01Who We Are
INFUSION AI, trading as Strong Reviews ("Strong Reviews", "we", "us", "our"), operates the "StrongReviews" Google Review Automation system that helps businesses collect, manage, and respond to customer reviews.
For the purposes of UK data protection law, INFUSION AI (trading as Strong Reviews) is the data controller for the personal data of visitors to our website and users of our platform.
Email: hello@infusion-ai.net
Address: 43 Garrard Avenue, Margate, Kent, CT9 5PY, United Kingdom
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at the email address above.
02What This Policy Covers
This Privacy Policy explains how we collect, use, store, and share personal data when you:
- Visit our website (strongreviews.co.uk)
- Sign up for and use our "StrongReviews" Google Review Automation system
- Contact us for support or sales enquiries
- Receive or respond to review requests sent via our platform (end customers of our business clients)
03The Personal Data We Collect
3.1 Platform Users (Business Customers & Their Teams)
When you register for and use the Strong Reviews platform, we collect:
- Account information: Full name, business email address, job title, company name
- Billing information: Billing address, VAT number (payment card details are handled directly by Stripe — we do not store card numbers)
- Usage data: Login timestamps, feature usage, settings, and preferences
- Communications: Support tickets and emails you send to us
- Technical data: IP address, browser type, device identifiers, and session data
3.2 End Customers (Recipients of Review Requests)
When our business customers use Strong Reviews to request reviews from their own customers, we process on their behalf:
- Contact details: Name, mobile number, and/or WhatsApp-registered number
- Review content: Any review text or ratings submitted or pulled in from Google
- Interaction data: Whether a review request was delivered, opened, clicked, or actioned
- AI-generated content: AI-drafted reply suggestions generated from the review text (see Section 4)
- Metadata: Timestamps and the business that sent the request
3.3 Website Visitors
When you visit our website, we automatically collect:
- IP address and approximate location
- Browser and device information
- Pages visited, time spent, and referral source
- Cookie data (see Section 9)
04How We Use Your Personal Data
We process personal data for the following purposes and rely on the legal bases set out below:
| Purpose | Legal Basis |
|---|---|
| Providing and managing your platform account | Performance of a contract (Art. 6(1)(b) UK GDPR) |
| Processing payments and managing subscriptions via Stripe | Performance of a contract (Art. 6(1)(b) UK GDPR) |
| Sending platform-related communications (e.g. receipts, system alerts) | Performance of a contract (Art. 6(1)(b) UK GDPR) |
| Sending review requests via SMS and WhatsApp on behalf of business customers | Legitimate interests of the business customer (Art. 6(1)(f) UK GDPR) |
| Importing reviews from Google on behalf of business customers | Legitimate interests of the business customer (Art. 6(1)(f) UK GDPR) |
| Using AI to analyse review wording and generate draft replies | Legitimate interests (Art. 6(1)(f) UK GDPR) |
| Improving our platform and fixing bugs | Legitimate interests (Art. 6(1)(f) UK GDPR) |
| Sending marketing communications to existing customers | Legitimate interests (Art. 6(1)(f) UK GDPR) |
| Sending marketing to new prospects | Consent (Art. 6(1)(a) UK GDPR) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c) UK GDPR) |
| Preventing fraud and maintaining platform security | Legitimate interests (Art. 6(1)(f) UK GDPR) |
4.1 AI-Assisted Reply Generation
Our platform uses artificial intelligence to analyse the content of customer reviews and generate suggested reply text for our business customers. This processing:
- Is applied to review text only — not to personal identifiers such as names or contact details where avoidable
- Produces a suggestion only — all replies are reviewed and sent by a human (the business customer)
- Does not make any automated decisions that produce legal or similarly significant effects on end customers
05Data Processor Responsibilities
Where our business customers use Strong Reviews to manage review requests sent to their own customers, our business customers are the data controllers for those end-customer records. Strong Reviews acts as a data processor on their behalf.
In that capacity, we process end-customer data only on the documented instructions of our business customers, as set out in our Data Processing Agreement (available on request and incorporated into our Terms of Service).
