Privacy Policy

1. Introduction

This Privacy Policy explains how Review Surge ("Review Surge", "we", "us" or "our") collects, holds, uses and discloses personal information when you:

• visit whirlword.com.au;
• create or use a Review Surge account;
• use our review automation and reputation management services (the "Service"); or
• contact or otherwise interact with us.

Review Surge is operated as a sole trader business in Western Australia.

We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) to the extent they apply to us.

2. What Personal Information We Collect

The information we collect depends on how you interact with Whirl Word and how the Service is configured. This may include:

Account and business information

• Name
• Email address
• Phone number
• Business name
• Business address
• Website
• Account and authentication information
• Account settings and preferences

Customer information

Our business customers may provide information about their own customers for use with the Service, including:

• First name
• Mobile telephone number
• Email address, where available
• Job or service-related information
• Review-related information
• Communication information

Integration information

Information may be received through integrations and connected business systems, including services such as:

• Zapier
• TouchSMS
• Google services
• Other systems connected to or used with Review Surge

Depending on the integration, this information may include customer contact information, job or invoice information, review information, and information required to trigger an automation.

Payment information

Payments and subscriptions are processed through Stripe. Whirl Word does not store customers' full payment card numbers.

Technical information

We may automatically collect information such as:

• IP address
• Browser and device information
• Operating system
• Pages and features accessed
• Session information
• Technical and security logs
• Website usage information

Support information

When you contact us, we may collect information contained in your communications with us, including information necessary to provide support or troubleshoot the Service.

3. How We Collect Personal Information

We may collect personal information:

• directly from you;
• when you create or use an account;
• through forms on our website;
• when you contact us;
• through your use of the Service;
• through integrations and connected systems;
• through automation platforms;
• through payment providers;
• through communication providers;
• through Google services; and
• from our business customers where they provide information about their own customers.

In some circumstances, we receive personal information about individuals from a business customer rather than collecting that information directly from those individuals.

4. How We Use Personal Information

We use personal information to:

• provide and operate the Service;
• create and manage accounts;
• process information through connected integrations;
• trigger and manage review requests and follow-up communications;
• provide customer support;
• troubleshoot and maintain the Service;
• process subscriptions and payments;
• communicate service, security and account information;
• monitor and improve our website and Service;
• prevent fraud and misuse;
• maintain security; and
• comply with legal obligations.

Where reasonably practical, information may be aggregated or de-identified for analytics and service improvement.

5. Customer Data Provided by Businesses

Review Surge provides software that businesses can use to automate review requests and related communications.

Our business customers may provide us with personal information relating to their own customers, such as names, mobile telephone numbers and email addresses.

The business providing this information to Review Surge is responsible for ensuring that it has the appropriate authority, consent or other lawful basis required to collect, use and provide that information to Review Surge and to communicate with those individuals using the Service.

Review Surge relies on its customers to provide customer information lawfully and does not independently verify how every customer contact was originally collected.

Review Surge processes this information for the purposes of providing the Service, including transferring information through connected systems, sending configured communications, managing review workflows and providing related functionality.

6. AI-Generated Review Replies

Review Surge provides an AI feature that can generate responses to Google reviews.

When this feature is used, review content may be provided to a third-party AI service, such as OpenAI, to generate a response based on the content and context of the review.

The AI feature is used to assist with generating review responses. It is not used to make decisions about an individual's employment, credit, insurance, housing or other matters that significantly affect an individual's rights or interests.

7. Who We Share Personal Information With

We do not sell personal information.

We may disclose personal information to third parties where reasonably necessary to provide the Service, operate our business or comply with legal obligations.

These may include:

• CRM and SaaS technology providers;
• automation and integration providers such as Zapier;
• SMS and email providers such as TouchSMS;
• payment providers such as Stripe;
• Google services;
• AI service providers;
• hosting and technology providers;
• analytics providers;
• professional advisers; and
• government authorities or other parties where required or authorised by law.

