Privacy Policy

YellowThumbs provides review request and reputation management software for local businesses. This policy explains what we do with personal data when you use YellowThumbs, and what we do with the customer contact details our business customers upload so review requests can be sent on their behalf.

For data you enter about your own account, YellowThumbs is the data controller. For the customer contact details you upload, you are the controller and YellowThumbs acts as your processor: we only use that data to carry out the sending, reporting and support tasks you ask us to.

• Account data: your name, email address, password (stored only as a secure hash), role and the business and locations you belong to.
• Business data: location names, addresses, phone numbers, opening details and Google Business Profile links.
• Customer data you upload: first and last name, email address, mobile number, visit date, tags and marketing consent flags.
• Review and message data: review requests sent, delivery and bounce events, opt-outs, reviews imported from Google, and replies published.
• Billing data: plan, subscription status and payment history. Card details are handled entirely by our payment provider and never reach our servers.
• Technical data: sign-in events, IP address, and error and security logs needed to keep the service safe and working.

• To send the review requests and reminders you schedule, by email and text message.
• To import your reviews, publish your replies and produce your reports.
• To draft suggested replies with AI. Drafts are always reviewed by a person before publishing, and sensitive reviews are never drafted automatically.
• To operate accounts, billing, security monitoring and support.

We do not sell personal data, and we do not use your customers' contact details to market YellowThumbs to them.

You confirm that you have a lawful basis for contacting every customer you upload. Every review request includes an unsubscribe link, and replying STOP to a text message opts that person out immediately. Opt-outs are permanent, apply across all of your locations, and cannot be overridden by a later upload.

We use a small number of trusted providers to run the service:

• Cloud hosting and database services for storing and serving your data.
• An email delivery provider for sending review requests and account emails.
• A text messaging provider for SMS review requests and opt-out handling.
• Google, to import your reviews and publish your replies once you connect your Google Business Profile.
• A payment provider for subscriptions and one-off purchases.
• An AI provider for generating suggested reply drafts.

Each provider is bound by contract to use the data only to provide their service to us.

Account, review and request history is kept for as long as your account is active and for up to 12 months afterwards, so reporting and disputes can be resolved. Opt-out records are kept indefinitely because deleting them would risk contacting someone who asked not to be contacted. You can archive locations and customers at any time, and we will delete uploaded customer data on request.

Data is encrypted in transit. Every record is locked to your business at the database level, not just in the app, and staff accounts only see the locations they are assigned to. Access tokens for connected services are stored encrypted, and administrative actions are written to an audit log that cannot be edited or deleted.

You can ask us for a copy of your data, to correct it, to delete it, or to restrict or object to how we use it. If you are an end customer who received a review request, contact the business that sent it, or contact us and we will pass your request on and action any opt-out immediately.

Email hello@yellowthumbs.com with any privacy question or request and we will respond within 30 days.