Privacy Policy

This Privacy Policy explains how Tailwind Reviews LLC ("Tailwind", "we", "us") collects, uses, shares and deletes personal information when you use the Tailwind Reviews website (tailwind.reviews), web application, public business directory, AI-assistant integrations and related services (the "Service").

It covers three groups of people:

Customers — businesses and the people who hold a Tailwind account on their behalf;
End customers — people who interact with a Customer's business through Tailwind, for example by leaving feedback, sending an order or booking request, or submitting a review;
Visitors — anyone who browses our website, uses the directory through an AI assistant, or contacts us.

If you have questions, write to support@tailwind.reviews.

1. Who we are and our role

The Service is operated by Tailwind Reviews LLC.

We are the controller of account, billing and website data, of the public directory, of the consumer contact record described in §2.4, and of messages you send us directly.
When we process data for a Customer's business — its connected reviews and comments, the feedback, complaints, orders and booking requests its end customers send it, and the contact details it uploads — we act on that business's behalf as its processor (or "service provider"). The business decides how it uses that data, and end customers should also read the business's own privacy notice. We pass requests we receive about that data to the business where appropriate.

2. Information we collect

2.1 Account and billing information

Account: name, e-mail address, password (stored only as a hash) or the identifier of the sign-in provider you use (Google, Apple, Facebook or LinkedIn), language, time zone and last sign-in time.
Business information: company name, website, address, categories, logo, services, prices, opening hours and other details you enter or that we import from your website or connected profiles.
Billing: payments are handled by Stripe. We send Stripe your name, e-mail address and account id, and keep the Stripe customer id and subscription status. Card details are entered on Stripe's page; we do not receive or store card numbers.
Agreements and preferences: the version of the Terms and Privacy Policy you accepted, the time, IP address and browser user agent at acceptance, your marketing-email choice and your notification settings.

2.2 Connected platforms and integrations

When you connect a third-party account we receive only the data that platform returns under the permissions you approve. Details for Google and Meta are in §3 and §4; other integrations are described in §5.

2.3 Public reviews, mentions and websites

To show a Customer what is said about its business, we collect publicly available reviews and mentions from sources such as Google Maps, Yelp, Trustpilot, Tripadvisor, Reddit, Hacker News, YouTube and X. This can include the reviewer's public display name, profile link, rating, text, photos and date. We also crawl the Customer's own website to build its business profile and for SEO audits.

2.4 End customers

Depending on what a business enables, end customers may give us:

Feedback and review requests: a business may send you a feedback request using the name, e-mail address or phone number it gave us. On the feedback page you may leave a rating, text, photos and your e-mail address, and continue a conversation with the business about a complaint.
Review submissions: your rating, text, name and, optionally, e-mail address, held for the business to moderate.
Orders, booking and quote requests made on a business's public page or through an AI assistant: your name, the contact details you choose to give (phone and/or e-mail), the service requested, the requested time, address if needed, and your comments. We deliver the request to the selected business using the channel it chose (for example e-mail, its own booking or shop system, or a calendar or spreadsheet). A request is not a confirmed booking unless the business confirms it.
Consumer contact record: when you send an order or booking request, we keep a contact record with your e-mail address, phone number and name, and link it to each business you contact through Tailwind. We use it to deliver your requests and so that a business's authorized assistant connection can look up your previous order with that same business ("the same as last time"). A business cannot see your history with other businesses.
QR codes: when you scan a business's review QR code we record a pseudonymous visitor identifier, the referring page and your browser user agent.

2.5 Visitors who contact us

Help-center contact form: your name, e-mail address and message are e-mailed to our support team. They are not stored in our database.
Newsletter: your e-mail address, subscription status and, if you give one, your reason for unsubscribing.
"Add a company" suggestions: the business details you submit, your e-mail address if you give it, and your IP address, which we use to prevent abuse.
Data-deletion and privacy requests: the details you provide so we can verify and complete the request.

2.6 Public directory and AI-assistant lookups

Participating businesses choose and confirm what they publish in the Tailwind directory: business name, category, description, city, website, public contact details, opening hours, services, prices, options, FAQs, policies, and when this information was last checked or confirmed.

When you use Tailwind through ChatGPT or another Model Context Protocol (MCP) client, we receive what is needed to answer the request: search words, a city you type, a business identifier, the tool requested, protocol and session identifiers, origin and user-agent headers, timestamps and network metadata such as an IP address. Directory lookups are read-only and do not require a Tailwind account.

The "Get Quote" form in ChatGPT is switched off until it is approved by the platform. Where a quote or booking request is available, your details are sent to the selected business only after you confirm that you want to share them.

We show each participating business how many directory requests we served for it; these are counts, not the conversations themselves. Anonymized figures from a business are included in aggregate statistics only if that business agreed to it.

