ReviewMaster Privacy Policy

This Privacy Policy explains how Marka Modern Retail Private Limited, operator of the ReviewMaster Shopify application (“ReviewMaster”, “Marka”, “we”, “us”, or “our”), collects, uses, discloses, stores and protects personal information.

Registered office: 1st Floor, Plot 558 P, Sector 27, Gurugram (Gurgaon), Haryana 122009, India
Privacy contact: tech@houseofmarka.com

This Privacy Policy applies to:

1. Shopify merchants and their personnel who install, configure or interact with ReviewMaster; and
2. customers, reviewers and storefront visitors whose information ReviewMaster processes through a Merchant’s use of the App.

1. Our Roles

ReviewMaster may act in different privacy roles depending on the processing.

1.1 Where Marka acts as a processor or service provider

For personal information belonging to a Merchant’s Customers that ReviewMaster processes according to the Merchant’s instructions, the Merchant generally determines the purposes and means of processing and ReviewMaster acts as the Merchant’s processor, service provider, or equivalent role under Applicable Law.

Examples include:

• processing order information to send review requests;
• storing Customer reviews;
• associating a review with an order;
• displaying reviews on the Merchant’s storefront;
• processing product questions;
• transmitting reviews to integrations enabled by the Merchant.

The ReviewMaster Data Processing Agreement governs that processing.

1.2 Where Marka acts as a controller

Marka may independently determine the purposes and means of processing for limited categories of information required to operate our own business, including:

• merchant account and business contact information;
• subscription and administrative records;
• security and fraud-prevention records;
• service-operational logs;
• legal and compliance records;
• support communications;
• global email suppression records used to prevent further messages to addresses that have unsubscribed, permanently bounced or reported spam.

For those activities, Marka acts as a controller or equivalent business role under Applicable Law.

2. Information We Receive About Merchants

When a Merchant installs or uses ReviewMaster, Shopify or the Merchant may provide information including:

• store name;
• Shopify store domain;
• primary domain;
• Merchant business contact details;
• account or administrative email address;
• installation status;
• Shopify store identifier;
• authentication or authorization credentials made available through Shopify;
• subscription plan;
• installation and uninstall dates;
• App settings;
• widget configuration;
• notification preferences;
• review configuration;
• feature usage and administrative activity;
• communications sent to ReviewMaster support.

Shopify access credentials are used only as necessary to provide the App and are protected as described in this Policy and our security measures.

We do not obtain Merchant payment-card information through ReviewMaster. Paid App billing is processed through Shopify.

3. Shopify Data Access

ReviewMaster requests only Shopify permissions reasonably necessary for enabled functionality.

Depending on the current version and functionality used, these may include permissions relating to:

• products;
• orders;
• eligible Customer details;
• files;
• discount codes;
• subscription or billing status;
• metafields or metaobjects;
• other Shopify resources required for approved ReviewMaster functionality.

ReviewMaster uses Shopify data only for purposes reasonably necessary to provide, operate, secure and support the App and as otherwise permitted by Applicable Law and Shopify requirements.

We do not use Shopify Merchant Data for unrelated competitive benchmarking.

4. Customer and Reviewer Information

Depending on the Merchant’s configuration and the Customer’s interaction with ReviewMaster, we may process:

Identity and contact information

• Customer or reviewer name;
• display name;
• email address;
• optional location supplied by the Merchant or Customer.

Order and verification information

• Shopify order identifier;
• order number;
• order status;
• eligible purchased products;
• fulfillment information;
• information necessary to determine whether a review qualifies for a verified-purchase designation.

We do not intentionally request postal addresses or telephone numbers for ReviewMaster review functionality unless a future feature expressly requires and discloses them.

Review information

• rating;
• review title;
• review text;
• review date;
• reviewer display details;
• verification status;
• incentive status;
• Merchant replies;
• source or import status.

Questions and answers

Where enabled:

• Customer name;
• question;
• Customer email where provided;
• Merchant response;
• applicable dates and product relationship.

Review incentive information

Where incentives are enabled:

• Customer email;
• issuance status;
• related discount-code identifier;
• expiry;
• information necessary to prevent duplicate incentive issuance.

Photos and videos

A Customer may choose to submit review photographs or videos.

Where the current implementation uploads review media into the Merchant’s Shopify Files account:

• the media is stored by Shopify on the Merchant’s behalf;
• ReviewMaster may temporarily receive or validate the upload;
• ReviewMaster may store the resulting Shopify media URL and related metadata.

