Privacy Policy

Effective date: 28 June 2026 Last updated: 16 October 2026 Controller: Maven Advertising SRL (operating the ReviewMix service), Iași, România; Trade Register (ONRC) no. J2021003339221 · EUID ROONRC.J2021003339221 · CUI (unique registration code) 21027661 · VAT RO46019966

---

1. Who we are

ReviewMix is a review aggregation and testimonial collection platform operated by Maven Advertising SRL, a limited liability company registered in Romania. We help website owners import Google Business Profile reviews and collect customer testimonials, display them together in a single embeddable widget, while respecting the rights of the people whose data we process.

We are the data controller for personal data relating to:

• Our own customers (people with a ReviewMix account)
• Visitors to our marketing website at reviewmix.eu and our app at app.reviewmix.eu
• People who contact us at support@reviewmix.eu, privacy@reviewmix.eu, or any other ReviewMix email

We act as a data processor on behalf of our customers for personal data relating to:

• People who submit testimonials via a collection link hosted by one of our customers
• People who have posted Google reviews of a customer's business, when that customer has connected their Google Business Profile to ReviewMix

Role split (per qualified legal review, June 2026). For live testimonial data, the customer is the data controller and ReviewMix is strictly a processor under Art. 28 — the customer determines purposes and means; ReviewMix acts on documented instruction. This is not joint controllership. For the consent metadata (the consent ledger: grants, withdrawals, and their technical metadata) that ReviewMix retains after the customer relationship ends, ReviewMix becomes an independent controller strictly for that ledger, processing it to evidence that valid consent existed at the time of collection (defense of legal claims, Art. 6(1)(f)). This is an "Independent Controller Transition" in the sense of EDPB Guidelines 07/2020 — an independent-controller posture, not joint controllership.

2. Contact

• Email: privacy@reviewmix.eu
• Postal: Maven Advertising SRL, Iași, România — the full registered address is on the Romanian trade register under J2021003339221, and we will supply it on request to anyone who needs to write to us on paper
• Data Protection Contact: the founder, reachable at privacy@reviewmix.eu. Following qualified legal review (June 2026), no mandatory Data Protection Officer is triggered under GDPR Art. 37 — ReviewMix's processing does not consist of large-scale regular-and-systematic monitoring or large-scale special-category processing — so the founder acting as the primary data-protection contact is sufficient for v1.

3. What personal data we collect

3.1 When you create a ReviewMix account (we are controller)

• Email address
• Name (optional, provided by you)
• If you choose the optional "Sign in with Google": your Google account email address, display name and Google account identifier, received from Google LLC (US) when you authorize the sign-in — see § 7 on transfers. Signing in by magic link sends Google nothing for the sign-in itself. Separately, and only with the consents they need, a new account's sign-up is reported to Google Analytics (§ 3.2) and to Google Ads (§ 4.10).
• Billing information processed via Stripe: name, billing address, VAT number, payment method details (payment method data is held by Stripe, not by us)
• Account activity: widgets created, testimonials approved, logins, plan changes
• How you found us: whether you signed up with an emailed link or with Google; the country our network provider, Cloudflare, works out from the connection you signed up from (a country code; your IP address is not kept with your account for this); and, if you answer it, your answer to the optional "How did you hear about us?" question we show in your dashboard until you answer or skip it. Section 4.11 explains why