2.7 Device, log and usage data

Our servers record IP address, browser user agent, requested pages and error details. We also keep first-party product-usage events linked to a session identifier. On the website, analytics and marketing tools collect usage data only if you allow them (see §8).

3. Google user data

Tailwind's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We request the following Google permissions only when you choose the related feature:

Feature	Scope	What we access
Sign in with Google	`openid`, `email`, `profile`	Your e-mail address, whether it is verified, and your first and last name
Google Business Profile	`business.manage`	Your accounts and locations; business information (name, phone, website, address, coordinates, hours, categories, service area); reviews (rating, comment, reviewer display name, dates) and replies. We also publish replies to reviews on your behalf, but only replies you approve in Tailwind
Search Console	`webmasters.readonly`	Search performance data for your sites (read-only)
Google Analytics 4	`analytics.readonly`	Traffic reports for your properties (read-only)
Google Ads	`adwords`	Campaign and performance reports for your accounts
Google Drive	`drive.readonly`	Folders and images you select to illustrate generated content (read-only)

We use this data only to provide and improve the user-facing features you enabled. We do not sell Google user data, do not use it for advertising, and do not use it to train general-purpose AI models. Humans at Tailwind do not read it unless you ask us to (for example for support), it is needed for security or legal reasons, or it has been aggregated and anonymized. We transfer it only to the service providers listed in §7 that need it to run the Service.

You can revoke Tailwind's access at any time at https://myaccount.google.com/permissions or by disconnecting the integration in Tailwind. See §10 for deletion.

4. Meta platform data

Tailwind integrates with Facebook, Instagram and Threads through Meta's APIs for Customers who connect their own business assets. Our use of data received from Meta APIs adheres to the Meta Platform Terms and Developer Policies.

4.1 Data accessed

Facebook Login: Meta user id, name, e-mail address and profile picture (email, public_profile).
Facebook Pages (pages_show_list, pages_read_engagement, pages_read_user_content, pages_manage_engagement, pages_manage_metadata): Page id and name, the Page's posts, and comments on those posts, including commenters' names.
Instagram professional accounts (instagram_basic, instagram_manage_comments): account id, username, the account's media, and comments on that media.
Threads (threads_basic, threads_content_publish, threads_manage_replies, threads_read_replies, threads_keyword_search): profile id, username, the profile's posts and replies to them, and — when you turn it on — public Threads posts that match keywords you monitor.

4.2 What we do with it

Show comments, replies and mentions in your Tailwind dashboard and notify you about new ones.
Let you reply from inside Tailwind. We publish content through Meta's APIs only when you approve it.
Generate AI-assisted reply suggestions that you review before anything is published (see §6).

4.3 What we do not do

We do not sell, license or rent Meta data; do not use it for advertising or to build audiences; do not combine it with other data for marketing; and do not use it to train general-purpose AI models. We share it only with the service providers in §7 that need it to run the Service.

You can remove Tailwind in Facebook under Settings → Apps and Websites. Meta then notifies us through our data-deletion callback (see §10).

5. Other integrations

You can also connect other services, for example Shopify, WooCommerce, Wix, Square, Squarespace, BigCommerce, Webflow, WordPress, CRM tools such as HubSpot, Pipedrive, Salesforce or Zoho, LinkedIn and X. We access only what the connection's permissions allow and use it to provide the feature you connected. For Shopify we request read access to customers, orders and products and the ability to create discounts and storefront scripts.

6. AI processing

Some features use AI models from third-party providers:

Reply drafts, sentiment analysis, digests, content suggestions and website analysis use OpenAI. We send the relevant review or comment text (which may include the reviewer's name) or website content.
The in-app chat assistant uses Anthropic (Claude) and can read your company's data in Tailwind to answer your questions.
AI visibility checks send your business name and search questions to OpenAI, Anthropic, Google (Gemini), xAI (Grok), DeepSeek and Perplexity to see how AI assistants describe your business. We do not send end-customer contact details for these checks.

AI output is a draft: you decide what to publish. We do not use your data to train our own general-purpose models.

7. Sharing and service providers

We do not sell personal information. We share it only as follows:

Recipient	Purpose	Data
DigitalOcean	Hosting, databases, file storage (for example review photos) and backups	All Service data
Cloudflare	Network security and delivery for our API	Network traffic, IP address
Vercel	Hosting of our website	Website requests, IP address
Better Stack	Server logs and error monitoring	Log entries, which can include IP address, e-mail address and error details
Stripe	Payments and subscriptions	Name, e-mail address, account id, payment details you enter with Stripe
E-mail delivery provider (SMTP)	Sending e-mails	Recipient address and e-mail content
Twilio	Sending text messages that a business asks us to send	Phone number and message content
OpenAI, Anthropic, Google, xAI, DeepSeek, Perplexity	AI features (§6)	Content needed for the feature
Apify, Tripadvisor, Brave Search, Semrush	Collecting public reviews, mentions, search and SEO data	Business names, search terms, public content
Google Analytics, Google Tag Manager, Microsoft Clarity	Website analytics, only with your consent (§8)	Usage data, device data, IP address; Clarity records page interactions
Google Ads	Measuring ad conversions, only with your consent (§8)	Usage and conversion events, device data

We also share information:

with the business you choose, when you send it feedback, a complaint, a review, or an order, booking or quote request;
in the public directory, limited to what a participating business chose to publish;
with a Customer's authorized users, for data in that Customer's account;
with the operator of an AI assistant you use, for example OpenAI when you use Tailwind in ChatGPT; that operator processes your conversation under its own privacy policy;
when required by law, for example a court order;
in a corporate transaction such as a merger or acquisition, where the successor must protect the information as this Policy describes.

