Privacy Policy

Who we are

Attesta is based in New Zealand and provides customer feedback, review request, review management, and related business tools. This policy explains how Attesta handles personal information when you use our website, dashboard, public feedback pages, review request links, support channels, and related services.

Our role

For account, billing, website, support, and product analytics data, Attesta generally acts as the organisation deciding why and how that information is handled. For customer records, review requests, private feedback, and other information a business uploads or collects through Attesta, the business is usually responsible for deciding why that information is used, and Attesta processes it to provide the service.

Information we collect

• Account information, such as name, email address, login details, role, and business name.
• Business profile information, such as contact details, branding, Google review link, plan, and service settings.
• Customer information added by a business, such as customer name, email address, phone number where provided, message history, opt-out status, and feedback history.
• Review and feedback information, including ratings, comments, public Google reviews, private feedback, AI classifications, reply drafts, recovery notes, and timestamps.
• Billing information handled through our billing provider, such as subscription status, plan, invoices, usage, payment status, and billing contact details.
• Technical and usage information, such as IP address, browser, device, pages visited, feature usage, logs, errors, security events, and cookie or similar technology identifiers.
• Support information, such as messages you send us, attachments, diagnostic details, and follow-up notes.

How we collect information

We collect information directly from account users, from businesses that add customer details to Attesta, from customers who use public review request or feedback pages, from connected services such as Google where enabled, and automatically when people use our website or app.

How we use information

• Provide, operate, secure, and improve Attesta.
• Create accounts, authenticate users, provide dashboards, and manage business settings.
• Send review requests, reminders, support messages, transactional emails, and service notices.
• Capture, store, classify, and display customer reviews and private feedback.
• Generate AI reply drafts, feedback classifications, and insights where a plan or setting enables those features.
• Process subscriptions, invoices, usage limits, billing support, and payment status.
• Detect, prevent, investigate, and respond to fraud, abuse, spam, security issues, and policy violations.
• Comply with legal obligations, enforce our terms, and respond to lawful requests.

Legal bases and lawful grounds

Where laws such as the UK GDPR require a legal basis, we rely on one or more of the following: performing our contract with you, our legitimate interests in providing and improving a secure business service, consent where required, compliance with legal obligations, and protection of rights, safety, and security. Businesses using Attesta are responsible for having their own lawful basis, consent, permission, or other valid authority for customer information they upload or use through the service.

Customer data, messaging, and consent

Businesses must only add or contact customers where they have a lawful reason to do so. Depending on the recipient and country, this may require express consent, inferred consent, an existing customer relationship, a soft opt-in, or another lawful basis. Attesta includes unsubscribe or opt-out mechanisms in review request messages and records opt-outs so future messages can be suppressed. Businesses remain responsible for the contacts they import, the message content they approve, and the timing and purpose of communications sent through their account.

AI features

Some Attesta features may use AI providers to classify feedback, summarise trends, or draft suggested replies. AI output is provided as a draft or assistance only. Account users are responsible for reviewing AI output before using it. We do not use customer feedback to knowingly create fake reviews or impersonate customers.

Sharing information

We do not sell personal information. We may share information with service providers that help us run Attesta, including hosting, authentication, email delivery, billing, analytics, logging, customer support, AI processing, and Google integrations. We may also share information where required by law, to protect rights and security, during a business transfer, or with your direction or consent.

International transfers

We are based in New Zealand, but our providers and users may be in New Zealand, Australia, the United Kingdom, the United States, and other countries. This means personal information may be processed or stored outside the country where it was collected. Where required, we use reasonable contractual, technical, and organisational safeguards for those transfers.

Security and retention

We use reasonable technical and organisational measures designed to protect personal information against loss, misuse, unauthorised access, disclosure, alteration, and destruction. No online service can guarantee absolute security. We keep personal information for as long as needed to provide Attesta, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and support legitimate business records. If an account is deleted, some information may remain in backups, audit logs, financial records, or records we must keep for legal reasons.

When you submit feedback

When you submit feedback on a business's public Attesta form or respond through a review request link, we collect the information you choose to provide, such as your name, email address, experience rating, and comments. The business may use this information to create or update your customer record, follow up about your experience, manage review and service history, and improve its operations. Attesta processes this information on the business's behalf to provide hosting, storage, classification, and related service features. The business is usually responsible for deciding why that information is used; Attesta handles it to operate the platform.

Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, port, or complain about how personal information is handled. UK users may also have rights under the UK GDPR. Australian users may have rights under the Privacy Act and Australian Privacy Principles. New Zealand users may request access and correction under the Privacy Act 2020. US state privacy laws may provide additional rights, such as access, deletion, correction, or opt-out rights. To make a request, contact us at support@attesta.co.nz.

Cookies and analytics

We may use cookies, local storage, and similar technologies for authentication, security, preferences, analytics, and product improvement. You can control cookies through your browser settings, but some features may not work properly without necessary cookies.

Children

Attesta is a business service and is not intended for children. Do not use Attesta to knowingly collect personal information from children unless you have all permissions required by applicable law.

Complaints and contact

If you have a privacy question, request, or complaint, email support@attesta.co.nz. We will respond within a reasonable time. If you are not satisfied, you may be able to complain to your local privacy or data protection regulator.