3.2 When you visit reviewmix.eu or app.reviewmix.eu (we are controller)

• IP address. We process it briefly for security and routing and keep it in raw form for 30 days, then hash it. With analytics consent your IP also reaches PostHog Inc., which derives an approximate country and device type from it and does not store it, and Google LLC on the marketing site. On the marketing site the Google tag's pre-consent measurement pings also carry your IP to Google; see our Cookie Policy.
• User agent string (browser, operating system, device type)
• With analytics consent: pages viewed, referrer, device/browser information, anonymous distinct IDs and session IDs (the dashboard can pick up the PostHog identifier from an earlier reviewmix.eu visit, so both sites can count one browser once), interaction events, and masked session replay through PostHog Inc. on the marketing site and inside the app dashboard; GA4 visitor/session identifiers and usage events through Google LLC on the marketing site. Text you type is masked before replay leaves your browser. On reviewmix.eu, which shows only our own content, other page text is recorded as it appears, except a help-centre search the page repeats back, which stays masked. In the dashboard, page text is masked except our own interface text, which we mark readable one element at a time, so our customers' data and the figures and dates shown from their accounts stay masked; element attributes are also masked, and page addresses and links sent without their query strings. Images are blocked on both sites. We never send PostHog your account identity, name or email address.
• With analytics consent, a small number of events are sent to PostHog Inc. by our servers rather than by your browser, recording that something you did reached a defined point: an account was created, a sign-in completed, a checkout was started, an account closure was requested. (A checkout being started is not a checkout being paid — we record that you reached Stripe, not what happened there.) They carry the same anonymous identifier your browser already uses for analytics, the name of the event and the time it happened. They also carry the analytics library's own technical fields — which library sent the event, its version, and that it came from a server rather than a browser — which describe our software, not you. They never carry your email address, your name, your account identifier, or anything you typed, and because they are sent by our server rather than your browser we switch off the location lookup that would otherwise run, so they carry no country either. Without analytics consent none of them is sent, and none is sent if your browser has no analytics identifier yet: we do not create one to send an event. This is the one kind of analytics that happens on pages where the analytics library itself never runs, such as sign-in and sign-up: we count that the step finished, and record nothing about the page you were on.
• On the marketing site, the Google tag also sends cookieless measurement pings to Google LLC while you have not yet answered the consent banner; analytics cookies require opt-in. Section 4.5 gives our basis for those pings and how to stop them.
• With analytics consent, our server also sends Google LLC a sign-up event for Google Analytics, carrying the Google Analytics identifier from your browser's _ga cookie and nothing else about you.
• With advertising consent: the ad-click identifier from a Google ad you clicked, and, when you sign up or start paying, a report to Google Ads with a hash of your email address. Section 4.10 describes it in full.

3.3 When you submit a testimonial via our customer's collection link (we are processor)

• Name
• Role or job title (optional)
• Company name (optional)
• Email address
• The testimonial text you write
• Photograph (optional, only if you upload one)
• Granular consent records: which uses of your data you have permitted, with timestamp, IP address hash, and the version of the consent text you saw
• The website that invited you (inferred from the widget)
• An optional reference supplied by the business that invited you (for example an order number), carried on the link you followed, showing them which of their requests your testimonial answered — deleted if you ask for your data to be erased

3.4 When you contact us

• Email address and any content you include in your message

3.5 When a site owner has connected a Google Business Profile (we are processor for the site owner)

If you have posted a review of a business on Google, and that business is a ReviewMix customer who has connected their Google Business Profile, ReviewMix may access and cache the following data about your review via Google's API:

• Your display name as it appears on Google
• Your review text (if you included text, not just a star rating)
• Your star rating (1–5)
• A URL to your Google profile photo. The URL is stored. The image itself is hosted by Google and is not stored by us — when your photo is shown in a business's widget, we fetch it from Google on request and serve it from our own servers, so your image is never requested directly from Google by the visitor's browser and Google does not receive that visitor's IP address from the business's website. Where the business uses a consent manager, the photo is shown only to visitors who have consented; other visitors see initials instead and no request is made.
• The date you posted your review on Google
• A URL linking back to your review on Google

This data is publicly available on Google Maps and Google Search. We access it using the business owner's authorized OAuth credentials, store it in EU infrastructure (Hetzner, Germany), and display it in the business owner's widget.

The business owner may also reply to your review from within ReviewMix (added 2026-08-29). Such a reply is composed by the business owner, sent to Google using the owner's authorized credentials, and published by Google on your review under the business's name — exactly as if the owner had replied in Google's own tools. ReviewMix stores a copy of the owner's reply (the owner's content, not yours) alongside the cached review; Google remains the system of record, and a reply edited or deleted on Google replaces our copy at the next refresh.

Following qualified legal review (June 2026): (a) Lawful basis: the business owner's (Controller's) legitimate interest under Art. 6(1)(f) — displaying reviews about their business that reviewers voluntarily posted publicly on Google. Google's Terms of Service grant the Controller the right of access to their own GBP data; they do not themselves supply the GDPR lawful basis. (b) Art. 14 notice: the Art. 14(5)(b) "disproportionate effort" exemption applies to direct reviewer notice for publicly-posted review data; the Controller (the business owner) discloses this processing in their own privacy notice. ReviewMix, as processor, bears no direct Art. 14 obligation toward the reviewer. (c) No direct relationship: there is no direct ReviewMix↔reviewer relationship — the reviewer never interacts with ReviewMix, and ReviewMix does not become a controller toward the reviewer by caching the review on the Controller's instruction.

4. Why we process your data and under what legal basis

4.1 To provide the ReviewMix service to our customers

• Legal basis (account data): performance of our contract with you (GDPR Art. 6(1)(b))
• Legal basis (testimonial submitter data): the customer's contract with the submitter, for which we act as processor under Art. 28

4.2 To process payments

• Legal basis: performance of contract (Art. 6(1)(b)) and compliance with tax law (Art. 6(1)(c))

4.3 To send transactional emails (magic links, confirmations, service notifications)

• Legal basis: performance of contract (Art. 6(1)(b))

4.4 To secure our service (rate limiting, abuse prevention, error monitoring)

• Legal basis: legitimate interest (Art. 6(1)(f)) — our interest in preventing fraud and abuse of the service, balanced against your interest in not being surveilled. We minimize this by hashing IPs after 30 days and scrubbing PII from error logs.

4.5 To understand how our service is used

• Legal basis: consent (Art. 6(1)(a)) for PostHog product analytics and masked session replay, and for GA4 analytics cookies; device storage and access also require consent under Art. 5(3) ePrivacy Directive. The same consent governs the events our servers send: they read the choice stored on your device and send nothing when it is absent or refused. They add no storage of their own, so Art. 5(3) is met by the identifier that is already there rather than by anything new.
• Separate basis for one narrow case: the Google tag's measurement pings while you have not yet answered the banner, described under “When you visit reviewmix.eu or app.reviewmix.eu”. Those store nothing on your device but do carry your IP address and browser information to Google LLC, and our basis for that is legitimate interest (Art. 6(1)(f)) — knowing how many people reach the site and by what route. You can object (Art. 21) by refusing analytics on the banner, which stops them from the next page you load provided your browser lets us store the refusal, and on the page where you refuse as well where we can, or at privacy@reviewmix.eu. We have documented the balancing test behind this and will share its substance on request.

4.6 To comply with legal obligations

• Legal basis: legal obligation (Art. 6(1)(c)) — retention of invoice data under Romanian tax law, preservation of consent records as proof under Art. 7(1), response to lawful requests from supervisory authorities.

4.7 Photographs

Following qualified legal review (June 2026), ordinary photographs (headshots) used for display are not Art. 9 biometric data. Per Recital 51, a photograph becomes biometric special-category data only when processed through specific technical means permitting unique identification (e.g. facial-recognition or algorithmic facial analysis). ReviewMix performs no facial recognition, identification, or algorithmic analysis — a submitter's photo is processed solely for display. Art. 9 sensitive-category rules are therefore not triggered; the photo is processed on the submitter's Art. 6(1)(a) consent for public display.

4.8 To import and cache Google Business Profile reviews on behalf of site owners (as processor)

When a site owner connects their Google Business Profile, we import and cache their Google reviews and include them in their widget.

• Our role: Processor under Art. 28, acting on the site owner's (Controller's) documented instruction.
• Legal basis (for the Controller): the Controller's legitimate interest under Art. 6(1)(f) in displaying reviews about their business that reviewers voluntarily posted publicly on Google (per qualified legal review, June 2026). Google's Terms of Service grant the Controller the right to access their own GBP data; the ToS are the access right, not the GDPR lawful basis. Reviewer notice is met by the Controller's own privacy notice under the Art. 14(5)(b) disproportionate-effort exemption (see Section 3.5); ReviewMix as processor owes no direct Art. 14 obligation to reviewers.
• Data: Review content and associated metadata as described in Section 3.5. We do not process special categories of data from Google reviews.

4.9 To email you reviews, tips and what's new, only if you ask for them

If you tick the box asking for these emails, we send you about one email a month: practical tips on collecting and answering reviews, and news about ReviewMix. These are marketing emails. They are not the same as the service emails described in Section 4.3 — sign-in links, billing notices and similar — which we send because they are necessary to provide the service, and which do not stop if you unsubscribe from this.