Personal information may be transferred electronically through APIs, webhooks, authenticated integrations, encrypted connections, cloud systems, payment systems, communication systems and other technology used to provide the Service.

8. Google Business Profile and Reviews

Where a customer connects Google services to Review Surge, we may access information made available through the permissions granted to that connection.

This may include:

• Google Business Profile information;
• business statistics;
• customer reviews;
• review ratings; and
• review text.

A customer may connect their own Google account, or may authorise Review Surge to assist with a connection where appropriate access has been provided.

Review Surge does not require a customer's Google account password for normal operation of the Google integration.

9. SMS and Email Communications

Review Surge may use SMS and email services to send review requests, follow-ups and other communications configured by our business customers.

Mobile telephone numbers provided to or processed by Review Surge are used for purposes related to the Service, including sending configured review invitations, follow-up messages and service-related notifications.

SMS communications may be delivered through TouchSMS or other communication functionality used to provide the Service.

Review Surge does not sell mobile telephone numbers or SMS opt-in information, and does not share such information with third parties for their own independent marketing purposes.

Where a recipient replies to a review request, the response may be made available to the relevant business customer and may generate notifications through the relevant communication systems.

Review Surge supports unsubscribe mechanisms for SMS communications. Where a recipient sends a recognised unsubscribe request such as STOP, relevant messaging will be stopped.

Our business customers are responsible for ensuring that communications sent through the Service comply with applicable laws, including applicable consent and marketing requirements.

10. Cookies and Analytics

Our website may use cookies and similar technologies for functionality, analytics and website performance. We currently use:

• Google Analytics; and
• Google Tag Manager.

These technologies may be used to understand website usage, measure performance, identify technical issues and improve our website. We do not currently use advertising or retargeting cookies for paid advertising campaigns.

11. Overseas Disclosure

Some third-party providers used by Review Surge may be located outside Australia or may process personal information outside Australia.

This may include providers located in the United States and other countries where our technology providers operate.

Overseas recipients may include technology, cloud, payment, communication, analytics, integration and AI service providers.

Where required by the Privacy Act, we take reasonable steps to address the requirements of Australian Privacy Principle 8 when personal information is disclosed to an overseas recipient.

12. Security

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

Our security measures may include:

• encrypted connections such as HTTPS/TLS;
• authentication and access controls;
• two-factor authentication where available and enabled;
• restricted access;
• security monitoring provided by our technology providers; and
• procedures for responding to security incidents.

No electronic storage or transmission system can guarantee complete security.

Where applicable, we will respond to data breaches in accordance with Australian privacy laws, including the Notifiable Data Breaches scheme.

13. How Long We Keep Information

We retain personal information only for as long as reasonably necessary to provide the Service, operate our business, comply with legal obligations, resolve disputes and maintain appropriate records.

When a customer closes their Review Surge account, we aim to delete personal information that is no longer required within 30 days.

Some information may be retained for longer where reasonably necessary for legal, taxation, accounting, security, backup, dispute-resolution or other legitimate purposes.

Information held by third-party providers may be subject to their own retention and deletion processes.

14. Access, Correction and Deletion

You may request access to personal information Review Surge holds about you and may request that inaccurate or outdated information be corrected.

You may also request deletion of your personal information, subject to information we are required or permitted to retain by law or for legitimate purposes.

To make a request, contact:

We may need to verify your identity before processing a request.

We will respond to reasonable requests within a reasonable period.

15. Privacy Complaints

If you believe Review Surge has mishandled your personal information or breached an applicable privacy obligation, you may contact us:

Please provide enough information for us to investigate your complaint.

We will consider and respond to privacy complaints within a reasonable period.

There is no charge for making a privacy complaint.

If you are not satisfied with our response, you may be able to make a complaint to the Office of the Australian Information Commissioner (OAIC).

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our Service, business, technology providers, data practices or applicable laws.

The latest version will be published on whirlword.com.au and will include the date it was last updated.

17. Contact Us

For privacy enquiries, access or correction requests, deletion requests or privacy complaints, contact: