Privacy Policy

1. Introduction

Ratesorant (“we”, “us”, or “our”) is a restaurant competitive intelligence platform. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website, applications, and services (collectively, the “Services”). By using Ratesorant, you agree to the practices described in this policy.

2. Information we collect

We collect the following categories of information:

• Account information: email address, password hash (managed by Supabase Auth), and optional profile information such as your name and role.
• Business information: restaurant name, address, cuisine type, location coordinates, and the names and addresses of competitors you choose to track.
• Usage data: log data, IP addresses, browser type, device information, pages viewed, and interactions with the Services, collected via server logs and analytics tools.
• Publicly available data: review text, star ratings, business hours, photos, and other information publicly posted on third-party platforms such as Google Maps, Yelp, and TripAdvisor for restaurants and competitors you configure.
• Communications: emails, support requests, and feedback you send us.
• Payment information: we do not store full credit card numbers. Stripe processes payments and provides us with a customer ID, subscription status, and limited card metadata (brand and last four digits).

3. How we use your information

We use your information to:

• Provide, operate, and maintain the Services;
• Authenticate you and manage your account;
• Collect and analyze public competitor reviews and listings;
• Generate daily opportunities, recommendations, reports, and alerts;
• Send transactional emails, daily briefings, and service notifications;
• Process payments and manage subscriptions;
• Improve our product, train and evaluate models where permitted, and prevent abuse;
• Respond to your questions and provide customer support.

4. AI and third-party processing

We use third-party AI providers, currently Anthropic and/or OpenAI, to analyze review text and generate insights. Only the review text and business names necessary for analysis are sent to these providers. We select providers whose API terms prohibit using customer data to train their models, and we do not authorize training on your data beyond those terms.

5. Cookies and tracking

We use cookies and similar technologies to authenticate users, remember preferences, understand usage, and improve the Services. For more details, please see our Cookie Policy.

6. Data sharing and subprocessors

We do not sell your personal data. We share data only with trusted service providers who help us operate the Services, including:

• Supabase - authentication and database hosting;
• Stripe - payment processing;
• Resend - email delivery;
• Anthropic / OpenAI - AI analysis;
• Apify - public data collection infrastructure;
• Vercel - hosting and edge functions.

Each subprocessor is contractually bound to use your data only to provide services to Ratesorant and to protect it with appropriate security measures.

7. Data retention

We retain your account data and generated insights for as long as your account is active. Raw scraped review data is retained for 90 days, after which it is deleted. If you delete your account, we remove your personal and business data within a reasonable period, except where we are legally required to retain records (for example, billing records for tax and accounting purposes).

8. Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. You can update much of your information directly in your account settings. For other requests, contact us using the details below.

9. Security

We implement industry-standard security measures, including encryption in transit (TLS), encrypted database storage, access controls, and regular security reviews. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

10. International transfers

Your data may be processed in countries other than your own, including the United States, where our hosting and service providers operate. We rely on appropriate safeguards, such as Standard Contractual Clauses, for any international transfers.

11. Children

Ratesorant is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you believe we have collected such data, please contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version here with a new “Last updated” date. Continued use of the Services after changes means you accept the revised policy.

13. Contact us

If you have questions or requests about this Privacy Policy, please email us at privacy@ratesorant.com.