ServiceHQ Reviews: privacy policy

ServiceHQ Reviews asks a trade business's customers for a Google review after a job, and helps the business keep up with the reviews that come in. It is operated by OnSpec Software Ltd, trading as ServiceHQ, registered in England and Wales under company number 17328057. Contact: support@servicehq.co.uk.

Who is responsible for what

The business that installs the add-on decides who is asked for a review, so it is thecontroller of its customers' data. We act as its processor: we only use that data to run the add-on for that business, on its instructions. For the business's own account details (its name, its billing, who connected it) we are the controller.

What we process

From the business's ServiceM8 account, with the permissions it approves when connecting:

• Business details: trading name, email address and timezone, so messages carry the right name and go out at sensible hours.
• Completed jobs: job number, status, completion time, badges, and the job's category and description (used only to describe the work in a drafted reply to a review).
• The customer to ask: the name, mobile number and email address on the job or the client card.
• Text and email history on those jobs, read only to spot a customer replying so no reminder goes to someone who has written back.
• Staff records, read only to note internally who completed a job. Staff names never appear in a message, and nobody is ranked.

About each review request:

• Who was asked (name, mobile or email, job number), when each message went, and how it went.
• Whether and when the customer opened the review link. We record the time only. The link does not set cookies or record where the customer is.
• Whether they replied, and whether the business ticked them as having reviewed.
• Opt-outs: the mobile number or email address of anyone who asked not to receive review requests from that business, kept so they are never asked again.

If the business connects its Google Business Profile:

• Its Google reviews: the reviewer's display name, star rating, what they wrote, the dates, and any reply already posted. Also the profile's name, average rating and number of reviews.
• Replies the add-on has drafted, until the business posts or replaces them.

Connection credentials for ServiceM8 and Google are stored encrypted, and are used only to act for the business that connected them.

What customers' devices share

Tapping a review link records the time and then sends the person straight to Google. Scanning the business's QR code adds one to a count and records nothing about who scanned it. The reviews shown on a business's own website by our widget come from Google's public reviews, with the reviewer's first name and initial only, and the widget sets no cookies.

Who else processes it

Only the companies needed to run the add-on, each for its own part:

• ServiceM8, where the jobs are, and which sends the texts and emails from the business's own account.
• Google, for the business's reviews and for posting replies the business approves.
• Anthropic, which provides the AI that drafts replies to reviews. For each review it receives the review itself, the business's name, area and phone number, and the job card's description of the work when the job can be found. We do not send it customers' phone numbers or email addresses, and what it receives is not used to train AI models.
• Meta, only if the business sends requests by WhatsApp through ServiceHQ Chat, which is covered by its own privacy policy.
• Stripe, which takes the subscription payment. We never see or store card details.

We do not sell any of this data, and we do not use it for our own marketing.

Where it is stored

On servers in the UK and the European Union, with encrypted backups held in the European Union. Where a supplier processes data outside the UK, the transfer is covered by the safeguards UK data protection law requires.

How long we keep it

While the business uses the add-on. The records of who was asked and who opened the link are what stop the same customer being asked over and over, so they are kept for as long as the add-on is in use. Opt-outs are kept for as long as we hold anything for that business, because forgetting one would mean asking someone who said no.

Disconnecting Google deletes the stored reviews and drafted replies straight away. Replies already posted on Google stay on Google.

When a business stops using the add-on, it can ask us to delete everything we hold for it and we will do so within 30 days. Deleted data persists in backups for up to a further 30 days before those expire, and is not restored or used in the meantime.

Your rights

If you are a business using the add-on, emailsupport@servicehq.co.uk from the address connected to your account for a copy of your data, a correction, or deletion.

If you were asked for a review, the business that asked you holds your details, so the quickest route is to ask them. To stop review requests from a business, use the link at the foot of any review email, or tell the business, which can mark your record so you are never asked. Replying to a review text or WhatsApp message also stops any reminders for that job. You can write to us too, and we will pass your request to the business and act on it ourselves.

You can complain to the Information Commissioner's Office atico.org.uk, though we would like the chance to put it right first.