Privacy Policy

1. Business Owner Information

When a business owner creates an account or manages a store profile on Svecho, we collect and store:

• Account Credentials: Email address and encrypted password hash, managed through Supabase Authentication.
• Business Profile Data: Business name, unique store slug, category, subcategory, products/services list, domain keywords, city, street address (if supplied), and verified HTTPS Google Review link.
• Usage Counters: Counters tracking the number of AI drafts created, in-flight draft reservations, trial quota allowances, and review link interactions.

2. Customer Review Drafts & Usage Information

When you use a business’s public review page to generate a draft, we collect the information needed to process your request and operate the service. This includes:

• Your selected star rating, product or service, and preferred language.
• The generated draft, or information about an unsuccessful generation request.
• The date and time of the request and the business it relates to.
• Technical identifiers used to recognize repeat requests, manage usage limits, and help prevent misuse.

We also use a pseudonymous identifier derived from your IP address to support usage limits and misuse prevention. This identifier is not anonymous. Raw IP addresses are not stored in our draft records.

3. Keywords, Notes & Free-Text Input Processing

When requesting a review draft, the customer's selected keyword chips and typed experience notes are processed in server memory and transmitted securely to our AI inference processor (Groq) to construct the draft.

4. Purposes of Data Processing

We process the data described above exclusively for:

• Draft Generation: Producing natural, authentic review suggestions matching customer sentiment and language choice.
• Quota Management: Enforcing trial draft allowances per business profile.
• Duplicate Request Prevention: Returning the cached draft for identical retries without re-consuming quota.
• Abuse Prevention & Rate Limiting: Protecting infrastructure from automated spamming and denial-of-service attempts via pseudonymous IP hashes.

5. Third-Party Service Providers & Processors

Svecho utilizes select cloud infrastructure partners to provide the service:

6. Distinction Between Svecho and Google

Svecho is an independent drafting companion. Svecho does not post to Google. When a customer copies review text and opens Google, any submission is made directly on Google's platform under Google's Terms of Service and Privacy Policy.

Requesting deletion of records in Svecho does not and cannot delete or modify reviews previously published on Google.

7. Cookies, Analytics & Infrastructure Logs

• Authentication Cookies: Necessary session cookies are utilized via Supabase SSR exclusively for authenticating business owners across protected owner dashboard and profile setup routes. Customers browsing public review pages do not receive authentication cookies.
• Marketing Analytics: No third-party marketing, behavioral advertising, or tracking analytics tools (such as Google Analytics or Meta Pixel) were identified in the current application codebase. Deployment-level analytics (e.g. Vercel Web Analytics, if enabled on hosting) are managed separately.
• Infrastructure Logs: While Svecho does not log customer reviews in application logs, we cannot guarantee zero infrastructure logging. Cloud hosting and edge routing providers (such as Vercel and Supabase) may record standard HTTP access logs (such as request paths, IP addresses, and user-agents) for security and routing purposes.

8. Data Retention & Account Deletion

No Self-Service Deletion: There is currently no self-service account deletion control in the Svecho web interface.

Deletion Requests: Business owners may request deletion of their account and associated data by emailing samyak@svest.in, subject to appropriate identity verification.

Upon manual account deletion, database foreign-key cascading automatically purges:

• The owner's authentication record and email.
• The business profile and configuration details.
• All associated draft reservation records and stored draft texts for that business.

Please note that we do not promise immediate erasure from encrypted database backups or third-party service provider logs, which follow their respective retention and purge schedules. Formal automated data retention and cleanup schedules have not yet been formalized.