Privacy Policy
Last updated: March 2026
Who We Are
Tap4Review is a service operated by Construction Media Limited, a company registered in England and Wales. Our registered address is First Floor, City Centre, Swan Buildings, 20 Swan Street, Greater Manchester, M4 5JW.
If you have any questions about this policy or how we handle your data, please contact us at [email protected].
ICO Registration: We are registered with the Information Commissioner's Office (ICO) as required under UK GDPR. Registration number: C1891489.
What Data We Collect and Why
We collect two types of data: data about our customers (businesses who subscribe to Tap4Review) and data about their end customers (the individuals who receive review requests).
| Data | Who it belongs to | Why we collect it |
|---|---|---|
| Name, email address | Subscriber (business) | Account creation and login via Google |
| Payment details | Subscriber (business) | Processed securely by Stripe — we never see your full card details |
| Google Business Profile data | Subscriber (business) | To display your reviews, ratings, and analytics inside the dashboard |
| Customer name, phone number, email, address | End customer (your customer) | To send a one-time SMS review request on behalf of the subscribing business |
Google API Data and Limited Use Disclosure
Tap4Review uses Google APIs to connect your Google Business Profile. When you authorise this connection, we access the following data via the Google Business Profile API:
- Your Google Business Profile account name and location details
- Your business reviews (star ratings, review text, reviewer names)
- Review response history
- Basic business information (name, address, category)
How we use this data:
- To display your review statistics and analytics within your Tap4Review dashboard
- To show your average star rating and review trends over time
- To help you monitor and respond to customer feedback
What we do NOT do with this data:
- We do not sell or transfer your Google data to any third party
- We do not use your Google data for advertising or marketing purposes
- We do not share your Google data with other Tap4Review users or subscribers
- We do not use your Google data for any purpose other than providing the dashboard features described above
Our use of data received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Google data is stored securely in our database and is only accessible to the authorised account holder. You can revoke access at any time by disconnecting your Google Business Profile in your account settings, or by visiting your Google Account permissions page.
Our Legal Basis for Processing
Under UK GDPR, we rely on legitimate interests to send review request messages — specifically, the legitimate interest of the subscribing business in requesting feedback from customers they have recently served. We only send one message per job completion, and every message includes a clear way to opt out of future messages.
For subscriber accounts, we process data on the basis of contract performance — we need your data to provide the service you've signed up for.
For Google Business Profile data, we process on the basis of your explicit consent — you grant access via Google's OAuth consent screen and can revoke it at any time.
How We Send Messages
Review request SMS messages are sent via third-party messaging providers. We currently use GoHighLevel (GHL) and are in the process of transitioning to MyCRMSim. Both providers are contractually bound to process data only on our instructions and in accordance with UK GDPR.
End customer phone numbers are used solely to send the review request message. They are not sold, shared with any other business, or used for any marketing purpose beyond the single review request.
Who We Share Data With
We only share data with the following third-party services, and only to the extent necessary to operate the platform:
- Stripe — payment processing
- Google — login authentication and Google Business Profile data access
- GoHighLevel / MyCRMSim — SMS delivery
- Manus (hosting platform) — cloud infrastructure and database hosting
We do not sell your data or your customers' data to any third party, ever.
How Long We Keep Data
Subscriber account data is retained for the duration of your subscription and for up to 12 months after cancellation, after which it is deleted. End customer data (names, phone numbers, emails, addresses entered for review requests) is retained for as long as the subscribing business account is active. If you cancel your account, all associated end customer data is deleted within 30 days.
Google Business Profile data (reviews and ratings) is cached in our database to power your dashboard analytics. This cached data is deleted when you disconnect your Google Business Profile or close your account.
Your Rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data ("right to be forgotten")
- Object to processing based on legitimate interests
- Request a copy of your data in a portable format
- Withdraw consent at any time (where consent is the legal basis)
To exercise any of these rights, email us at [email protected]. We will respond within 30 days.
You also have the right to lodge a complaint with the ICO at ico.org.uk.
Cookies
We use only essential cookies required to keep you logged in and to maintain your session. We do not use advertising or tracking cookies. No cookie consent banner is required for strictly necessary cookies under UK law.
Changes to This Policy
If we make significant changes to this policy, we will notify subscribers by email and update the "last updated" date at the top of this page.