Privacy policy

Good Reviews · Version 2026-09-27 · English

1. Who is responsible

Good Reviews is provided by Kailar UG (haftungsbeschränkt), Viererblock 18a, 39326 Wolmirstedt, Germany. Managing directors: Lea Rademacher and Ole Koslowski. Commercial register: Amtsgericht Stendal, HRB 26608. VAT ID: DE322762389. Contact for privacy and support: kontakt@kailar.de.

For merchants, account contacts and visitors to our own pages, Kailar is the controller for the purposes described below. For a shop's review invitations, customer records and private feedback, the shop is the controller and Kailar processes data on its instructions. The responsible shop is identified in its invitation or feedback page. Its own privacy notice explains its particular purposes and legal bases. This policy supplies information about Good Reviews; it does not replace the shop's notice.

2. Information for customers of a shop

The shop supplies data through Shopify, an authorised integration or an import. Depending on the feature used, this includes email address, first name, customer and order identifiers, order date, status and tags, language, marketing-consent status, invitation and delivery history, and unsubscribe or delivery-block status. Good Reviews uses these data to schedule and send invitations, prevent duplicate or unwanted mail, deliver replies and show results to that shop.

Submitting feedback is voluntary. A submission may contain a rating, your words, answers to additional questions, photos and, for an order-linked invitation, the contact details already associated with that order. A general shop link can collect feedback without a name or email. If you voluntarily enter an email there, it is unverified; Good Reviews labels it accordingly and does not make it a verified customer identity. The shop may use its own email application to contact that address. Do not submit health information, other sensitive details, information about children or information about other people that is unnecessary for your feedback.

Private feedback and photos are made available to the shop and its authorised users; they are not automatically published as public reviews. Publishing them elsewhere requires a separate lawful basis. Image processing removes file metadata when re-encoding a photo, but information visible in the picture remains.

If you choose an external review service, your browser leaves Good Reviews. That provider receives connection information such as your IP address and handles the review under its own terms and privacy policy. Good Reviews does not automatically send your private feedback to that service. The shop chooses the destinations and routing; rating-based routing remains technically available for existing or custom configurations. Merchants must use a fair invitation process and comply with the review service's rules.

The shop must establish a lawful basis before using your information. For German review-request emails our service terms require demonstrable prior consent covering these invitations (Article 6(1)(a) GDPR and section 7 UWG). A Shopify marketing flag alone does not establish the scope of that consent. Replying to a service enquiry may be necessary for a contract or pre-contractual request (Article 6(1)(b)); handling other voluntary feedback and preventing duplicate or unwanted messages may rely on the shop's documented legitimate interests (Article 6(1)(f)). The shop must assess necessity, your expectations and your rights, and tell you the basis it actually uses. Optional feedback is not a condition of buying goods.

3. Delivery, measurement and opting out

Review invitations can be sent on behalf of the shop from bewertungen@mail.goodrepeats.com. The reply address is the shop's verified Shopify contact email; a shop may instead use its own configured sender domain. The shop remains responsible for the invitation. Delivery data, bounces, complaints and unsubscribes are processed to deliver mail and prevent further unwanted messages.

Open and click measurement are off by default. Where a shop enables them, an individual image URL may record an opening and an individual link may record a click, its time and destination against the invitation. These records can also affect reminders and delivery rules. Email security scanners may trigger events, so an event does not prove that a person read a message. Optional individual measurement requires a separate, valid prior permission where required; a merchant's setting is not your consent. Necessary link delivery and security processing are distinct from optional measurement.

You can stop review invitations from that shop using the unsubscribe link in the email or by contacting the shop. Withdrawing consent does not affect the lawfulness of earlier processing. Ask the shop to withdraw any separate measurement permission as well. A minimal suppression record can remain to honour your choice. Opening this privacy policy does not set cookies or use analytics, browser storage, external fonts or tracking images.