• Where you can tick it: on the sign-in and sign-up form, and in your account settings. It is never pre-ticked anywhere, and refusing has no effect on the service or its price
• Legal basis: your consent (Art. 6(1)(a)), recorded with a timestamp and with a version identifying the exact wording you agreed to
• When the consent is recorded: if you tick it on the sign-in or sign-up form, not when you tick the box but when you then open the link we email you — so a tick you never confirm by using that address creates no record at all. If you turn it on in your account settings, where you are already signed in and the address is already confirmed, it is recorded when you save
• Withdrawal: untick the box in your account settings at any time, or use the unsubscribe link in any such email — either takes effect immediately and we keep no record of you on any mailing list afterwards
• Who sends them: Resend, our email provider, listed in our sub-processors

4.10 To measure which of our ads bring customers, only if you allow advertising

When we advertise ReviewMix on Google Search and you allow advertising on our consent banner, we measure whether the ad you clicked led to a sign-up and, later, to your first paid subscription. We use this to decide which ads and search terms to keep paying for. We do not use it to show you ads, to build advertising audiences or for remarketing.

• What is processed: on every page of reviewmix.eu once you allow advertising, the Google Ads tag's own request (your IP address, browser information and the page address) and its _gcl_au cookie; if you clicked one of our ads, the ad-click identifier Google adds to the link (gclid, gbraid or wbraid), kept in a cookie on your device, then with the sign-in link we email you (with Google sign-in, read from that cookie when your account is created), and, once you sign up, with your account; when you clicked the ad and when you gave advertising consent, with the version of our consent banner it was given under; the fact and time of your sign-up; the value and currency of your first paid subscription; and a one-way SHA-256 hash of your account email address, which Google uses to match the report to the ad click (Google calls this Enhanced Conversions). Google receives the hash, not your address. The hash is still personal data: Google can match it to a Google account. While advertising is allowed, the ad-click identifier (and any dclid or Google _gl linker parameter on the same link) stays in your browser's address bar for the rest of that page view, so if you have also allowed analytics, the page address Google Analytics records carries it too, and our product analytics (PostHog, Section 4.5) removes it from its events but a session replay of that visit may still show it
• Recipient: Google LLC (Google Ads), which receives the identifier, the event, its value and the hash from our server. Google acts under its data-protection terms for Google Ads; the transfer to the US relies on those terms, which include the EU Standard Contractual Clauses, and on Google's EU-US Data Privacy Framework certification. Our Google Analytics property is linked to our Google Ads account for reporting only: ad costs and clicks appear beside site visits. No Google Analytics event is ever used as a Google Ads conversion, no Google Analytics audience is shared with Google Ads, and personalised advertising and Google signals are off for the link and the property.
• Legal basis: your consent (Art. 6(1)(a)), given through the advertising choice on our consent banner; the cookie also requires consent under Art. 5(3) ePrivacy Directive. Without it, none of the processing above happens. The reporting link between our Google Analytics and Google Ads accounts, described under Recipient, belongs to our Google Analytics processing (Section 4.5) and sends Google Ads no conversion. An advertising consent recorded under an earlier version of this policy does not cover it; if you had given one, the banner asks again
• Retention: we keep the ad-click identifier with your account for 90 days after you sign up, then delete it. Before you sign up it is on our server only with the sign-in link we email you: removed when you use the link, and deleted with an unused link within two days after it expires. Google keeps what it receives for as long as its Google Ads terms provide; we record the period Google states in our records of processing
• Withdrawal: turn advertising off in Cookie settings in your dashboard, and nothing more is reported for your account from then on. If you turn it off on reviewmix.eu instead, it reaches your account the next time you open the dashboard in the same browser; to stop reporting at once without opening it, write to privacy@reviewmix.eu. Closing your account stops it too. A report already sent stays with Google: the reporting interface we use has no way to take one back, and what Google holds from it is the ad-click identifier, the event (your sign-up, or your first payment, with its time, amount and currency) and the hash of your email address, not the address itself

4.11 To know which channels bring us customers

When you create an account, we keep with it how you signed up (an emailed link or Google) and the country Cloudflare works out from the connection you signed up from (or a marker that the connection came through the Tor network). In your dashboard we also show an optional question, "How did you hear about us?", until you answer or skip it, with a short list of answers (for example a Google search, a Google ad, an AI assistant such as ChatGPT, social media or a recommendation); if you answer, we keep your answer too, and if you skip it, we only note that you skipped it. We use these to see which channels and countries bring us customers.

