Privacy Policy

1. Who we are and how to contact us

Review Wheel is operated by MAXSOLU, a French limited liability company (SARL) registered under 841 653 355 RCS Paris, whose registered office is at 17 rue Daniel Stern, 75015 Paris, France. MAXSOLU is the controller for the processing described in this policy.

For privacy, account deletion, or data-access requests, email contact@restoinc.com or write to the postal address above. Please identify the email address associated with your account or participation so that we can locate your data. We may request reasonable proof of identity before acting on a request.

2. Scope and roles

This policy applies to visitors, merchant account holders, merchant team members, partners, and players who use a merchant's Review Wheel game.

Review Wheel is the controller for platform accounts, authentication, subscription billing, security, platform operations, and Google Business Profile connections. A merchant may also act as an independent controller for its customer campaign, rewards, review requests, internal feedback, and in-store redemption activity. Questions about a particular merchant's use of your information may therefore also be directed to that merchant.

3. Information we collect directly

Account and merchant data may include your name, email address, password hash, preferred language, profile image, role and permissions, store name, store address, telephone number, logo, uploaded media, team invitations, configuration, support messages, and audit history.

Player and campaign data may include your Google account identifier, Google email address, name, profile image, language, accepted terms, optional marketing consent, selected rating, written feedback, uploaded feedback images, task and review-link activity, coins earned and spent, game participation, prize result, redemption code, redemption status, and related timestamps.

Partner and commercial data may include partner profile information, promotion codes, referrals, commissions, payout records, and the attribution between a partner and a merchant.

Billing data may include the selected plan, checkout consent, promotion code, Stripe customer, subscription, checkout and invoice identifiers, invoice amounts, payment status, refunds, disputes, and invoice documents. Review Wheel does not receive or store full payment-card numbers; card data is handled by Stripe.

Technical data may include IP address, user agent, browser and device information, a pseudonymous device identifier derived for fraud prevention, session and security events, approximate request time, error logs, rate-limit events, and authentication records.

4. Google Sign-In data

When you choose Google Sign-In, Review Wheel requests the minimum standard identity scopes needed for authentication: openid, email, and profile. Google may provide a stable Google account identifier, email address, email-verification status, display name, and profile picture.

We use this data to authenticate you, create or link the correct merchant or player record, show your profile, prevent duplicate or fraudulent participation, associate prizes and feedback with the correct participant, and maintain account security. We do not access your Gmail, Google Drive, contacts, calendar, password, or payment-card information through Google Sign-In.

On a public game page, a masked version of a winner's display name and, where enabled, the Google profile picture may appear in the recent-winners area. The merchant operating the game and authorized staff may see the participant identity and activity needed to manage feedback, prizes, fraud prevention, and redemption.

5. Google Business Profile data

A merchant may separately connect a Google Business Profile. This connection requests the https://www.googleapis.com/auth/business.manage scope. After the merchant gives permission, Review Wheel may access the Google Business account and location identifiers, business name and address, aggregate rating and review count, and reviews for the selected location, including reviewer display name and profile picture when supplied by Google, star rating, comment, review dates, and the business's existing reply.

This information is used only to let the authorized merchant select its location, synchronize its Google reviews, and view those reviews and rating summaries inside the Google Reviews dashboard. The current service does not use this permission to publish replies or make undisclosed changes to the merchant's Google Business Profile.

OAuth access and refresh tokens are encrypted before storage. Access tokens are refreshed only when needed to provide the connected feature. A merchant can disconnect the integration from the Google Reviews dashboard and can also revoke access from the security settings of its Google Account.

6. Purposes and legal bases

Contract and pre-contractual steps: creating and administering accounts and stores; providing games, prizes, redemption, statistics, subscriptions, invoices, support, and connected Google features; and communicating service or security information.

Legitimate interests: securing the platform; preventing duplicate plays, abuse, account takeover, payment fraud, and unauthorized redemption; maintaining audit trails; diagnosing errors; measuring service reliability; defending legal claims; and improving user-facing functionality. We balance these interests against the rights of affected individuals.

Legal obligations: retaining accounting and invoice records, responding to lawful requests, handling tax and compliance duties, and documenting required consents.

Consent: optional marketing communications, optional permissions, and any non-essential cookies or similar technologies if introduced. Consent may be withdrawn at any time without affecting processing that occurred before withdrawal.

7. Google API Limited Use disclosure

Review Wheel's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is used only to provide or improve the user-facing authentication, game participation, merchant profile connection, and Google review synchronization features described in this policy. It is not sold, transferred to advertising platforms or data brokers, used for personalized or interest-based advertising, used to determine creditworthiness, or used to train a general-purpose artificial intelligence or machine-learning model.

Human access to Google user data is limited to the user, authorized merchant personnel where required for the feature, and authorized Review Wheel personnel where necessary for support requested by the user, security or abuse investigation, compliance with law, or internal operations involving appropriately aggregated data.

