Privacy Policy

Your privacy is important to us. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have. By using SRS Tool, you agree to the practices described in this policy.

SRS Tool (Simple Review Service Management Tool) is operated from Toronto, Ontario, Canada. We are the data controller for information you provide when creating an account and using our platform.

Contact: support@srstool.com · +1-437-837-8887 · Toronto, Ontario, Canada

Account Information: When you sign up, we collect your email address and (optionally) your name. This is required to create and manage your account.

Business Information: You may provide your business name, logo, Google Review URL, and other business details to configure your QR review page.

Customer Feedback Data: When your customers submit private feedback through your QR link, we collect: their name (optional), email address (optional), feedback category, and message text. This data is stored on your behalf and displayed in your dashboard.

Payment Information: Payments are processed by Stripe. We do not store your credit card number or full payment details. Stripe may collect billing name, address, and card details in accordance with their own privacy policy.

Usage & Analytics Data: We collect data about how you use our platform, including pages visited, features used, QR link click counts, and general interaction patterns. This helps us improve the product.

Technical Data: We may collect IP address, browser type, device type, and operating system for security and diagnostic purposes.

• To create, maintain, and manage your account
• To provide the core service — generating QR codes, delivering feedback to your dashboard, tracking analytics
• To send transactional emails such as account confirmation, subscription billing, trial reminders, and feedback alerts
• To process payments through Stripe
• To respond to your support requests
• To improve, debug, and develop the platform
• To comply with legal obligations

We do not use your data or your customers' data for advertising. We do not sell data to third parties.

We only share data with trusted third-party services necessary to operate SRS Tool:

• Supabase — our database and authentication provider. Your account and feedback data is stored securely on Supabase infrastructure.
• Stripe — payment processing. Stripe handles all billing data under their own PCI-compliant privacy policy.
• Resend — transactional email delivery. Email content necessary for account operations is processed through Resend.
• Vercel — hosting and deployment infrastructure.

We may disclose data if required by law, court order, or government authority. We will notify you when legally permitted to do so.

When your customers submit feedback through your QR link, they are voluntarily providing their information to you (the business owner) via our platform. As the business owner, you are the data controller for that feedback. We act as a data processor on your behalf.

You are responsible for:

• Ensuring customers are aware their feedback may be collected
• Using customer feedback only for legitimate business improvement purposes
• Complying with applicable privacy laws in your jurisdiction regarding customer data

We recommend making clear to customers — on your QR page or in signage — that their feedback will be seen by the business owner.

We retain your account data for as long as your account is active. If you cancel your account, we will retain your data for 30 days to allow for reactivation or data export, after which it will be deleted.

Customer feedback data is retained until you delete it from your dashboard or until your account is permanently closed.

Billing records may be retained for up to 7 years to comply with Canadian tax and accounting regulations.

Under Canadian privacy law (PIPEDA) and, where applicable, GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct inaccurate or incomplete data
• Deletion — request that we delete your personal data, subject to legal retention requirements
• Portability — request an export of your data in a machine-readable format
• Withdraw Consent — opt out of non-essential communications at any time

To exercise any of these rights, contact us at support@srstool.com. We will respond within 30 days.

SRS Tool uses minimal cookies necessary for the platform to function:

• Authentication cookies — to keep you logged in (Supabase auth tokens)
• Session cookies — to maintain your session state

We do not use advertising cookies, tracking pixels, or sell cookie data to third parties.

We take data security seriously. Our measures include:

• All data transmitted over HTTPS/TLS encryption
• Database access protected by Row Level Security (RLS) policies
• Authentication managed by Supabase with secure token handling
• Payment data handled exclusively by PCI-compliant Stripe infrastructure

No system is 100% secure. In the event of a data breach affecting your personal information, we will notify you within 72 hours as required by applicable law.

SRS Tool is not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us at support@srstool.com and we will delete it promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the effective date at the top of this page. Continued use of SRS Tool after changes constitutes your acceptance of the updated policy.

For any privacy-related questions, data requests, or concerns: