Privacy Policy

Last updated: September 2026

1. Controller

The controller responsible for data processing on this website within the meaning of the EU General Data Protection Regulation (GDPR) is:

2. Hosting and server log files

This website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. When you visit the website, the server automatically records information that your browser transmits (IP address, date and time, requested page, referrer, browser and operating system). This is necessary to deliver the website securely and stably (Art. 6(1)(f) GDPR). Log files are deleted after a short period, unless longer storage is required to investigate security incidents. We have concluded a data processing agreement with our host.

3. Fonts, cookies and web analytics

Fonts, scripts and media of this website are served from our own server; no data is sent to Google Fonts or other font CDNs. We do not use advertising or tracking cookies.

To understand how our website is used, we use Ahrefs Web Analytics, provided by Ahrefs Pte. Ltd., 16 Raffles Quay, #33-03 Hong Leong Building, Singapore 048581. Ahrefs Web Analytics works without cookies and does not create cross-site user profiles. When you visit a page, your browser loads a script from analytics.ahrefs.com, which records aggregated information such as the page visited, referrer, device type, browser, country and visit duration. Your IP address is transmitted to Ahrefs for technical reasons but is not stored in a way that identifies you. The legal basis is our legitimate interest in analysing and improving our website (Art. 6(1)(f) GDPR). Where data is transferred to Singapore, this is based on the EU Standard Contractual Clauses. You can object to this processing at any time, for example by blocking the script in your browser. More information: ahrefs.com/legal/privacy-policy.

Your browser’s local storage is used only to keep your order and dashboard login on your device; you can clear it at any time in your browser settings.

4. Customer account and login cookie

When you place your first order we create a customer account with your email address as the username and send you a password by email. Passwords are stored only as a secure hash. When you log in, we set a single session cookie (br_session) that keeps you logged in until you close your browser. It is technically necessary for the dashboard and is not used for tracking (§ 25(2) TDDDG, Art. 6(1)(b) GDPR).

5. Finding your business and reviews

When you search for your business in the order form, the search term is sent to the Google Places API (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to find the matching Google Business Profile, and the publicly visible reviews of that profile are retrieved via Google and via SerpApi, LLC (5540 N Lamar Blvd #12, Austin, TX 78756, USA). Only the search term and the ID of the business profile are transmitted – no personal data about you. The legal basis is Art. 6(1)(b) GDPR (preparing your order).

6. Payment

Payments are processed by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin 2, Ireland). When you click “Pay”, you are redirected to Stripe, which processes your payment details under its own privacy policy; we only receive the payment status and your email address. Legal basis: Art. 6(1)(b) GDPR.

7. Orders

When you place an order we process the data you enter (name, email address, company, phone number, address, country, the business profile and the reviews you submit) in order to perform the contract, communicate with you and issue invoices (Art. 6(1)(b) GDPR) and to comply with statutory retention obligations (Art. 6(1)(c) GDPR). To request removal of a review, we pass the necessary information (e.g. the review link and the reason for removal) to Google. We store order data for as long as necessary for these purposes and in accordance with statutory retention periods (tax and commercial law, generally up to 7–10 years).

8. Contact by email

If you contact us by email, we process your message and contact data to handle your enquiry (Art. 6(1)(b) or (f) GDPR). We delete the data once your enquiry has been dealt with, unless statutory retention obligations apply.

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR). You can withdraw any consent given at any time with effect for the future. To exercise your rights, write to info@byereviews.com. You also have the right to lodge a complaint with a data protection supervisory authority.

10. Security

This website uses TLS encryption (recognisable by “https://” in the address bar) to protect the data you transmit.