Privacy Policy

1. Who is responsible

• For the accounts of business owners and their team, and for this website, RateTeam is the controller.
• For employee data and ratings processed on behalf of a business, the business is the controller and RateTeam acts as its processor. Requests about that data should first be addressed to the business.

2. Data we process

• Account data: email address, password (stored only as a secure hash by our authentication provider), your name and, optionally, a phone or WhatsApp number. We use the phone only for support and billing of your account, never for marketing without your consent. If you sign in with Google, we also receive your name and profile picture.
• Business data: business name, industry, country, time zone, locations and settings.
• Employee data entered by the business: name, display name, role, photo and, optionally, email for their personal view.
• Ratings: stars, selected aspects, optional comment, language and time. Customers are not asked for their name, email or phone.
• Anti-fraud signals: a salted hash of a random browser identifier and of the IP address. We do not store the IP address itself.
• Technical data: security and error logs from our hosting providers.

3. Purposes and legal bases

• Providing the Service under our contract with the business.
• Preventing fraud and abuse, based on legitimate interest.
• Sending service emails (sign-in links, alerts, weekly summaries), which each user can turn off in their settings where applicable.
• Complying with legal obligations.

We do not sell personal data or use it for advertising.

4. Retention

• Rating comments and anti-fraud signals are removed according to each business’s retention setting (730 days by default).
• Anti-fraud hashes are removed after 30 days at the latest.
• Account data is kept while the account is active and deleted on request or after closure, unless the law requires otherwise.

5. Service providers

We rely on providers that process data on our behalf:

• Supabase (database, authentication and file storage) — region data region.
• Vercel (website and application hosting).
• Resend (transactional email).
• Cloudflare Turnstile (bot protection, when enabled).
• Google (only if you choose to sign in with Google).

Some providers may process data outside your country, under appropriate safeguards such as standard contractual clauses.

6. Your rights

Depending on your jurisdiction, you may have the right to access, rectify, delete, object to or restrict the processing of your data, and to data portability. Write to privacy email. In Argentina, the supervisory authority is the Agencia de Acceso a la Información Pública (AAIP); in the EU, your local data protection authority.

7. Information for employees

Businesses must inform their employees before using RateTeam. Employees can see their own ratings and statistics, but never anti-fraud details or other people’s data. The goal of RateTeam is recognition and improvement, not surveillance.

8. Security

Each business’s data is isolated at the database level, access is restricted by role and connections are encrypted. No system is completely secure; we will notify incidents as required by law.

9. Children

The Service is intended for businesses and is not directed at children under 16.

10. Changes and contact

We will publish updates on this page and notify material changes. Contact: privacy email · registered address.