4. Information for merchants and contacts

Kailar processes shop identity, business/contact details, installation and authorisation records, settings, subscriptions and billing status to provide and administer Good Reviews. For a merchant who is a natural person, the basis is Article 6(1)(b) GDPR; for employees and representatives of a merchant, our legitimate interest in managing that business relationship under Article 6(1)(f). Shopify handles its own platform and payment activities under its applicable terms. Good Reviews receives subscription information, not your full payment-card details.

Support enquiries contain the contact details, messages and attachments you provide and the shop reference needed to help you. We process them to perform the contract or answer a pre-contractual request, or in our legitimate interest in resolving other enquiries. Please avoid sending unnecessary customer details. Authorised Kailar personnel can use our internal support tools to handle the enquiry. Security and administration involve technical request data such as IP address, time, requested resource, errors and administrative actions; our legitimate interests are preventing abuse, protecting accounts and maintaining the service. Legal obligations, including applicable record-keeping duties, use Article 6(1)(c).

Automated rules select sending times, reminders and configured destinations. These operations can evaluate interactions and ratings, but Good Reviews does not use them to make decisions with legal or similarly significant effects on you within Article 22 GDPR. We do not sell customer feedback or use it for our own advertising profiles.

5. Optional text tools and review-profile connections

When a merchant requests assisted writing or translation, template text, form labels, instructions and languages are sent to the configured text provider. Customer/order rows are not automatically fetched for this purpose, but personal information typed into those texts is not automatically removed. Use placeholders and do not submit personal or confidential customer information to these tools.

The text provider in production is the Google Gemini API, operated by Google. No other AI provider is connected. The permitted use is translating and drafting merchant text and templates without personal data; customer names, email addresses and review contents are not sent. Google handles these requests under its own Gemini API terms, and processing may take place outside the EU. Google is therefore not a subprocessor for customer personal data under our DPA, and these tools must not be used for such data. Using another provider or sending personal data would require a new notice under the DPA first.

If a merchant connects a Google business profile, we process authorisation tokens, profile/location identifiers and aggregate review information to display that profile's results. Trustpilot profile information can also be used for aggregate reporting. This connection differs from a customer choosing to visit a public review service.

6. Providers and international access

Hosting is with Hetzner Online GmbH in Germany. Coolify is used to manage the deployment; use of that software alone does not mean customer data are sent to a separate Coolify cloud service. Mail is delivered through Amazon Web Services SES in the Frankfurt region (eu-central-1), with delivery-status processing. Email travels to the recipient's mail provider, which may operate in another country. Shopify and the review services you or the shop use have their own roles and privacy terms.

The AWS contracting entity for this account is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg; the AWS GDPR Data Processing Addendum, including standard contractual clauses for any transfer outside the EEA, forms part of the AWS Service Terms. Our support and privacy mailbox kontakt@kailar.de is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany; it receives whatever you send us by email. Backups are kept by the application on the Hetzner server and by Hetzner's own server backup; no further backup provider has access. The current list is on our subprocessors page. Contact us for the current provider documentation. The data processing agreement sets out the conditions for authorised processing and provider changes.

A German hosting location is not a guarantee against access from outside the EEA. Where such access is needed, a valid Chapter V GDPR mechanism must apply before the transfer: an applicable adequacy decision or appropriate safeguards, such as the European Commission's standard contractual clauses with a transfer assessment and necessary supplementary measures. We do not assert an unverified EU–US Data Privacy Framework certification. You may request information and a copy of applicable safeguards through our contact address, with other people's data and confidential information protected.

7. How long information is kept

Periods below describe the application rules; a valid earlier erasure request can shorten them. The shop chooses the period appropriate for its purpose. Cleanup normally runs at startup and hourly, so deletion is carried out at the next successful cleanup. Failed file deletion is retried.

