GDPR Compliance Statement

Review Mechanic as a Data Processor: We act as a Data Processor on behalf of the subscribing business or merchant (the Data Controller) regarding end-customer data (names, telephone numbers, and transaction metadata used to dispatch review requests).

Review Mechanic as a Data Controller: We act as an independent Data Controller for account, administrative, and billing data belonging to the merchant directly (such as merchant login emails, business profile names, and billing records).

Sending review requests via WhatsApp, SMS, or email constitutes electronic direct communication governed by GDPR Article 6, the EU ePrivacy Directive, and the WhatsApp Business Messaging Policy. We enforce compliance through two core pillars:

• Customer Opt-In & Consent (Art. 6(1)(a)): Merchants must ensure customer consent prior to contact. Within Review Mechanic’s manual review dispatch flow, an explicit consent attestation ("Customer consented to receive a review invitation. Data is processed securely under GDPR guidelines") is active. For POS checkout ingestion, automated background blasting is prohibited; the merchant must actively trigger a 1-click invitation for verified customers.
• Legitimate Interest (Art. 6(1)(f)): Retained narrowly to maintain idempotent transaction deduplication logs and prevent repeat messages to the same individual, balanced against customer privacy.

We store solely the minimum metadata required to deliver and verify customer review invitations:

• Customer first name or display name
• Telephone number (E.164 sanitized format) and/or email address
• Transaction amount, date, and external event ID (for connected POS checkouts)
• Shortlink access timestamps to monitor invitation conversion rates

Review Mechanic does not create behavioural profiles, does not track consumer browsing across external sites, and never sells, rents, or monetizes customer data.

End customers and subscribing merchants hold enforceable rights under Chapter III of the GDPR:

• Right of Access (Art. 15): Request a copy of personal information held.
• Right to Rectification (Art. 16): Modify or update inaccurate contact information.
• Right to Erasure (Art. 17): Instant permanent deletion of transaction or audit records.
• Right to Restrict Processing (Art. 18) & Object (Art. 21): Halt message dispatches.
• Right to Portability (Art. 20): Export transaction records in standard JSON/CSV format.
• Right to Lodge a Complaint (Art. 77): Contact your competent EU national supervisory authority.

For end customers: Because Review Mechanic acts as a Processor, rights requests can be submitted directly to the merchant (the Controller) or to Review Mechanic directly at privacy@review-mechanic.com, which we will action in direct coordination with the merchant.

• On-Demand Purge: Merchants can trigger an instant deletion of any individual customer or transaction log directly via the dashboard. Production database records are purged in real time.
• Active Account Storage: Checkouts and invitation logs remain stored while an account is active. Unactioned transaction entries older than 90 days are subject to scheduled automated archiving.
• Account Termination: Upon merchant account deletion, an atomic cascading purge wipes all connected business records, credentials, and review records. Encrypted rolling backups overwrite fully within 30 days.

Review Mechanic provides optional checkout webhook listeners for Square, Shopify, and Clover. This automation is completely optional—manual review dispatch remains standard.

Zero Financial Exposure: Webhook listeners accept only event notifications (payment_intent.succeeded, orders/paid). Our systems never request, parse, or store primary account numbers (PAN), card verification values (CVV), expiration dates, or bank credentials.