1. Who we are
GatherRatings (gatherratings.com) is run by SetupMyBusiness, based in Brooklyn, New York, USA. In this policy, “we” and “us” mean GatherRatings.
We deal with three groups of people, and we collect different things from each:
- Customers who open a business's review page by QR code, NFC card or link.
- Businesses that use GatherRatings, and the staff who sign in to their dashboard.
- Visitors to gatherratings.com, including people who send us a message.
2. If you leave a rating on a review page
Each review page belongs to the business named on it. That business decides what its page asks for and what it does with your feedback. We run the page and store what you send on the business's behalf.
What we collect
- The star rating you tap.
- Anything you choose to write in the feedback box.
- Your name and phone number, only if the business asks for them and you choose to fill them in.
- Whether you ticked the box agreeing to hear from the business, the exact wording you were shown, and when you ticked it.
- Which card, table or printed code you came from, when the business has tagged it.
- Whether you tapped the button to go to Google.
We don't store your IP address with your feedback, and review pages don't set cookies or load analytics or advertising trackers.
How it's used
- The business sees your rating and feedback in its GatherRatings dashboard and can export it.
- For ratings of 1 to 3 stars, the business can choose to get an email with your rating, your feedback and any details you gave, so they can follow up.
- Your rating is counted in the business's statistics and weekly summary.
We don't use your details to market to you, and we don't sell them. If you agreed to hear from the business, it's the business that may contact you, and you can ask them to stop at any time.
When you go to Google
By default, every customer is offered the Google review link, whatever rating they give. A business can instead choose to show customers who give 1 to 3 stars an optional private feedback form and a thank-you message, without the Google link. When you tap the Google link, you leave GatherRatings and go to Google. Anything you post there is public and handled under Google's privacy policy. We don't see, write or post Google reviews.
3. If you're a business or website visitor
Contact form
When you send us a message, we collect your name, business name, email address, phone number (optional), number of locations, what you're interested in and your message. We use these details to reply to you and, if you go ahead, to set up your service. A copy of the message is emailed to our team.
Dashboard accounts
For people who sign in to the dashboard, we keep:
- Your name, email address, phone number (optional), role and which businesses you can manage.
- Your password and two-factor sign-in, handled by our sign-in provider, Supabase. Passwords are stored hashed, and we never see them.
- A history of sign-ins and failed sign-in attempts: the date and time, IP address, approximate location (country, region and city, as reported by our hosting provider) and browser. You can see your own history in Settings, and GatherRatings administrators can see it too. We use it to keep accounts secure.
- A record of changes made in the dashboard (who changed what, and when), so mistakes and misuse can be traced.
Business details
The name, logo, colours, contact details, social links, Google review link and alert email addresses you give us for each review page. Anything you put on a review page is public.
Visiting the website
To show prices in your currency, the website reads the country our hosting provider detects from your IP address. We don't store it. Like most hosts, our hosting provider keeps short-term server logs, which include IP addresses, for security and to keep the service running.
4. Cookies and tracking
The public website, blog and review pages don't set cookies and don't use analytics, advertising pixels or other tracking. Our fonts are served from our own site, so loading a page doesn't send your details to a font service.
The dashboard uses cookies only to keep you signed in. They're needed for sign-in to work, so there's no option to turn them off.
If we ever add analytics or other tracking, we'll update this policy first and ask for consent where the law requires it.
5. Stopping spam and abuse
To stop people flooding review pages, the contact form or the sign-in page, we count how many requests come from the same IP address in a short time. The address is turned into a one-way code (a hash) before it's counted, and the counts expire within an hour. The contact form also has a hidden field that only automated bots fill in.
6. Who processes your information
We don't sell personal information or share it for advertising. These companies process it for us so we can run GatherRatings:
- Vercel hosts the website and review pages.
- Supabase runs our database, file storage (business logos) and dashboard sign-in. Data is stored in Tokyo, Japan.
- Upstash holds short-lived counters used to block spam and abuse.
- Resend sends our emails, such as low-rating alerts and weekly summaries.
We also share information:
- with the business whose review page you used, as described above;
- when the law requires it, or to protect people from harm or fraud;
- with a buyer or successor if GatherRatings is sold or merged, under the same promises as this policy.
Your information may be stored and processed in Japan, the United States and other countries where these companies operate. Their data protection laws may differ from those where you live.
7. How long we keep it
- Customer feedback and Google clicks: deleted automatically once they're 2 years old. The deletion runs once a month, so a record can last up to a month longer. A business can ask us to delete its feedback sooner, for example when it stops using GatherRatings.
- Contact form messages: for as long as we need them to follow up, and for the length of our relationship if you become a customer.
- Dashboard accounts, sign-in history and the change log: while the account exists, for security.
- Spam and abuse counters: less than an hour.
You can ask us to delete your information at any time, as described below.
8. Your choices and rights
You can ask us to:
- tell you what information we hold about you and give you a copy;
- correct information that's wrong;
- delete your information;
- stop using it for a particular purpose.
If you left feedback on a review page, the quickest route is usually the business itself, since it decides how your feedback is used. You can also contact us and we'll help or pass your request on.
Depending on where you live, for example the European Union, the United Kingdom or California, you may have more rights, including the right to complain to your local data protection authority. We'll answer requests as soon as we can and within the time the law allows. We may need to confirm who you are first.
To make a request, use the contact form on our home page and tell us what you'd like us to do.
9. How we protect it
All traffic uses HTTPS. The database can only be reached through our own server code, not directly from the internet. Dashboard access needs a password, which is checked against lists of known leaked passwords, and can require two-factor sign-in. Staff only see the businesses they've been given access to.
No system is perfectly secure. If you think you've found a security problem, please tell us straight away.
10. Children
GatherRatings isn't aimed at children. If you believe a child has given us personal details, contact us and we'll delete them.
11. Changes to this policy
When we change this policy, we'll update the date at the top of this page. If a change significantly affects how we use information, we'll also tell the businesses we work with by email before it takes effect. Our Terms of Service explain how the service itself works.
12. Contact us
For questions about this policy or your information, use the contact form on our home page.