— GDPR-native by design
Last updated: November 2026. We collect the minimum we need, we host it in Europe, and you can object or ask us to erase your data at any time by writing to support@inflate.review.
OpenReviews is a customer-review infrastructure platform operated under the Inflate brand by INFLATE, a simplified joint-stock company with a sole shareholder (société par actions simplifiée unipersonnelle, SASU) with a share capital of €500, registered with the Nanterre Trade and Companies Register (RCS Nanterre) under number 945 119 048 (SIRET 945 119 048 00011), with its registered office at 99 avenue Achille Peretti, 92200 Neuilly-sur-Seine, France ("OpenReviews", "Inflate", "we", "us", "our").
Our platform helps online merchants collect, unify, and display product reviews, and answer shopper questions through an AI assistant. It has three components: Inflate collects reviews from a merchant's own customers through email, SMS, WhatsApp, and QR codes; OpenReviews retrieves and syndicates existing public reviews from external review sources — in particular marketplaces, retailers, and brands — and unifies them by product identifier (EAN/GTIN); and Augur is an AI assistant that answers shopper questions on product pages using verified reviews as its source.
This Privacy Policy explains how we handle personal data. It is addressed both to our business customers (merchants, retailers, marketplaces, and brands — "Merchants") and to the consumers whose reviews we process ("Consumers", "you").
OpenReviews acts as a trusted third party engaged at the request of Merchants to collect, unify, and display product reviews on their behalf. In that capacity, we process personal data on the instructions of the Merchant and apply safeguards designed to keep reviews authentic, verified, and reliable.
Depending on the activity, we act in two capacities under the EU General Data Protection Regulation (GDPR). As a processor (sub-processor), when we collect, syndicate, translate, classify, store, and display reviews on behalf of a Merchant, the Merchant is the data controller and our processing is governed by a data processing agreement (DPA). As a controller, when we operate our own website (openreviews.io), manage Merchant accounts, handle our commercial relationships, run our marketing, and administer our internal operations, we determine the purposes and means ourselves.
If you are a Consumer, you may object to the processing of your personal content (such as a review or the associated author identity) and exercise your other rights at any time. The Merchant on whose behalf we processed your data is generally your first point of contact, but you can also contact us directly at support@inflate.review, and we will handle your request or forward it to the relevant Merchant.
Depending on the service and your relationship with us, we may process: the identity of review authors (name or pseudonym, and where applicable an email address); contact details (email address and phone number used to solicit and collect reviews via email, SMS, or WhatsApp on behalf of a Merchant); review content (the text of your review, star rating, any photos or videos, the product concerned, and related information such as purchase or publication date); syndicated review data (publicly available reviews and associated author display names retrieved from external review sources — in particular marketplaces, retailers, and brands — and matched to products by EAN/GTIN); Merchant account and business-contact data (names, professional email addresses, job titles, and account credentials of Merchant staff); contact details of people who book a call with us (name, company, email address, phone number if provided, chosen time slot); and limited technical and usage data generated when you interact with our website, the review widget, or Augur.
We do not intentionally collect special categories of data (such as health, religious, or political data). Please do not include such information in reviews.
We obtain personal data directly from Consumers when they submit a review or respond to a collection request; from Merchants who provide their customers' contact details so we can solicit reviews on their behalf; and from external review sources with which we work to retrieve and syndicate existing public reviews — in particular marketplaces, retailers, and brands. People who book a call with us enter their own details in our online calendar.
We process personal data for the following purposes and legal bases under the GDPR. Collecting reviews (sending review invitations by email, SMS, WhatsApp, or QR code) — on the basis of consent and/or the legitimate interests of the Merchant to gather feedback about products purchased. Publishing and syndicating reviews — on the basis of consent and/or the legitimate interests of the Merchant and OpenReviews to provide accurate, comprehensive product information to shoppers. Classifying and moderating reviews — on the basis of legitimate interests in providing a reliable and relevant service. Operating the Augur AI assistant — on the basis of the legitimate interests of the Merchant and OpenReviews in helping shoppers, and/or the Merchant's contract with us. Managing Merchant accounts and our commercial relationship — on the basis of the performance of a contract and our legitimate interests. Arranging calls and following up on enquiries (online booking and the exchanges that follow) — on the basis of pre-contractual steps taken at your request and our legitimate interest in responding to businesses that contact us. Audience measurement (Google Analytics, Microsoft Clarity) and measuring the effectiveness of our ads (Meta pixel), see section 10 — on the basis of your consent, collected purpose by purpose through our cookie banner. Security, fraud prevention, and legal compliance — on the basis of our legitimate interests and our legal obligations.
Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of prior processing. Where we rely on legitimate interests, you have the right to object.