06Who We Share Your Data With
We do not sell personal data. We share data only with the following categories of sub-processor, each bound by a data processing agreement:
| Sub-processor | Purpose | Data Location |
|---|---|---|
| Stripe | Subscription billing and payment processing | USA (IDTA safeguards in place) |
| Vercel | Application hosting and delivery | USA (IDTA safeguards in place) |
| Supabase | Database and data storage | West Europe (London) |
| Twilio | SMS message delivery | USA (IDTA safeguards in place) |
| ClickSend | SMS and WhatsApp message delivery | Australia (IDTA safeguards in place) |
| Review data import via Google My Business API | USA (IDTA safeguards in place) |
We may also share data with legal or regulatory authorities where required by law or to protect our rights.
07International Data Transfers
Our primary database is hosted in London (West Europe) via Supabase. However, several of our sub-processors are based outside the UK (see Section 6).
Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including:
- The UK's International Data Transfer Agreement (IDTA)
- Adequacy decisions issued by the UK Secretary of State
- Standard contractual clauses approved for use under UK law
You can request details of the specific safeguards in place for any transfer by contacting us at hello@infusion-ai.net.
08How Long We Keep Your Data
| Data Type | Retention Period |
|---|---|
| Platform account data | Duration of the contract + 3 years |
| Review data (processed on behalf of customers) | Duration of the customer contract |
| Billing records | 7 years (legal requirement) |
| Support communications | 3 years |
| Marketing enquiries | 2 years from last interaction |
| Website analytics | 26 months |
| Cookies | See Section 9 |
When data is no longer required, we securely delete or anonymise it.
09Cookies
Our website uses cookies and similar tracking technologies. These include:
- Strictly necessary cookies: Required for the website and platform to function (no consent required)
- Analytics cookies: Help us understand how visitors use our site (require consent)
- Marketing cookies: Used to show relevant advertising (require consent)
You can manage your cookie preferences via our cookie banner or by adjusting your browser settings. Note that disabling certain cookies may affect platform functionality. For a full list of cookies we use, see our Cookie Policy.
10Your Rights Under UK GDPR
You have the following rights regarding your personal data:
- Right of access: Request a copy of the personal data we hold about you
- Right to rectification: Ask us to correct inaccurate or incomplete data
- Right to erasure: Ask us to delete your data in certain circumstances
- Right to restriction: Ask us to limit how we process your data
- Right to data portability: Request your data in a structured, machine-readable format
- Right to object: Object to processing based on legitimate interests or for direct marketing
- Rights related to automated decision-making: Our AI reply generation does not constitute solely automated decision-making with legal or similarly significant effects
To exercise any of these rights, contact us at hello@infusion-ai.net. We will respond within one calendar month.
End customers: If you received a review request from one of our business customers and wish to exercise your data rights, please contact that business directly — they are the data controller for your personal data. We can assist them in fulfilling your request.
11Data Protection Complaints
If you wish to raise a complaint about how we have handled your personal data, please contact us at hello@infusion-ai.net with the subject line "Data Protection Complaint".
In accordance with the Data (Use and Access) Act 2025, we will:
- Acknowledge your complaint within 30 days of receipt
- Investigate your complaint without undue delay and keep you informed of progress
- Notify you of the outcome once our investigation is complete
We take all data protection complaints seriously and will work to resolve them fairly and promptly.
12The Right to Complain to the ICO
If you are unhappy with how we have handled your personal data or your complaint, you have the right to lodge a complaint with the UK's supervisory authority:
We would appreciate the opportunity to address your concerns before you contact the ICO — please raise a complaint with us first using the process in Section 11.
13Security
We take data security seriously and implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:
- Encryption in transit (TLS) and at rest
- Role-based access controls
- Secure hosting within Supabase (London data centre)
- Regular security assessments
No method of transmission over the internet is completely secure. If you believe your data has been compromised, please contact us immediately at hello@infusion-ai.net.
14Children's Data
Our platform is intended for business use only. It is not directed at individuals under the age of 16, and we do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us so we can delete it promptly.
15Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top and, where changes are material, notify you by email or in-platform notification.
Your continued use of our platform following any update constitutes acceptance of the revised policy.
16Contact Us
For any questions, requests, or concerns regarding this Privacy Policy or your personal data:
Email: hello@infusion-ai.net
Address: 43 Garrard Avenue, Margate, Kent, CT9 5PY, United Kingdom
As Oscar Wilde might have observed: "The truth is rarely pure and never simple" — which is exactly why you need a Privacy Policy that says what it means.