The Merchant remains responsible for managing media stored in its Shopify account after ReviewMaster is removed.

5. Technical and Security Information

We may process limited technical information necessary for:

• request authentication;
• security;
• abuse prevention;
• fraud detection;
• rate limiting;
• reliability;
• troubleshooting;
• storefront analytics.

This information may include:

• IP address;
• a truncated or cryptographic representation of an IP address;
• browser user-agent;
• timestamp;
• request information;
• device/browser characteristics;
• event type.

Raw shopper IP addresses are not persistently stored. Where used for abuse prevention, an IP address may be transformed into a non-reversible or limited-purpose value and retained only for the period necessary to prevent repeated abusive activity.

6. How We Use Personal Information

We process information where reasonably necessary to:

• install and authenticate ReviewMaster;
• provide Merchant-requested functionality;
• synchronize eligible Shopify data;
• collect and display reviews;
• send review invitations or reminders on behalf of a Merchant;
• identify eligible verified purchases;
• provide questions and answers;
• issue configured review incentives;
• moderate, publish and syndicate reviews;
• provide analytics;
• administer subscriptions;
• enforce plan limits;
• provide support;
• diagnose and resolve errors;
• maintain service security and reliability;
• prevent fraud, spam and abuse;
• honour unsubscribe and suppression requests;
• comply with law, court orders and regulatory requirements;
• establish, exercise or defend legal claims.

7. Legal Bases Where Marka Acts as Controller

Where GDPR, UK GDPR or another law requiring a legal basis applies and Marka acts as controller, we may rely on:

Contract

Where processing is necessary to:

• administer a Merchant’s account;
• provide contracted services;
• process subscription administration;
• respond to contractual requests.

Legitimate interests

Where necessary for our legitimate interests, balanced against the rights of individuals, including:

• securing ReviewMaster;
• preventing fraud and abuse;
• preventing unwanted email after opt-out;
• maintaining deliverability;
• troubleshooting;
• protecting legal rights;
• operating and improving service reliability.

Legal obligation

Where processing is required for:

• accounting;
• taxation;
• lawful government requests;
• regulatory compliance;
• legal record keeping.

Consent

Where we specifically request consent for processing and consent is the appropriate lawful basis.

Consent may be withdrawn where Applicable Law provides that right.

Where ReviewMaster acts only as a Merchant’s processor, the Merchant is responsible for identifying the lawful basis for its underlying Customer processing.

8. Customer Communications

ReviewMaster may send review invitations, reminders or related messages to Customers only on behalf of and according to the configuration or instructions of a Merchant, subject to our technical, compliance and suppression controls.

The Merchant is responsible for ensuring that it has a lawful basis, consent or other permission required under Applicable Law.

ReviewMaster may prevent communications to addresses that:

• unsubscribed;
• permanently bounced;
• reported spam;
• are otherwise suppressed for legal, deliverability or abuse-prevention reasons.

9. Email Suppression Records

To avoid sending further ReviewMaster-enabled messages to persons who have opted out, reported spam or experienced permanent delivery failure, Marka may maintain a limited suppression record.

A suppression record may contain:

• email address or a suitable suppression identifier;
• reason for suppression;
• date or related operational information.

Marka acts as controller for this limited processing where we determine that the record must apply across the ReviewMaster platform.

We retain suppression information for as long as reasonably necessary to ensure the applicable address remains suppressed, subject to Applicable Law.

Deleting that record may cause an individual who previously opted out to receive another message, so suppression records may outlive other information relating to that Customer.

10. Cookies and Browser Storage

ReviewMaster may use limited first-party cookies or browser storage necessary to:

• maintain Merchant sessions;
• prevent session abuse;
• remember non-tracking storefront preferences;
• prevent repeated “helpful” votes;
• remember that a storefront popup was dismissed during a visit.

We do not use ReviewMaster cookies for third-party behavioral advertising.

The Merchant session cookie currently in production is:

• cookie name: reviewmaster_session;
• purpose: Merchant session continuity and security;
• maximum duration: 30 days;
• the cookie is cryptographically signed to prevent tampering; its contents are not encrypted and are limited to session identifiers;
• Shopify access tokens are never stored in the cookie.

Shopify access tokens are not exposed to storefront visitors.

11. Public Review Information

Where a Merchant publishes a review, some review information is intentionally made public.

