Privacy Policy

Unbound Reviews · Last updated 1 November 2026

Unbound Reviews (reviews.unbound.agency) is a review-management service run by Unbound, a digital marketing agency in New Zealand, for the businesses we work with (our “clients”). It sends review requests to a client's customers, collects their feedback, shows the client its Google reviews and helps it reply. This policy explains what personal information the service handles and how we look after it, in line with the New Zealand Privacy Act 2020.

Whose information this covers

People who sign in to the service: the Unbound team and staff of our clients.
A client's customers, whose details the client gives us so we can ask them for a review. We handle this information on the client's behalf.
People who use a review page to rate a business or send private feedback.
People who have left a public Google review for a client's business.

What we collect

Sign-in details: your name, email address and profile photo from your Google account.
Customer details from clients: name, mobile number and email address, the staff member or job involved, and whether the person has opted out of messages.
Review page responses: the option chosen, any feedback written and any contact details someone chooses to give.
Google reviews of client businesses: the reviewer's public name and photo, star rating, comment and date, and the business's reply.
Connected accounts: access tokens for the Google Business Profile, Facebook, Instagram and LinkedIn accounts that are connected to the service.
Technical information: cookies that keep you signed in, and server logs (such as IP address and browser) used for security and troubleshooting. We don't use advertising or analytics cookies.

Google user data

When you sign in with Google, we receive your name, email address and profile photo. We use these only to identify you and decide which client workspaces you can access.

When an Unbound team member connects Google Business Profile, the service can see the business locations that Google account manages and their reviews. It uses this access to show each client its reviews and to post replies to those reviews, either written or approved by a user, or sent automatically when a client has turned on auto-reply. It doesn't change any other part of a Business Profile.

We don't sell Google user data, use it for advertising, or let people read it except where needed to provide the service, keep it secure or comply with the law. Unbound Reviews' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove the service's access to your Google account at any time at myaccount.google.com/permissions.

How we use information

To send review requests by SMS and email on a client's behalf, and record whether they were delivered.
To show clients their reviews and the feedback their customers send.
To suggest replies to reviews. Review text and the business name are sent to Google's Gemini AI service to draft them.
To post replies on Google, and to share reviews on a client's Facebook, Instagram or LinkedIn page when the client turns this on.
To run, secure, support and improve the service.

We don't use customers' details for our own marketing, and we never sell personal information.

Who we share it with

We share information only with the client it relates to and with the providers that run parts of the service:

Google Cloud: hosting and database (United States, Oregon).
SMS Everyone: sending text messages.
Twilio SendGrid: sending email.
Google (Gemini API): drafting suggested replies.
Google Business Profile, Meta (Facebook and Instagram) and LinkedIn: publishing replies and posts on accounts a client has connected.

Some of these providers store or process information outside New Zealand, including in the United States. We use providers that protect personal information in ways comparable to the Privacy Act 2020. We may also disclose information where the law requires it.

Security

Information is sent over encrypted (HTTPS) connections. Passwords, API keys and access tokens for connected services are encrypted in our database. Only signed-in users can see a client's workspace, and only the Unbound team can change its settings.

How long we keep it

We keep information for as long as the client uses the service. When a client account is closed, its data is deleted, and backups are replaced over time. We keep a record of opt-outs so we don't message someone again after they've asked us to stop. You can ask us to delete your information sooner.

Your choices and rights

Every review request includes an opt-out link. Once you use it, that business won't send you more requests through this service.
You can ask to see or correct the personal information we hold about you. If a business gave us your details, you can also contact that business directly.
If you're not happy with how we've handled your information, please tell us. You can also complain to the Office of the Privacy Commissioner.

Changes

We may update this policy as the service changes. The date at the top shows when it last changed.

Contact us

For privacy questions or requests, email hello@unbound.nz.