This policy explains what L&AS VENTURES SINGLE MEMBER PRIVATE COMPANY ("we"), Nikitara 87, 16675 Voula, Greece, AFM 802718607, does with personal data in connection with Build my reviews.
1. Two different roles
When we are the controller. For the people who subscribe to and use the dashboard — Merchants, their team members, and visitors to buildmyreviews.app — we decide why and how data is processed.
When we are the processor. For a Merchant's own customers who use a Customer Page — the Customers — the Merchant is the controller and we act on their instructions. If you are a Customer and want your data corrected or deleted, you can ask us directly (see section 8) and we will act, and you may also contact the business whose QR code you scanned.
2. What we collect, and why
Merchants and dashboard users
| Data | Why | Legal basis |
|---|---|---|
| Name, e-mail, workspace and location details | To create and run your account | Performance of a contract |
| Sign-in tokens and session cookies | To keep you logged in securely | Performance of a contract |
| Billing details, VAT number, invoices | To sell you a subscription and meet accounting law | Contract and legal obligation |
| Support messages | To answer you | Legitimate interest |
| Product usage, error reports | To keep the Service working and improve it | Legitimate interest |
| Marketing e-mails about the product | To tell you about the Service | Consent, withdrawable in one click |
Payment card details never reach us. They are handled by Stripe Payments Europe, Limited, our payment processor. We are the seller of record and hold only the billing name, address, VAT number and invoice history needed to issue and keep your invoices.
Customers
| Data | Why | Legal basis (controller = the Merchant) |
|---|---|---|
| Name, e-mail, profile picture from Google sign-in, or e-mail alone | To create the customer account and send the prize | Performance of a contract with the Customer |
| Consents given, with timestamp and text version | To prove consent was given | Legal obligation |
| Spins, prizes won, prize codes, redemption status | To run the game and let staff validate a prize | Contract |
| Events: scan, sign-in, spin, review-link click, time away from the page, skip | To produce the Merchant's reports and prevent abuse | Legitimate interest of the Merchant |
| A one-way hash of device and network characteristics | To stop the same person spinning repeatedly | Legitimate interest of the Merchant |
| Optional private feedback and rating | To pass the Customer's message to the team | Consent |
| Marketing e-mails from the Merchant | To invite the Customer back | Consent, withdrawable in one click |
What we never do. We do not read, write or publish reviews on anyone's behalf. We cannot tell whether a Customer actually posted a review — no review platform provides that information — and we never ask a Customer for the text of a review or for proof that one was left. We do not sell personal data. We do not use Customer data to build profiles across different Merchants.
3. Google review counts
Once a day we ask the Google Places API for the public rating and review count of each Location, so the Merchant can see how their profile is changing. This is public information about a business, not personal data about any reviewer.
4. Cookies
The website uses a consent banner. Strictly necessary cookies (session, security, load balancing) are set without consent because the Service cannot work without them. Analytics is privacy-friendly and aggregated. Customer Pages set only the cookies needed to keep the Customer signed in and to remember that the wheel has been used.
5. Who else processes the data
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Application and website hosting, database, file storage, CDN, security | EU / global, SCCs |
| Stripe Payments Europe, Limited | Payment processing, card data, fraud prevention | Ireland (EU) |
| Brevo (Sendinblue SAS) | Transactional and marketing e-mail | France (EU) |
| Google Ireland Ltd | Sign-in, public place data | EU / US, SCCs |
Error monitoring (Sentry) and website analytics (Plausible) are part of the planned architecture but are not deployed today; they are listed at buildmyreviews.app/legal/subprocessors and this policy will be updated before either begins processing.
The current list is published at buildmyreviews.app/legal/subprocessors. We give 30 days' notice before adding a new one.
6. International transfers
Data is stored in the European Union wherever the provider offers it. Where a provider processes data outside the EEA we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses together with additional safeguards.
7. How long we keep it
| Data | Kept for |
|---|---|
| Merchant account | While the account exists, then 30 days |
| Invoices and accounting records | 5 years, as Greek law requires |
| Customer accounts and prizes | While the Merchant's workspace exists, or until deletion is requested |
| Event logs | 13 months |
| Private feedback | 24 months |
| Support messages | 24 months |
| Waitlist e-mail addresses | Until launch, or until you unsubscribe |
| Backups | 30 days, then overwritten |
8. Your rights
You can ask for access, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Where processing is based on consent you can withdraw it at any time without affecting what was done before. Write to support@buildmyreviews.app and we answer within 30 days. Merchants can export and delete Customer data themselves from the dashboard, and Customers can delete their own account and prizes from the account page linked in every e-mail we send them.
You can complain to the Hellenic Data Protection Authority (dpa.gr) or to the authority in your own country.
9. Security
Encryption in transit and at rest, sessions signed and short-lived, secrets held in a managed vault, least-privilege access, nightly backups with a rehearsed restore, error monitoring, and rate limiting on sign-in and gameplay. No system is perfectly secure; we will notify you and the competent authority of a breach within the timeframes the GDPR requires.
10. Children
The Service is not directed at children. Merchants must not run prize games aimed at minors. If you believe a child has created a Customer account, write to us and we will delete it.
11. Changes
We will post any update here and, if it is material, tell Merchants by e-mail before it takes effect.
Contact: support@buildmyreviews.app — L&AS Ventures, Nikitara 87, 16675 Voula, Greece.