Privacy Policy

1. Who we are (data controller)

ReviewLoom is an independent software product developed and operated by an individual developer (“we”, “us”). We are the data controller for the small amount of personal data described in this policy. You can reach us at kunlun2050@gmail.com for any privacy question, including access and deletion requests.

ReviewLoom is not affiliated with Amazon.com, Inc. or Google LLC. Those companies have their own privacy policies that apply to your use of their services.

2. Summary

• The review data you export is read inside your browser and written directly to a file on your computer. We never receive it and never store it.
• You can use ReviewLoom entirely without an account. In that case we store nothing about you on our servers.
• If you choose to sign in with Google, we store your Google account identifier, email address and display name, plus a daily count of how many reviews you exported. That is the whole list.
• We do not run advertising, we do not use analytics or tracking pixels, we do not build profiles, and we do not sell or rent data to anyone.

3. Data processed inside your browser (never sent to us)

Removing the extension deletes all of this local data. We have no copy and cannot recover it for you.

4. Data we store on our servers — only if you sign in

Signing in is optional. If you use “Sign in with Google”, the extension receives an ID token and sends it to our API at amazonreviewexporter.top. We verify that token with Google and then store the following:

We do not store the reviews you export, the Amazon pages you visit, your browsing history, your IP address in a customer database, or any content of your Google Drive, Gmail, Calendar or Contacts.

5. Payments

Paid plans are sold through third-party payment providers (currently Alipay; other providers may be added). When you pay, you are redirected to the provider's own checkout page and your card, bank or wallet details are entered there. We never see or store your card number, bank credentials or wallet password. The provider tells us only whether the payment succeeded, the amount, the currency, and a transaction reference, which we store with the order record.

The payment provider processes your data under its own privacy policy.

6. Why we use this data (purposes and legal bases)

• To provide the service you asked for — authenticating you, counting your daily exports, applying a purchased plan. Legal basis: performance of a contract.
• To keep the service secure and working — verifying that a request is genuine, preventing abuse of the free allowance, rate limiting. Legal basis: our legitimate interest in running a functioning, abuse-resistant service.
• To meet the law — retaining order records for tax and accounting. Legal basis: legal obligation.
• With your consent — only for the sign-in itself; you may withdraw it at any time by signing out or by asking us to delete your record.

We do not use your data for advertising, profiling, automated decision-making with legal effect, or any purpose unrelated to the list above.

7. Who we share data with

We do not sell, rent, trade or share personal data for anyone else's purposes. Data is disclosed only to the processors that are technically required to run the service:

• Cloudflare, Inc. — hosting, database and network delivery for our API and website. Requests pass through Cloudflare's global network, which means data may be processed in a country other than yours.
• Google LLC — only as the identity provider that issues and validates your sign-in token. We do not send Google any data about your exports.
• The payment provider — only when you make a purchase, and only the order data it needs to process the payment.
• Authorities — if we are legally compelled, and only to the extent required.

We may publish aggregate, non-identifying statistics (for example “10,000 exports processed”), but never anything that identifies a person.

8. How long we keep data

• Daily usage counters: kept for 400 days, then deleted automatically. Only the current day is used to enforce the allowance; older rows exist solely for abuse investigation.
• Account record (identifier, email, name, plan): kept while your account exists. Deleted within 30 days of a deletion request, or after 24 consecutive months without any sign-in.
• Order and payment records: kept for 5 years after the purchase, because tax and accounting rules require it. These records are minimal (order id, amount, date, transaction reference) and are not used for any other purpose.
• Local data in your browser: kept until you clear it or remove the extension; we have no access to it and no ability to delete it remotely.

When a retention period ends, the data is deleted from our database. Encrypted backups, if any, expire within 35 days.

9. Your rights

Subject to applicable law (for example the GDPR in the EU/EEA and UK, or your local data-protection law), you have the right to:

• Access the personal data we hold about you, and receive a copy.
• Correct data that is wrong (usually by signing in again, which refreshes it).
• Delete your account record and usage counters.
• Restrict or object to processing based on our legitimate interest.
• Port the data you gave us, in a machine-readable format.
• Withdraw consent at any time, without affecting processing already carried out.
• Complain to your local data-protection authority.

To exercise any of these, email kunlun2050@gmail.com from the address associated with your account, or include your Google account email. We answer within 7 days and complete requests within 30 days. We may ask for proof that the account is yours; we will never ask for your password.

The simplest deletion method needs no email at all: sign in to the extension, open the popup, and use the account section to sign out — then email us and we will remove the server-side record.

10. Security

• All traffic between the extension, our API and this website uses HTTPS/TLS.
• Our API verifies Google ID tokens on every request; unsigned or expired tokens are rejected.
• Access to the production database is limited to the deployed service through scoped credentials; there is no public database endpoint.
• We store the minimum: there is no review content, no browsing history and no payment credential in our database to leak.
• Administrative operations (refunds, order queries) require a separate secret token.

No system is perfectly secure. If a breach ever affects your data, we will notify affected users and the competent authority as required by law.

11. Cookies and similar technologies

This website sets no cookies and runs no analytics, advertising or fingerprinting scripts. It is plain static HTML. Our hosting provider processes standard request metadata (IP address, user agent, timestamp) to deliver the page and to defend against attacks; those logs are short-lived and are not used to build profiles.

The extension does not set cookies either. It uses chrome.storage.local, which stays on your device and is not readable by websites.

12. Children

ReviewLoom is a business and research tool and is not directed to children. We do not knowingly collect data from anyone under 16 (or under the digital-consent age in your country). If you believe a child has created an account, email us and we will delete it.

13. Google API Services — Limited Use disclosure

ReviewLoom's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Concretely, for the Google user data we handle:

• We request only the openid, email and profile scopes. We do not request Gmail, Drive, Calendar, Contacts, Photos, or any other Google API scope.
• We use the data only to authenticate you and to maintain your usage counter and purchased plan.
• We do not use it for advertising, and we do not sell it.
• We do not transfer it to third parties except as needed to provide the service (Cloudflare hosting), to comply with law, or as part of a merger/acquisition with notice to you.
• We do not use it to train, fine-tune or improve machine-learning models.
• Humans do not read your data, except where you ask us to for support, where required by law, or for security investigation — and then only the minimum necessary.

14. AI, generated media and prohibited uses

ReviewLoom contains no generative AI features. It does not generate, edit, synthesize or distribute images, video or audio, and it does not use Google user data, review content, or any other input to create or spread AI-generated non-consensual intimate imagery (AI NCII) or any other abusive synthetic media. It performs text extraction and CSV/JSON serialization only.

15. Changes to this policy

If we change how we handle data, we update this page and its “Last updated” date. Material changes that affect existing users will additionally be announced in the extension's release notes at least 14 days before taking effect. Continuing to use ReviewLoom after a change means you accept the updated policy.

16. Contact

Privacy questions, access requests, deletion requests, or complaints:

Email: kunlun2050@gmail.com
Data controller: the individual developer operating ReviewLoom
Website: amazonreviewexporter.top
Response time: within 7 days; statutory requests completed within 30 days

Amazon Review Exporter, ReviewLoom and this website are independent of Amazon.com, Inc. and Google LLC. “Amazon” and “Google” are trademarks of their respective owners and are used here only to describe compatibility.