• Nothing read from your device: we do not read the address of the page you came from, the site that referred you, or campaign tags in links for this. We do not combine these details with the identifiers our analytics uses (Sections 3.2 and 4.5). Refusing analytics on our cookie banner is not an objection to this; to object, write to us as below.
• Before your account exists: with an emailed link, the country is kept with that sign-in link on our server and removed when you use it; an unused link is deleted after it expires, normally within two days. If you already have an account and are signing in, nothing is kept.
• Who sees it: ReviewMix staff only, through our internal tools. It is not sent to Google, PostHog or anyone else, and it is included when you ask for a copy of your data.
• Legal basis: legitimate interest (Art. 6(1)(f)) — knowing how our customers find us. You can object (Art. 21) at privacy@reviewmix.eu, and we will clear them from this record, together with when you answered or skipped the question; we keep only a note that you objected (how you signed up stays in the records we keep to run your account). We have documented the balancing test behind this and will share its substance on request.

5. How we obtain your consent

For testimonial submitters, we capture separate consent for each use of your data:

• Displaying your name publicly
• Displaying your photograph publicly (only if you uploaded one)
• Displaying your company name publicly
• Using your testimonial in paid marketing or advertising

Each consent is a separate action. You can grant some and refuse others. Every consent is recorded with the exact text you saw, a timestamp, and technical metadata for audit purposes.

You can withdraw any consent at any time via the self-service link emailed to you at submission, at the URL format app.reviewmix.eu/t/<your-token>. Withdrawal takes effect within 60 seconds across every website displaying your testimonial.

6. Who we share your data with

We share personal data only with the sub-processors listed at app.reviewmix.eu/legal/subprocessors:

• Hetzner Online GmbH (Germany) — hosting
• Cloudflare, Inc. (EU edge, US HQ) — DNS, TLS, CDN, security
• Stripe Payments Europe Ltd. (Ireland) — payment processing
• Resend, Inc. (EU routing, US HQ) — transactional email
• Google LLC (Mountain View, California, USA) — Google Business Profile API for connected businesses, optional “Sign in with Google” identity claims, and GA4 marketing-site analytics for visitors, including visitors without an account. GA4 analytics cookies require consent; the tag also sends cookieless measurement pings while a visitor has not yet answered the banner. With advertising consent only, Google Ads conversion measurement (Section 4.10). SCC Module 3 applies to the GBP integration; marketing analytics and ad measurement are separate controller processing purposes.
• PostHog Inc. (US; EU Cloud, Frankfurt) — not a sub-processor for your data: this is our own analytics about visitors to our sites, listed because we publish every recipient. Consent-required product analytics and masked session replay on our marketing site and inside the app dashboard, identified only by an anonymous, randomly generated identifier that we never link to your account; Standard Contractual Clauses Module 2 (Controller-to-Processor) cover the transfer. Most of this is sent by your browser; a small number of events about steps you completed are sent by our servers, on the same consent and under the same anonymous identifier.

Each sub-processor is bound by a Data Processing Agreement with us; Google Ads measurement (Section 4.10) runs under Google's data-protection terms for Google Ads. We do not sell your data. We do not share your data with data brokers. The one advertising use is the Google Ads measurement in Section 4.10, which needs your advertising consent and is never used to target ads at you.

7. International data transfers

ReviewMix's infrastructure is in Germany (Hetzner Frankfurt). Your core data — account information, testimonials, consent records, photographs — is stored in the EU and processed in the EU.

The recipients that involve a transfer outside the EEA are these, and the list is the same one published in our sub-processor register: Cloudflare (US parent), Resend (US parent), Stripe (its EU entity may share data with Stripe, Inc. in the US), Google LLC (for the Google Business Profile API, the optional Google sign-in, marketing-site Google Analytics, and, with advertising consent, Google Ads conversion measurement), and PostHog Inc. (a US company; the data itself is stored in Frankfurt). For the Google GBP API specifically, ReviewMix's EU servers fetch review data from Google's US API endpoints and immediately store it in EU Postgres — no review data is retained outside the EU. Where data is transferred outside the EU:

• We rely on EU Standard Contractual Clauses (SCCs) as the transfer mechanism
• We rely on supplementary measures (encryption in transit and at rest, minimization of data transferred) to address Schrems II concerns
• Our Transfer Impact Assessments are available on request to customers via privacy@reviewmix.eu

Following qualified legal review (June 2026), the combination of Module 3 Standard Contractual Clauses (Processor-to-Processor) for the ReviewMix→Google LLC GBP transfer, plus data minimization (only the business owner's own publicly-posted GBP review content is fetched) and encryption (in transit and at rest), constitutes a defensible Transfer Impact Assessment posture under current EDPB guidance. Module 3 applies because ReviewMix (the customer's processor) transfers to Google LLC (a further processor); Module 2 (Controller-to-Processor) would apply only where the Customer itself is established outside the EEA.