8. Who receives personal data

Personal data is available only to people and providers that need it for the purposes described above. Recipients may include the merchant operating a game and its authorized staff; Review Wheel administrators and authorized support personnel; an attributed partner for the limited merchant information permitted by the platform; and service providers acting under contract.

Service providers may include Google for authentication and Business Profile connectivity; Stripe for checkout, subscriptions, invoices, refunds, and payment security; OVHcloud for infrastructure hosting; the configured transactional-email provider for account, security, and prize emails; and Sentry if production error monitoring is enabled. Each provider processes data under its own terms and privacy commitments.

We may disclose information where required by law, to protect users or the service, to investigate fraud or security incidents, or in connection with a merger, acquisition, financing, or transfer of the service, subject to applicable notice and legal safeguards. We do not sell personal data.

9. International data transfers

Some providers, including Google, Stripe, email providers, or error-monitoring providers, may process data outside France or the European Economic Area. Where GDPR requires it, such transfers rely on an adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism provided by the relevant recipient.

10. Cookies and local storage

Review Wheel uses strictly necessary cookies and similar storage for authentication sessions, OAuth state and security checks, the selected language and store, player sessions, cookie choices, and interface preferences. These technologies are required to sign in securely and provide requested functionality.

We do not currently use these essential cookies for third-party behavioral advertising. If optional analytics, advertising, or other non-essential trackers are introduced, they will be described in the Cookie Policy and used only after obtaining consent where required.

11. Retention

Account, store, and configuration data is kept while the account or service relationship remains active and then for only as long as reasonably necessary to close the account, resolve disputes, prevent fraud, and meet legal obligations.

Google OAuth tokens are kept until the connection is disconnected, authorization is revoked, the associated account is deleted, or the token becomes invalid. Synchronized Google reviews and related location data are kept while the merchant uses the review dashboard and may be retained as account history until the merchant requests deletion or closes the relevant account, unless a legal obligation requires longer retention.

Player, feedback, prize, redemption, and anti-fraud records are retained for the duration needed to operate the campaign, honor and verify prizes, handle complaints, prevent repeat abuse, and establish or defend legal claims. Merchant administrators may archive campaign feedback, but archived data remains subject to the same retention limits.

Invoices, payment and accounting records may be retained for up to ten years where required by French accounting or tax law. Security logs and backups are retained on rolling, limited schedules and are deleted or overwritten when no longer necessary. Data may be anonymized instead of deleted when it can no longer identify an individual.

12. Security

We use measures appropriate to the nature of the data, including HTTPS, secure and HttpOnly cookies, password hashing, encrypted Google Business tokens, role-based access control, store-level authorization, rate limiting, audit logs, validation of uploads and inputs, and restricted administrative access. No internet service can guarantee absolute security; users must protect their credentials and report suspected unauthorized access promptly.

13. Your choices, disconnection, and deletion

You may update profile and store information from the dashboard, unsubscribe from optional marketing where offered, disconnect Google Business Profile from the Google Reviews dashboard, and revoke Review Wheel's Google access at https://myaccount.google.com/permissions.

To request deletion of a Review Wheel account or Google-derived data, email contact@restoinc.com or send a written request to MAXSOLU, 17 rue Daniel Stern, 75015 Paris, France. State the account email, the relevant store or game where applicable, and the scope of the request. Disconnecting Google Business Profile stops future API access but does not by itself erase records that must be retained for security, accounting, dispute, or legal purposes; a separate deletion request may be made.

14. Your GDPR rights

Subject to applicable conditions, you may request access, rectification, erasure, restriction, and portability of your personal data; object to processing based on legitimate interests; and withdraw consent at any time. You may also give instructions concerning your personal data after death where French law permits.

We normally respond within one month. The period may be extended where a request is complex or numerous, in which case we will inform you. You may lodge a complaint with the Commission nationale de l'informatique et des libertes (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at https://www.cnil.fr.

15. Automated processing and game outcomes

The service uses automated rules to calculate prize outcomes from a merchant's configured probabilities and stock, to count coins and participation, and to detect indicators of duplicate accounts or abuse. Anti-fraud checks may temporarily prevent participation or require review. These controls are designed to protect campaign fairness and do not make decisions about credit, employment, insurance, or similarly significant matters. You may contact us or the relevant merchant to contest an incorrect restriction.

16. Children

Review Wheel is a business service and is not directed to children. Google-connected features are not intended for children who are below the minimum age required to manage their own Google Account or provide valid consent under applicable law. A parent or guardian should contact us if they believe a child provided personal data without appropriate authorization.

17. Changes to this policy

We may update this policy when the service, legal requirements, or use of Google data changes. The current version and update date will remain publicly available at https://www.restoinc.com/en/privacy. If a material change affects how previously authorized Google user data is used, we will provide appropriate notice and request renewed consent where required before using that data for the new purpose.