How we handle your data when we email you.

Who we are

BeyondReviews is operated from Italy by Simon Folmann and Luca Versiglia, at Località Carlotta 3, 24031 Almenno San Salvatore BG, Italy. The two of them are joint controllers for the data described here. Write to [email protected] about anything on this page. We answer within 7 days, usually much faster.

Why you got an email from us

We make a reviews app for Shopify stores. We wrote to you because your business publishes the address we used, on its own website or, for agencies and developers, in its Shopify Partner Directory profile, and because what we sell is relevant to running an online store.

What we hold about you

• Your business email address, and the page where it is published.
• Your store or business name, website address and country.
• For stores: one of your public product pages, and what our scan of it found (for example, whether your reviews are in the page a search engine reads). For agencies: how many of the client stores in your public profile we scanned, and how many had that finding. We never name those stores to anyone.
• Where your website names its founder or owner, that first name, so we can greet you properly.
• Whether you replied, and anything you told us.
• A score our software gives your store, used only to decide who we write to first (see below).
• Whether your address passed our mailbox check, and when.

Where it came from

Only from public sources: your own website, your public Shopify storefront data, and, for agencies, the Shopify Partner Directory. We record the page and the date for each address, so we can always tell you exactly where we found yours.

If you press "Show my reviews"

Your page from our email has a button that shows your reviews in our widget. We read nothing until you press it. Then we read your store's public reviews, at most 12, from your store and its review app, and show them only in your browser. We keep nothing: the reviews are not saved, cached or logged, and they are gone when you close the page. The only thing we count is how many times your internet address pressed the button in the last hour, so the button cannot be misused.

What we count on these pages

We count how many times each part of these pages is used, per page and kind of store, with nothing that identifies you or your store: for example, how often a page was opened or the "Show my reviews" button was pressed. We keep only those daily totals, for 90 days. No cookie, internet address, store name or ID is sent or kept, and if your browser asks sites not to track you (Do Not Track or Global Privacy Control), nothing is counted.

Why we may use it

Our legal basis is legitimate interests (GDPR Art. 6(1)(f)): telling a business about a product relevant to it, using only business contact details it has published, in a few plain emails that always let you stop. The scoring, the mailbox check and the drafted answers serve the same interest. You can object at any time, and we will stop at once. If you join our list, the basis for the emails we then send is your consent (GDPR Art. 6(1)(a)).

What a computer does, and what a person does

Some steps are done by software. None of them has a legal effect on you or affects you in a similarly important way: the most they decide is whether, when and how we email your business. So they are not the kind of automated decision the GDPR's Article 22 is about. We still want you to know what they are:

• Who we write to first. Software gives each store a score from the public facts above (for example, what our scan found and what kind of store it is), and we email the highest scores first. The score only sets the order and whether we write at all.
• A mailbox check. Before our first email, a checking service tests whether your published address can receive mail, so we do not write to addresses that bounce.
• Answers to your replies. When you write back, Claude, an AI made by Anthropic, reads your message and drafts an answer. A short, plain answer that passes our checks (for example, a yes to joining our list) can be sent by itself after a 10-minute hold. Simon is sent a copy of each one first and can stop it. Anything angry, legal, unclear or new waits for Simon.
• Stopping. If you reply "stop" or unsubscribe, software adds you to our do-not-contact list straight away.

Asking for a person, or saying no

You can object to any of this at any time, and objecting to marketing email, or to the scoring we use for it, always works (GDPR Article 21(2) and 21(3)). Reply "stop" to any of our emails, or write to [email protected], and we stop writing to you and stop scoring your business.

If you would rather a person dealt with you, say so in any reply, for example "a person, please". Simon then reads your messages and writes back himself, and nothing is sent to you automatically.

If you join our list

If you join our list from one of our pages, or say yes in a reply, your email address, store and the consent you gave go to Loops, the email service that sends our company emails (the welcome, short news and the note when we open). Loops shows us whether those emails are opened and their links clicked, as the consent says. You can unsubscribe in one click in any of them.

Who else sees it

Only the companies that help us do the work above, acting on our instructions and bound to keep it confidential: Google Workspace (our email for simon@ and hello@), Loops (company emails to people on our list), Brevo (single emails such as a scan readout, and notes to us when someone joins), Cloudflare (our website hosting and the pages linked from our emails), Anthropic (Claude, which drafts our answers to your replies), and the companies that send our emails and check mailboxes before the first email.

Some of them are outside the European Economic Area or the UK. Where that is so, we rely on the safeguards the GDPR and UK GDPR provide, such as an adequacy decision (including the EU-U.S. Data Privacy Framework where the company is certified) or the standard contractual clauses. We never sell or rent your details.

How long we keep it

Up to 12 months after our last email to you, then it is deleted. If you ask us to stop, we keep only your address on a do-not-contact list, for as long as we send email, so that we never write to you again.

Your rights

You can ask to see what we hold about you, to correct it, to delete it, to restrict how we use it, or to have a copy, and you can object to its use at any time. If you joined our list, you can take back your consent at any time; that does not make what we did before unlawful. Objecting to marketing email always works: reply "stop" to any of our emails, or write to [email protected].

If you are in the EU/EEA and believe we have not handled your data lawfully, you can complain to the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it) or to the supervisory authority where you live or work. In the UK, you can complain to the Information Commissioner's Office (ico.org.uk). Elsewhere, your own data protection authority can help too.

Some steps are automated, as explained above under "What a computer does, and what a person does". None of them has a legal or similarly significant effect on you, and you can always ask for a person instead.