Privacy

This policy explains what Goodshout does with personal information. It covers two groups: the businesses who use Goodshout, and their customers who receive review requests.

What we collect

From businesses: your name, email, business name, phone, timezone, your Google listing details (place ID or review link), and billing details (held by Stripe, not us).

About your customers: the name and email address (and a phone number, if you choose to add one) that you give us or that we extract from an email you BCC or forward to us (we keep only the name and email address, never the email itself, its subject or attachments, or any invoice details), plus whether they opened the link, which option they chose, whether they went on to Google, and any private message they submit.

About visitors to our website: we count page views on our public pages without cookies. We record the page, the site that sent the visitor, the device type and country, and a one-way hash of the visitor’s IP address and browser that changes every day, so we can count unique visitors without identifying anyone or following them from one day to the next. We don’t record the IP address itself, and visitors with Do Not Track turned on aren’t counted. On the sign-up path we also keep a random ID in your browser (it is not a cookie and contains no personal details) so we can see which sign-up steps people reach and where they get stuck.

Businesses we contact: we may email businesses we find through public listings, such as their Google Business Profile and public website, to tell them about Goodshout. We keep the business name, listing details and the public contact email we found, and whether they have unsubscribed. Every one of these emails carries our identity and an unsubscribe link, and anyone who unsubscribes is never emailed again.

Messages to us and emails we send you: if you use the Help button in the app, we receive your message along with your account email, business name, plan and the page you were on. When you finish setting up, we email you a short welcome and, if you haven’t sent anything after about a week, one reminder. Both have an unsubscribe link. Test requests you send to yourself or another address are marked as tests and don’t count toward your plan.

Advertising: on our public pages, and the sign-up and login pages (never inside the dashboard, where a business’s customer and complaint data lives), we use the Meta (Facebook and Instagram) advertising pixel and its Conversions API. This uses a cookie and tells Meta which of our pages you viewed, and, if you email yourself a preview or sign up, a one-way scrambled (hashed) version of that email address, the two ID codes Meta’s own cookie keeps in your browser, and your IP address and browser type, so we can see whether our ads led to a sign-up. We keep those two codes with your new account until you finish setting up. Your IP address and browser type are passed straight to Meta and not kept by us. Meta may use this to show you or people like you our ads elsewhere, under its own privacy policy. You can opt out in your browser’s cookie settings, or from your ad preferences at facebook.com/adpreferences.

How we use it

To send review requests on a business’s behalf, route private complaints to the business, and show the business their own activity. Review-request messages are sent on a transaction basis (after a job or purchase) and every one carries the sender’s identity and a working unsubscribe, as required by the NZ Unsolicited Electronic Messages Act.

Who we share it with

We use these processors: Supabase (database and file storage, Sydney), Postmark (email), Stripe (payments), Anthropic (AI suggestions for a business owner’s reply to a private complaint; it receives the business name and the text of the complaint, never the customer’s name or contact details), Google (business search when you set up, and our own email for contacting businesses), Meta (advertising, see above) and Vercel (hosting). We do not sell personal information.

Unsubscribing and deletion

Any recipient can unsubscribe from the link in any message; we stop immediately and cancel anything queued. Businesses can download their data or delete their account themselves in Settings, or email us and we’ll do it. We keep records needed for legal or accounting reasons for as long as the law requires.

Your rights

Under the NZ Privacy Act 2020 you can ask to see or correct the information we hold about you. Email us and we’ll respond within 20 working days.

Contact

Email privacy@goodshoutapp.com.