That assessment was made for the GBP integration and covers it alone. For website analytics and ad measurement ReviewMix is the controller, not a processor, and the transfers to Google LLC and PostHog Inc. for those purposes rest on their own agreements and on your consent, except the Google tag's pre-consent measurement pings, which rest on legitimate interest as Section 4.5 explains; they do not inherit the GBP assessment above.

8. How long we keep your data

When you withdraw consent for displaying a testimonial, it is hidden from public display within 60 seconds. The testimonial content itself is not deleted by withdrawal — it is retained unpublished so you can re-engage later (editing re-submits it for approval), and you can erase it irreversibly at any time using the erasure option at your self-service link. The consent grant and withdrawal metadata (not the testimonial content itself) is retained for 3 years as described in the table above, so we can evidence that valid consent existed at the time of collection. The 3-year period reflects the general limitation period for legal claims under Romanian Civil Code Art. 2517, balanced as a legitimate interest under Art. 6(1)(f). After the customer relationship ends, ReviewMix holds this consent ledger as an independent controller strictly for that compliance-proof purpose (see Section 1).

9. Your rights

Under GDPR you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate data
• Erasure ("right to be forgotten") — request deletion, subject to our legal retention obligations
• Restriction — limit how we process your data
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — at any time, without affecting the lawfulness of prior processing

To exercise any right, email privacy@reviewmix.eu. We respond within 30 calendar days.

Testimonial submitters have immediate self-service for most of these rights at the app.reviewmix.eu/t/<your-token> link emailed to them at submission.

You also have the right to lodge a complaint with a supervisory authority. In Romania, this is:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336, București Telefon: +40.318.059.211 / +40.318.059.212 Email: anspdcp@dataprotection.ro Web: www.dataprotection.ro

If you are located in another EU member state, you may also contact your local supervisory authority.

10. Cookies and tracking

We use cookies and similar technologies described in detail in our Cookie Policy.

In summary:

• Strictly necessary cookies — always active: session cookie, CSRF token, consent preference cookie
• Functional cookies — only with consent. We set no optional preference cookies; two cookies that remember a choice you made in the dashboard are listed as strictly necessary in the Cookie Policy, together with the dashboard's browser local-storage entries for dismissed notices and for work you have not finished (an unsent reply, unsaved widget settings, onboarding choices, printables options), which stay on your device. The functional choice controls the functionality and personalisation signals passed to Google Analytics
• Analytics cookies — with consent: PostHog Inc. (EU Cloud, Frankfurt) for product analytics and masked session replay on reviewmix.eu and inside the app dashboard at app.reviewmix.eu, and Google LLC for GA4 on reviewmix.eu. The Google tag's cookieless measurement pings, sent only while you have not yet answered the banner, are described under “When you visit reviewmix.eu or app.reviewmix.eu”.
• Not a cookie, but part of the same choice — with analytics consent our servers send PostHog a small number of events recording that a step you took finished. They store nothing on your device and read only the analytics choice and the anonymous identifier that are already there; refusing analytics stops them.
• Not a cookie either, also on the analytics choice — our server tells Google Analytics that a sign-up happened, using the identifier already in your _ga cookie.
• Advertising cookies — only with advertising consent: the Google Ads tag on reviewmix.eu and its cookies, used to measure which of our ads lead to a sign-up or a paid subscription (Section 4.10). No remarketing or ad personalisation; that permission is refused for everyone. An advertising consent given before this took effect does not count; the banner asks again, and a refusal stands

You can change or withdraw your choices at any time from the floating cookie button on reviewmix.eu, which reopens the banner. The app at app.reviewmix.eu reads the same choice, shows the same banner only when no choice is stored on your device or the stored one predates a change that needs a new answer, and Cookie settings in the dashboard's account menu changes or withdraws it there.

11. Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects concerning you.

12. Children's data

ReviewMix is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, contact privacy@reviewmix.eu and we will delete it.