Depending on the configuration, public information may include:

• reviewer display name;
• reviewer-supplied location;
• rating;
• title;
• review text;
• review media;
• date;
• verification status;
• incentive disclosure;
• helpful-vote count;
• Merchant reply;
• review source.

We do not intentionally publish reviewer email addresses or Shopify order identifiers through the storefront review widget.

Customers should not include personal information in review content that they do not want displayed publicly.

12. Review Integrations and Syndication

At a Merchant’s instruction, ReviewMaster may transmit eligible review information to third-party services or platforms, including supported Shopify or Google functionality.

Data sent depends on the requirements of the destination and may include:

• reviewer display name;
• rating;
• title;
• review text;
• review date;
• verification information;
• incentive status;
• product identifiers.

Destination platforms independently determine their own use of data once lawfully received.

ReviewMaster does not guarantee that a destination will accept, publish, rank, index or continue displaying any review.

13. Service Providers and Subprocessors

We use service providers to operate ReviewMaster.

The authoritative current list of subprocessors that process personal data on our behalf is published at:

https://reviewmaster-app.azurewebsites.net/subprocessors

The list may include providers for:

• cloud hosting;
• database hosting;
• transactional email;
• Shopify platform services;
• security or operational infrastructure.

Our subprocessors are contractually required to protect personal data in accordance with applicable obligations.

We may also disclose information:

• to professional advisers;
• to auditors;
• to insurers;
• in connection with a corporate transaction;
• where legally required;
• to protect Marka, Merchants, Customers, Shopify or other persons from fraud, abuse, security threats or unlawful conduct.

14. No Sale or Behavioral Advertising

ReviewMaster does not sell Customer personal information for money.

ReviewMaster does not use Customer review data for third-party behavioral advertising.

ReviewMaster does not disclose Merchant or Customer information to advertisers for cross-context behavioral advertising.

Where a particular privacy law defines “sale” or “sharing” more broadly, we intend not to engage in activities that constitute sale or sharing for cross-context behavioral advertising through ReviewMaster.

15. AI and Automated Content

ReviewMaster does not use Customer review text to train Marka-owned general-purpose artificial-intelligence models.

Review text is not transmitted to a third-party generative-AI provider for rewriting or model training.

16. International Processing and Transfers

Marka is established in India.

ReviewMaster may process personal information in countries other than the country where a Merchant or Customer is located.

Current hosting, email and other processing locations are described in our DPA and Subprocessor List.

Where personal information protected by EEA, UK, Swiss or other international-transfer rules is transferred to a country not recognized as providing adequate protection, we use an applicable transfer mechanism where legally required, which may include:

• European Commission Standard Contractual Clauses;
• the UK International Data Transfer Addendum;
• other lawful transfer safeguards.

Additional details are provided in our DPA.

17. Data Security

We maintain technical and organizational measures designed to protect personal information against unauthorized:

• access;
• disclosure;
• alteration;
• loss;
• destruction.

Measures may include, as appropriate:

• HTTPS/TLS encryption in transit;
• encryption of sensitive credentials at rest;
• access controls;
• logical separation of Merchant data;
• secret management;
• least-privilege access;
• logging;
• dependency and system maintenance;
• backups;
• incident-response procedures.

No online system can guarantee absolute security.

18. Retention

We retain information only for as long as reasonably necessary for the purposes described in this Policy, contractual obligations, platform requirements or Applicable Law.

Merchant data

While ReviewMaster remains installed, data required to provide the service may be retained for the duration of the relationship.

Review invitations

Personal information associated with review requests is retained only for the period reasonably necessary to send the request, reminders, verify the resulting review, prevent duplicate requests and meet legal or operational requirements.

Single-use invitation links should expire within the period stated in the App.

Reviews

Published review information may be retained while ReviewMaster is installed and the Merchant requires the review to be provided through the service.

Operational and analytics information

Identifiable technical information, if retained, is kept for limited periods appropriate to its security, fraud-prevention or operational purpose.

Backups

Residual personal information that remains solely in encrypted backups after deletion is:

• placed beyond ordinary active use;
• not restored to production except where legitimately necessary for disaster recovery;
• automatically deleted or overwritten within no more than 35 days after the relevant production deletion, unless Applicable Law requires otherwise.

Legal records

Marka may retain records required for:

• taxation;
• accounting;
• security;
• fraud prevention;
• legal claims;
• regulatory compliance,

for the period required or permitted by Applicable Law.