8. Cookies and similar technologies

Necessary cookies keep you signed in and the Service secure. They include the session cookie (up to 12 months), short-lived sign-in and redirect cookies, cookies the app reads to show the right screens (for example whether you are signed in or have a subscription), a language-preference cookie (NEXT_LOCALE), and tw_consent, which remembers for 12 months that you have seen our cookie notice. These cannot be switched off.
Analytics cookies — Google Analytics (via Google Tag Manager) and Microsoft Clarity — help us understand how the website is used. Clarity records page interactions such as clicks and scrolling.
Marketing cookies — Google Ads — measure whether our ads lead to sign-ups.

Analytics and marketing tools load when you visit the website. You can block or delete these cookies in your browser settings, and opt out of Google Analytics with Google's browser add-on (https://tools.google.com/dlpage/gaoptout).

9. E-mails and consent records

When you create an account you must accept the Terms of Service and this Privacy Policy. We record the version you accepted, the time, your IP address and your browser user agent.

We send service e-mails you need, such as sign-in codes, billing notices and the notifications and weekly reports you turn on. Marketing e-mails are sent only if you opt in, and you can opt out at any time. Our e-mails include a link to manage your e-mail preferences.

10. Retention and deletion

We keep personal information only as long as needed for the purposes in this Policy, unless the law requires longer. We do not currently run automatic deletion schedules except where noted below.

Onboarding drafts expire automatically after 24 hours.
Account deletion (Account → Settings → Delete Account) immediately anonymizes your name and e-mail address and removes your sign-in connections. Business data, connected-platform data, orders and billing records are not removed automatically: they are kept while needed for legal, accounting and dispute purposes and are deleted when you ask (see below).
Disconnecting an integration stops future imports. Data already imported stays until you ask us to delete it.
Company suggestions (e-mail and IP address) are kept while needed to prevent abuse and deleted on request.
Public directory listings stay published until the business unpublishes them, closes its account or asks us to remove them. We verify that the requester controls the business.
Logs, including MCP request logs, are kept only as long as reasonably needed to operate and secure the Service. We do not add MCP request contents or search words to the public directory.
Backups may keep deleted data until they are overwritten in the normal backup cycle. We do not restore deleted data except for disaster recovery, and it stays subject to your deletion request.

How to ask for deletion:

use the form at https://tailwind.reviews/data-deletion — you receive a reference code, and we complete verified requests within 30 days;
e-mail support@tailwind.reviews;
remove Tailwind in your Facebook settings — Meta notifies us and you can check progress at https://tailwind.reviews/data-deletion/status?code=...;
Shopify merchants: after you uninstall the app, Shopify notifies us and we remove the store connection; on Shopify's erasure requests we anonymize customer details in orders imported from the store.

We may ask you to confirm your identity first. Some records (for example invoices) may be kept where the law requires. End customers asking about data held for a business may also contact that business directly.

11. Security

We use reasonable technical and organizational safeguards, including encrypted connections, access controls, private file storage and monitoring. No online service can guarantee absolute security.

12. International transfers

We and our service providers may process information in the United States, the European Union and other countries. Where the law requires, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses.

13. Your rights

Depending on where you live (for example under the GDPR, the UK GDPR or US state laws such as the CCPA), you may have the right to access, correct, delete or export your data, to restrict or object to processing, and to withdraw consent at any time without affecting earlier processing. You can also complain to your local data-protection authority.

Our legal bases under the GDPR are: performing our contract with you; our legitimate interests in running, securing and improving the Service and in delivering requests to the businesses you contact; your consent (marketing e-mails); and legal obligations.

To exercise your rights, e-mail support@tailwind.reviews or use the data-deletion form. We respond within the time the law requires. We do not sell personal information. For marketing cookies that may count as "sharing" under California law, see the Do Not Sell or Share page.

14. Children

Tailwind is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.

15. Changes

We post changes at tailwind.reviews/privacy with a new version number and effective date. If a change materially affects how we use personal information, we will give additional notice, and we may ask account holders to accept the new version.

16. Contact

Tailwind Reviews LLC — Privacy support@tailwind.reviews

For Meta-related privacy questions, put Meta App ID 1470586621283504 in the subject line.