Augur and our review-processing features (such as review summaries, automatic translation and the classification of product feedback versus shipping or service complaints) are powered by Google's Gemini AI models, which we access through the Google Cloud (Vertex AI) service. Google acts as our processor for this purpose. Depending on the task, we send these models the content of reviews (text and rating), the questions asked to Augur, information about the product concerned, or the first rows of a review file imported by a Merchant, so that its columns can be recognised. This processing may take place outside the European Union (see section 9). Augur is designed to answer strictly from verified review content, with safeguards intended to prevent fabricated ("hallucinated") answers.
We do not sell your personal data. We share personal data only as necessary and with appropriate safeguards: with Merchants, to whom reviews and related data are displayed and accessible; with service providers (sub-processors), namely a cloud hosting provider located in the European Union that stores and processes data under contractual data-protection terms, Google (Google Cloud), which provides the AI models described in section 6, Grafana Labs, which stores our technical logs and service metrics, and NeetoCal (Neeto LLC), the booking tool embedded in our website, which receives the information entered when you book a call; with Google, Microsoft and Meta, only if you accept audience measurement or ad measurement, as described in section 10; for legal reasons, where required by law, court order, or a competent authority, or to protect our rights and the security of our service; and in a corporate transaction, such as a merger, acquisition, or asset sale, subject to this Policy.
When a Consumer submits a review through our platform, or when a review enters the OpenReviews network, the author grants OpenReviews a non-exclusive licence to host, store, reproduce, translate, and distribute that review across the OpenReviews network. This licence allows the same review to appear not only on the product page where it was originally submitted, but also on the pages of identical products (matched by EAN/GTIN) offered by other Merchants and partners within the network.
We reserve the right to redistribute reviews to other network partners that sell the same product, provided that we always do so without altering the content of the review and without misrepresenting its origin or authorship. A review is always displayed as authentic, verified feedback, and both its meaning and its source are preserved.
In practice, a single review of a product may be shown across several identical product listings within the network, increasing its reach while remaining faithful to what you wrote. This distribution is limited to the review content and the associated author display name; it does not include your contact details (such as email or phone number), which are never shared for this purpose. You can object to this distribution, or request the removal of your review, at any time by contacting us at support@inflate.review.
We host personal data within the European Union. Some of our service providers may, however, process it outside the EU/EEA, in the following cases.
Artificial intelligence. The data sent to the Gemini models (section 6) goes through Google Cloud's global service, which may process it outside the EU/EEA, including in the United States. This transfer is covered by the European Commission's Standard Contractual Clauses, set out in Google Cloud's data processing terms, and Google LLC participates in the EU-U.S. Data Privacy Framework.
Technical logs. Our technical logs and service metrics are stored by Grafana Labs in the United Kingdom, which benefits from an adequacy decision of the European Commission.
Audience and ad measurement. If you accept them (section 10), the data sent to Google (Google Tag Manager, Google Analytics), to Microsoft (Microsoft Clarity) and to Meta (Meta pixel) may be transferred to the United States by these companies, which participate in the EU-U.S. Data Privacy Framework recognised by the European Commission.
Booking a call. If you book a call with us, the information you enter is processed by Neeto LLC, our booking provider, which may process it outside the EU/EEA; this transfer is covered by the European Commission's Standard Contractual Clauses, set out in Neeto's data processing agreement.
If other transfers become necessary, we will implement an appropriate transfer mechanism (such as the European Commission's Standard Contractual Clauses) and update this Policy accordingly.
Our website (openreviews.io), our review widget, and Augur use technologies that are strictly necessary to operate and secure the service, which do not require your consent. Your cookie choice itself is stored in your browser (local storage, not a cookie).
Measurement subject to your consent. On our public pages and our sign-up flow, and only for the purposes you accept (“Fine by me!”, or one by one via “Choose”), we load Google Tag Manager (Google Ireland Limited), a tool that fires our tags, and then:
— Improve your experience (audience measurement): Google Analytics 4 (Google Ireland Limited) sets cookies (_ga and _ga_…) and collects the pages you view, your journey on the site, certain actions (clicks to sign up or to book a meeting, account creation), where your visit came from (“utm” campaign parameters), and technical information (device type, browser, approximate country). Purpose: understanding how our website is used, in order to improve it. Google Analytics 4 does not log your IP address.
— Improve your experience, also: Microsoft Clarity (Microsoft Ireland Operations Limited). Purpose: understanding how visitors use our website, in order to improve it: clicks, scrolling, mouse movements and pages viewed, shown as heatmaps and session recordings that let us replay how a visit unfolded. Text typed into form fields is always masked before it is sent to Microsoft. Clarity sets two cookies on our domain, _clck (pseudonymous visitor identifier, 1 year) and _clsk (links the pages of a single visit, 1 day), as well as cookies on Microsoft's clarity.ms domain, in particular CLID and MUID (a browser identifier shared across Microsoft sites), for about 1 year. Microsoft keeps recordings for 30 days and click and heatmap data for 9 months. Microsoft processes this data as a controller, including for its own purposes, advertising among them, in accordance with the Microsoft Privacy Statement; it may be transferred to Microsoft Corporation in the United States, which participates in the EU-U.S. Data Privacy Framework. To withdraw your consent, use “Manage cookies”: Clarity is no longer loaded and we delete _clck and _clsk from your browser; cookies on the clarity.ms domain, which we cannot delete ourselves, can be removed in your browser settings.