The minimum age for valid digital consent in Romania is 16, set by Law 190/2018 (Romania's GDPR implementing law, which adopts the Art. 8(1) default of 16), as confirmed by qualified legal review (June 2026). Below 16, a holder of parental responsibility must consent.

13. Data security

We protect your data with, among other measures:

• TLS encryption for all traffic
• Your Google connection credentials stored encrypted, never in plain text
• Strict access controls (only the founder and future authorized personnel access production data, and only with audit logging)
• Rate limiting and automated abuse detection
• Magic-link-only authentication (no passwords to be stolen)
• Regular backups, encrypted and stored separately
• Annual review of security practices

No system is perfectly secure. We describe our incident response procedure in Section 14.

14. Data breach notification

If a breach occurs that is likely to result in a risk to your rights and freedoms, we will:

• Notify the competent supervisory authority (ANSPDCP) within 72 hours of becoming aware
• Notify you directly without undue delay if the breach is likely to result in high risk to you
• Publish a public statement when appropriate

15. Changes to this policy

We may update this policy. Every change is published, with its date, in the changelog at the end of this policy. Material changes are also announced in the app dashboard at least 30 days before they take effect. Cookie changes that need a new answer from you are asked through the consent banner when they take effect. We do not email you about changes to this policy; changes to our sub-processors are notified as our sub-processor register and Data Processing Addendum describe. The current version is always at app.reviewmix.eu/legal/privacy-policy. A changelog of updates is maintained at the bottom of this page.

16. Governing law

This policy is governed by the laws of Romania and the European Union. Disputes are subject to the jurisdiction of the courts of Iași (the registered seat of Maven Advertising SRL). This forum clause does not override the mandatory right of a consumer to bring proceedings in, or be sued only in, the courts of their own place of domicile under applicable EU consumer-protection rules (Brussels I bis Regulation, Art. 17–19) — the consumer home-forum right is preserved.