19. Shopify Privacy Webhooks and Deletion

ReviewMaster supports Shopify’s applicable mandatory privacy/compliance mechanisms.

Customer data requests

Where Shopify or a Merchant forwards an eligible Customer data request, ReviewMaster will provide information reasonably necessary for the Merchant to respond, subject to Applicable Law and the DPA.

Customer redaction

When ReviewMaster receives an enforceable Customer deletion/redaction instruction, we delete or irreversibly anonymize Customer personal data as required.

We will not automatically assume that free-text review content is anonymous merely because the reviewer’s email or display name has been removed.

Where review text, media or other content itself identifies the individual, it may also require deletion or additional anonymization.

ReviewMaster may retain only information independently permitted or required to be retained, such as an applicable suppression record.

Shop redaction / uninstall

Following uninstall, applicable Merchant Data is deleted within Shopify’s required period and ordinarily substantially sooner through ReviewMaster’s uninstall and redaction processes.

Credentials enabling ReviewMaster to access the Merchant store are deleted, revoked or rendered unusable when no longer authorized.

20. Rights of Merchants and Individuals

Depending on Applicable Law, an individual may have rights including:

• access;
• correction;
• deletion;
• restriction;
• objection;
• portability;
• withdrawal of consent;
• complaint to a competent supervisory authority.

These rights are not absolute and may be subject to legal exceptions.

Customers of Merchants

If you are a Customer who submitted information through a Merchant’s store, the Merchant generally controls that information.

You should normally submit your request to the Merchant first.

ReviewMaster will assist the Merchant according to our DPA and Applicable Law.

Where Marka independently controls a particular record, such as a suppression record or Marka’s own correspondence with you, you may contact us directly.

21. EEA and UK Individuals

Where GDPR or UK GDPR applies, individuals may have rights under those laws.

Where Marka acts as a processor, requests should generally be handled through the relevant Merchant controller.

Where Marka acts as controller, you may contact:

tech@houseofmarka.com

22. United States State Privacy Rights

Residents of certain US states may have additional rights under applicable state privacy laws.

Where such a law applies to Marka’s own controller/business processing, we will honour legally applicable rights.

Where ReviewMaster acts as a processor/service provider for a Merchant, the Merchant is responsible for receiving applicable consumer requests and ReviewMaster will assist as required by the DPA.

ReviewMaster does not use Customer personal information for targeted advertising or sell Customer personal information through ReviewMaster.

23. India Privacy Requirements

Marka complies with applicable Indian privacy, data-protection and cybersecurity laws.

This includes compliance with the Digital Personal Data Protection Act, 2023 and applicable rules to the extent their respective provisions are in force and applicable to our processing, together with other presently applicable Indian legal requirements.

As additional provisions become legally effective, Marka will update its processes and notices where required.

24. Children’s Information

ReviewMaster is intended for use in connection with ordinary ecommerce reviews and is not directed to children.

We do not knowingly design ReviewMaster to solicit personal information directly from children under 16.

Merchants must not knowingly use ReviewMaster to collect children’s personal data where doing so would violate Applicable Law.

If you believe a child has submitted personal information unlawfully through ReviewMaster, contact the relevant Merchant or email us at tech@houseofmarka.com.

25. Business Transfers

If Marka or ReviewMaster is involved in a:

• merger;
• acquisition;
• financing;
• reorganization;
• insolvency;
• sale of assets;
• transfer of business,

information may be disclosed or transferred as part of that transaction, subject to appropriate confidentiality and data-protection obligations.

26. Legal Disclosure

We may preserve or disclose information where we reasonably believe doing so is necessary to:

• comply with Applicable Law;
• respond to lawful legal process;
• enforce our agreements;
• protect legal rights;
• investigate fraud;
• protect security;
• prevent harm.

Where legally permitted and appropriate, we may notify the affected Merchant before disclosure.

27. Changes to this Privacy Policy

We may update this Policy as ReviewMaster changes.

If a change materially affects how personal information is processed, we will use commercially reasonable means to inform affected installed Merchants where required.

The “Last updated” date identifies the current version.

28. Contact

Privacy questions and legally applicable requests may be sent to:

Marka Modern Retail Private Limited
ReviewMaster
1st Floor, Plot 558 P, Sector 27, Gurugram (Gurgaon), Haryana 122009, India
Email: tech@houseofmarka.com