it with.

Information we collect

From clients: name, email address, business name, billing details (handled by Stripe), and any settings you enter (message templates, Google review URL, connected Google Business Profile).

From end customers: first name, last name, email address, phone number, opt-in source and timestamp, opt-out timestamp (if applicable), and a record of review-request messages sent. End-customer data is uploaded or sent to us by our clients, who attest they have explicit consent from those customers to contact them.

From public review pages: when an end customer follows a review link we created for them, we record that the link was opened so the client can see whether the request worked. We do not display ads and do not use tracking cookies on the public review page beyond what Cloudflare Turnstile requires for bot protection.

How we use it

• To deliver review-request SMS and email on behalf of the client.
• To show the client a dashboard of who was contacted and what reviews came in.
• To draft AI reply suggestions for incoming Google reviews. We do not use customer data to train third-party AI models — see the OpenAI section below.
• To bill the client and prevent abuse.

SMS opt-out

End customers can opt out of SMS at any time by replying STOP to any message. We honor the opt-out immediately across every client list that contains that phone number, and Twilio also blocks future messages at the carrier level. To opt back in, reply START. You may also email privacy@rekmarketing.com to be removed.

Email opt-out

Every review-request email includes an unsubscribe link. Clicking it removes that contact from future sends for the client that sent the message.

Third parties we share data with

We use the following service providers to run REKommend:

• Supabase — hosts our Postgres database and authentication.
• Twilio — delivers SMS messages and handles STOP/START at the carrier level.
• Resend — delivers transactional email.
• OpenAI— generates AI reply drafts. Per OpenAI's API terms, data sent through the API is not used to train their models.
• Cloudflare — bot protection on the public review page (Turnstile).
• Vercel — application hosting.
• Stripe — payment processing for client subscriptions.
• Google— Business Profile API access to read and respond to reviews on the client's behalf.

We do not sell personal information. We do not share end-customer contact lists between clients.

Data retention

Client account data is retained while the subscription is active and for 90 days after cancellation. End-customer contacts and review-request records are retained for as long as the client keeps them in their dashboard; opt-out records are retained indefinitely so we never re-message someone who opted out.

Your rights

End customers may request access, correction, or deletion of their data by contacting the client business that sent the message. If the client is unresponsive, email privacy@rekmarketing.com.

Security

We use HTTPS everywhere, row-level security in the database to isolate each client's data, and bcrypt-hashed passwords. We limit access to production data to REK staff who need it for support.

Changes

If we make material changes to this policy we will email active clients and post a notice on this page.

Contact

REK Marketing & Design
privacy@rekmarketing.com