---

Changelog

• 16 October 2026 — New Section 4.11: we keep with each new account how you signed up and the country Cloudflare works out from your sign-up connection, and ask an optional "How did you hear about us?" question in the dashboard until you answer or skip it, keeping your answer if you give one; on legitimate interest, to see which channels bring us customers, with a right to object. Nothing is read from your device for it, and nobody outside ReviewMix receives it. Sections 3.1 and 8 updated to match. Not material for existing accounts, which gain nothing; it applies to accounts created from now on.
• 13 October 2026 — New Section 4.10: with advertising consent only, Google Ads conversion measurement — the ad-click identifier kept with your account for 90 days, server reports of your sign-up and first paid subscription (with its value) to Google Ads, and a SHA-256 hash of your email for matching (Enhanced Conversions). No remarketing or ad personalisation. Advertising consents given before this change do not cover it; refusals stand. Section 4.10 also says that, while advertising is allowed, the identifier is in the page address Google Analytics records, and that PostHog strips it from its events but a session replay may still show it. Section 15: policy changes are now announced in the changelog, in the app dashboard and, for cookie changes that need a new answer, through the consent banner, instead of by email, with the same 30-day lead time for material changes (not material: only the channel changes); changes to sub-processors keep the notice the register and the Data Processing Addendum describe. Sections 3.1 and 3.2 add this and a server-sent Google Analytics sign-up event on the existing analytics consent; Section 4.10 also discloses the reporting-only link between our Google Analytics and Google Ads accounts; Sections 6, 7, 8 and 10 updated to match; Section 6 no longer says we share nothing with advertisers, and names this one use instead. Not material for existing accounts, which gain no tracking without a new opt-in; announced in the app dashboard when it takes effect.
• 1 October 2026 — Section 10 now also points to the dashboard's browser local-storage entries listed in the Cookie Policy: dismissed notices, and drafts of work you have not finished, kept on your device and deleted when you finish, discard or sign out, or after 7 days (onboarding 24 hours). Nothing is sent to us or to anyone else. Non-material: no new purpose, no new recipient. The draft entries take effect when deployed.
• 27 September 2026 — Section 4.9 pointed to the wrong section for the service emails: it said Section 4.2, which is about payments; they are described in Section 4.3. The reference is corrected. Nothing about what we send, or why, changes.
• 19 September 2026 — Section 4.9 corrected on one point of timing. Since 18 September it has said, of both places you can tick the box, that the consent is recorded only when you open the link we email you. That is true of the sign-in and sign-up form. It was never true of account settings, where you are already signed in and your address is already confirmed, and the change takes effect when you save it. The text now says so for each place separately. Nothing about what we send, to whom, or how you withdraw has changed; this corrects a description of our own system that was wider than the system. It takes effect when deployed.
• 18 September 2026 — Section 4.9 rewritten for the marketing emails. The ask now appears on the sign-in and sign-up form as well as in account settings, and what it asks for is stated more broadly and more plainly: about one email a month with tips on collecting and answering reviews, and ReviewMix news. Three things are newly stated rather than newly done — that these are marketing emails and are separate from the service emails in Section 4.2, which keep coming either way; that the consent is recorded with a version identifying the exact wording agreed to; and that Resend sends them, as our sub-processor list already said. One thing is genuinely new and in your favour: the consent is recorded only when you open the link we email you, so a box ticked and never confirmed from that address creates no record. The previous text described a narrower "product updates" mailing collected only in account settings. No new recipient. It takes effect when deployed.
• 12 September 2026 — With analytics consent, a small number of events are now sent to PostHog by our servers as well as by your browser, recording that a step finished: an account created, a sign-in completed, a checkout started, an account closure requested. They carry the anonymous identifier your browser already uses, the event name, the time, and the analytics library's own technical fields describing the sending software — no email address, no name, no account identifier, nothing you typed, and no country, because the location lookup is switched off for them. Nothing is sent without analytics consent, or if your browser has no analytics identifier yet. This is the first analytics that happens on pages where the analytics library itself never runs, such as sign-in and sign-up; what is recorded there is that the step finished, not anything about the page. No new recipient and no new storage on your device. It takes effect when deployed.
• 11 September 2026 — Session replay records the text of our own pages: on reviewmix.eu as it appears, with typed text and a repeated help-centre search masked; in the dashboard only the interface text we mark readable, with our customers' data, the figures and dates shown from their accounts, and element attributes masked; images blocked on both sites. Also corrected: a star rating chosen when adding a testimonial by hand in the dashboard was recorded, contrary to this policy; that control is now excluded from replay. Non-material: no new purpose, no new recipient, and the newly readable text is our own content. It takes effect when deployed to each site.
• 10 September 2026 (second entry) — The app dashboard now shows the consent banner when no choice is stored on your device, instead of relying on a choice made on reviewmix.eu that customers who sign up directly, or use a new device or a private window, never made. A stored choice is still never asked for again. Also stated: the dashboard can reuse the anonymous PostHog identifier from an earlier reviewmix.eu visit, as it could since PostHog reached the dashboard. No new purpose, no new recipient. The banner takes effect when deployed to the app.
• 10 September 2026 — PostHog analytics and masked replay extended to the app dashboard, on the analytics choice already made on reviewmix.eu, with Cookie settings in the dashboard's account menu to change or withdraw it. Dashboard replay also blocks images and masks element attributes, and page addresses and links are sent without query strings, because those pages show our customers' own data. Non-material: no new recipient, and nobody is measured who has not already opted in. It takes effect when deployed to the app.
• 9 September 2026 — Analytics reversal: legitimate interest (Art. 6(1)(f)) named for the Google tag's pre-consent measurement pings, with the Art. 21 objection route beside it; consent-based PostHog Cloud EU analytics and masked replay, retained marketing-site GA4, recipient and transfer disclosures, and analytics withdrawal controls. GA4 cookieless pings are distinguished from consent-required storage. Also removes a Do Not Track / Global Privacy Control commitment and a functional-cookie description that the service never implemented. A cookie-settings control inside the app is added when analytics reaches the app.
• 19 August 2026 — §13 accuracy corrections: removed the "encrypted storage at the disk level" measure, which did not match the implemented system (no full-disk encryption is in place at this version), and added the application-level encryption of stored Google connection credentials, which does exist and had gone unlisted. Companion to the same-day Annex II corrections in the DPA. Non-material — mechanism descriptions only; no operative term changed.
• 13 August 2026 — Added §4.9 (product-update emails, consent-based, one-click unsubscribe), published together with the feature it describes. Additive disclosure of a new opt-in processing purpose; no existing term changed.
• 2 July 2026 — Editorial: legal-review attributions reworded impersonally throughout; internal review-status note refreshed. Non-material — no operative determination changed.
• 28 June 2026 — Initial publication.