• Orders, invitations, private feedback, related photos and captured test messages: 180 days by default, configurable by the shop from 7 to 365 days, measured from creation.
• Individual interaction events: at most 90 days or the shorter shop period. The invitation's first opening/click time may remain for the invitation's period.
• Feedback reply contents: at most 180 days or the shorter shop period. Delivery attempts and notification records: 180 days. Provider delivery events and webhook/order signals: 90 days.
• Working copies of customer data requests: 30 days. An export downloaded by a merchant has its own retention under that merchant's control.
• Unsubscribe and delivery blocks: while needed to prevent unwanted sending, subject to review and erasure rules. These records do not follow the ordinary invitation expiry automatically.
• Pseudonymous erasure and duplicate-send checks in the application: 365 days from their recording or renewal. A separate recovery-protection record is supported by the software but is not active in production. If it is ever enabled, it keeps only keyed digests, not readable contact details, and it will first receive a removal rule tied to the backup periods below.
• Translation caches: 30 days. AI usage metadata (shop, time, provider/model and token counts, not the submitted text): 744 days, checked when the module starts or usage is recorded.
• Support tickets: normally 365 days after resolution or 730 days without an update. Administrative audit records: normally 730 days. Different documented periods may be needed for a specific dispute or security matter; these application settings are configurable and are not a universal legal retention period.

Uninstallation stops the shop's installation and triggers removal from the active app database after two days at a successful cleanup; verified shop-erasure requests can act sooner. Request a complete return of data before uninstalling, because the automated removal starts then. The DPA preserves the merchant's legal right to return or deletion. Account, legal-acceptance and business records needed for legal obligations or specific claims are separated by purpose and retained only for the applicable duty or claim period. Billing is handled through Shopify; statutory record periods depend on the document category, not on the customer-feedback setting.

Backups: the application makes an encrypted database backup every day and deletes each backup automatically after 35 days; restoring one needs a separately held key. Hetzner's server backup keeps at most seven daily copies of the server and overwrites the oldest. A one-time encrypted archive made during the security migration on 26 September 2026 is held on the protected server only and will be deleted by 31 October 2026. The application writes no request or customer-content logs; its technical container log is limited by size and removed when the application is redeployed. This notice does not claim that uninstalling immediately removes every copy. Copies awaiting deletion must be restricted to recovery or a specific lawful retention purpose; restored data must be reconciled with erasure instructions before reuse. Ask kontakt@kailar.de about the status of a particular erasure or copy.

8. Browser storage and connections

In the merchant interface, Shopify session tokens authorise access. The optional Google connection sets a security cookie named gr_review_oauth for ten minutes. Local browser storage remembers the selected language and keeps mail-editor recovery drafts and duplicate-send attempt references; drafts and attempt references are valid for seven days. Reply drafts use session storage. Language preferences have no fixed automatic expiry. Expiry checked on a later visit does not itself erase a file from a device that is never visited again; browser settings can clear it.

For cookies and similar storage, section 25(2) TDDDG exempts only access strictly necessary for a service you expressly request or for transmitting a communication. Optional storage or measurement outside that exemption requires prior consent; accepting the service terms is not that consent. Images configured by a merchant in its messages or review page may be retrieved from the image host, which receives your connection information. Your mail client can block remote images. Our public legal pages load no such external content.

9. Your rights and contact

Subject to the GDPR's conditions, you can request access, correction, erasure, restriction and data portability. You may object to processing based on legitimate interests on grounds relating to your situation, and object at any time to processing for direct marketing. You may withdraw consent at any time without affecting earlier lawful processing. Contact the shop for its customer processing; Kailar assists it and can forward your request. Contact Kailar for our own merchant, support or website processing. We may request proportionate identity information to prevent disclosure to the wrong person.

You can complain to a supervisory authority, particularly where you live, work or consider an infringement occurred. Kailar's local authority is the Landesbeauftragte für den Datenschutz Sachsen-Anhalt. You do not need to contact us first. The privacy contact above is available regardless of whether a statutory data protection officer is required.

We update this notice when the service or legal requirements change. The version is shown at the top; material changes affecting merchants will be communicated through the app or their contact address. Changes to contractual processing follow the DPA and are not approved merely by publishing a new notice.