— More relevant content (ad measurement): the Meta pixel (Meta Platforms Ireland Limited) sets cookies in your browser (in particular _fbp and, if you arrive from one of our ads, _fbc) and sends Meta the pages you view, the same actions, and where your visit came from (“utm” parameters and the Meta click identifier). Purpose: measuring how well our ads perform on Facebook and Instagram; this data also allows Meta to show our ads to people who have visited our website. For the collection and transmission of this data, Meta and we are joint controllers; Meta then processes it on its own behalf, in accordance with its privacy policy.
Booking calendar. On our booking pages, the NeetoCal calendar is embedded in the page: it is loaded from the servers of Neeto LLC, which applies its own privacy policy there, including for its cookies. If you have accepted ad measurement, it also reports the steps of your booking (time slot chosen, call booked) to the Meta pixel, without sending it your contact details.
Retention. Google Analytics cookies expire no later than 13 months after they are set, and audience measurement data is kept for 14 months in Google Analytics. Meta pixel cookies expire no later than 90 days after your last visit. Retention periods for Microsoft Clarity are given above. Your choice (consent or refusal, purpose by purpose) is kept for 6 months, after which we ask you again. Visit-source parameters are only kept for the duration of your browsing session.
Declining or changing your mind. Declining takes one click, like accepting (“Decline” button) and has no effect on your browsing: none of these tags is loaded. You can change your choice at any time, purpose by purpose, via the “Manage cookies” link at the bottom of the page; if you withdraw your consent, we delete the relevant tool's cookies from your browser.
Anonymous audience measurement. Regardless of this choice, we measure traffic to our website anonymously, without cookies, without identifiers, and without writing anything to your browser: only the page viewed, the language, the website you came from, and the type of device are sent to our servers, and your IP address is only used to infer your country before being discarded. Your browser's “Do Not Track” and “Global Privacy Control” signals turn this measurement off.
We keep personal data only as long as necessary for the purposes described above. Reviews are retained on a lasting basis so they remain available on product pages for as long as the relevant product listing or Merchant contract is active, and are removed thereafter or upon a valid deletion request. Contact details used for review solicitation are kept only as long as needed for the collection campaign and are then deleted or anonymised, and in any event within 3 years of the last contact. Merchant account and business-relationship data are kept for the duration of the contract and for the period required to meet our legal, accounting, and tax obligations thereafter. Booking information is kept for 3 years from our last exchange, unless a contractual relationship follows. Anonymised technical measurement data is kept for a maximum of 13 months. Retention periods specific to audience and ad measurement (Google Analytics, Microsoft Clarity and Meta pixel cookies, data kept by Microsoft Clarity, the choice made in the cookie banner) are set out in section 10.
OpenReviews provides AI assistants (such as ChatGPT or Claude) with a connector at https://api.openreviews.io/mcp, which gives read-only access to the review summaries already published on openreviews.io. How to use it is explained on the Your AI page.
What the connector receives. No account or credentials are required. The connector does not receive your conversation: only the request your assistant sends it, that is a product name, brand, barcode, category or openreviews.io link, and the requested language. This request is used only to find the product and return its summary, and the connector does not store it.
IP address and technical logs. The IP address the call comes from, usually the assistant platform's, is used to limit the number of calls per minute, in a counter that expires after one minute. As for any request our servers receive, the IP address, time, address called and calling software's identifier also appear in our technical logs, kept for 30 days at most for security and troubleshooting. These logs do not contain the request, except when a call fails: the error may then cite the requested product or category.
Usage measurement. We count calls per day, per tool, per calling software (its technical identifier) and per outcome (product found, not found, error). These counts contain no request, no IP address and no data that could identify you. They are used to monitor the use and quality of the service, based on our legitimate interest.
What the connector returns. Data already public on openreviews.io: the rating, the number of reviews analyzed, the summary, strengths and weaknesses, short review excerpts without author names, and the link to the product page.
Your assistant. The assistant you use processes your conversations under its own privacy policy, which OpenReviews does not control.
Under the GDPR, you have the right to access your personal data, request correction of inaccurate data, request erasure, restrict or object to processing (including objecting to processing based on legitimate interests, and to review-collection messages), obtain data portability, and, where processing is based on consent, withdraw that consent at any time.
To exercise these rights over data we process on behalf of a Merchant, you can contact that Merchant directly, or contact us at support@inflate.review and we will forward your request. You also have the right to lodge a complaint with your local supervisory authority. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL).
For any question about this Privacy Policy or to exercise your rights, contact us at support@inflate.review, or by post at INFLATE, 99 avenue Achille Peretti, 92200 Neuilly-sur-Seine, France.
We may update this Privacy Policy from time to time. We will post the updated version with a revised "Last updated" date and, where changes are significant, provide additional notice.