Last updated: August 3, 2026

Operated by: HiFiveStar (legal entity details available on request via support@hifivestar.com)

Who We Are

HiFiveStar ("HiFiveStar," "we," "us") is a review management platform that helps local businesses collect, monitor, and respond to online reviews. This Privacy Policy explains what data we collect, why, how long we keep it, and your rights.

Contact for data requests: support@hifivestar.com

Our Role: Controller and Processor

Data controller — for the account, billing, and business information of the merchants who sign up for HiFiveStar, we act as the data controller.
Data processor — for the end-customer and review data our business customers collect and manage through the platform (such as reviewer details and customer contacts uploaded for review campaigns), we act as a data processor on the merchant's behalf.

Business customers can review our Data Processing Addendum at https://hifivestar.com/dpa.

Data We Collect

Account & Identity Data

Business email address — collected at signup — used for authentication and communication — retained for the life of your account. GDPR basis: Contractual necessity.
Password / auth credentials — collected at signup — used for authentication (stored hashed by the platform provider) — retained for the life of your account. GDPR basis: Contractual necessity.
Business name, address, phone — collected during onboarding — used to identify your business and connect review platforms — retained for the life of your account. GDPR basis: Contractual necessity.

Review Management Data

Review data from third-party platforms — collected via platform integrations (Google, Yelp, Facebook, TripAdvisor, and others) — includes reviewer name, review text, star rating, date — used for monitoring and response — retained for the life of your account. GDPR basis: Contractual necessity.
AI-generated review responses — generated when you use auto-reply features — used to respond to reviews on your behalf — retained for the life of your account. GDPR basis: Contractual necessity.
Review request campaign data — collected when you send SMS or email review requests — includes customer contact info and delivery status — retained until you delete them or close your account. GDPR basis: Legitimate interest.

Customer Contact Data

Customer email addresses and phone numbers — collected when you upload contacts for review campaigns — used to send review requests via SMS and email — retained until you delete them or close your account. GDPR basis: Legitimate interest (your business relationship with your customer).

Billing & Subscription Data

Stripe payment data — collected via Stripe Checkout at subscription — includes email, payment method (processed by Stripe, we don't store card numbers) — used for billing — retained for as long as your account is active and thereafter as required for legal, tax, and accounting obligations. GDPR basis: Contractual necessity and Legal obligation.
Subscription tier — collected at purchase — includes plan name (Core / Growth / Business / Enterprise tiers) — used for feature gating — retained for the life of your account. GDPR basis: Contractual necessity.

Marketing Website Analytics

Google Tag Manager (GTM-MKHVR88) — collected on hifivestar.com page load — includes page views, click events, session data — used for marketing analytics and conversion tracking — retained per Google's data retention policy. GDPR basis: Legitimate interest.
Self-hosted analytics beacon — anonymous page-view events sent to our own first-party analytics endpoint — used for aggregate traffic measurement, no third-party ad networks — retained as aggregate counts. GDPR basis: Legitimate interest.
SocialJuice testimonial embed — loaded on the marketing website — SocialJuice may collect visitor data per their own privacy policy — used to display customer testimonials. GDPR basis: Legitimate interest.
IP address — collected on every request — used for CDN, security, and rate limiting — retained in server logs for a limited period for security and diagnostics. GDPR basis: Legitimate interest.
User-agent string — collected on every request — used for debugging — retained in server logs for a limited period for security and diagnostics. GDPR basis: Legitimate interest.
Google Search Console data — collected via GSC API — used for SEO monitoring — not directly tied to individual users. GDPR basis: Legitimate interest.

Affiliate & Partner Data

Affiliate registration data — collected at affiliate.hifivestar.com/register — includes name, email, payment details for commissions — used for affiliate program management — retained for as long as your affiliate relationship is active and thereafter as required for legal, tax, and accounting obligations. GDPR basis: Contractual necessity.

Help Center & Support Data

Support ticket content — collected when you contact support via help.hifivestar.com — includes email, message content — used for issue resolution — retained for as long as needed to provide support. (support platform: Gleap) GDPR basis: Contractual necessity.

How We Use Your Data

Providing the service — review monitoring, AI responses, review campaigns, listing management.
Authentication and security — verifying identity, preventing unauthorized access.
Billing — processing payments via Stripe.
Marketing — website analytics, conversion tracking, testimonial display.
Affiliate management — tracking referrals and commissions.
Legal compliance — financial record keeping.

We do not use your data to:

Train AI models
Sell your personal or business information

Data Sharing

Processor	Data Shared	Purpose
Stripe	Email, payment info	Billing
Google	Business data, analytics	GTM, GBP integration, GSC
Our platform provider	Account and review data	Core product functionality — processed on our behalf under contract
SocialJuice	Visitor cookies (their embed)	Testimonial display
Cloudflare / Vercel	IP address	Hosting, CDN
AI provider	Review text, business context	AI review response generation

We do not sell your personal information.

Cookies

We use cookies and similar technologies on our website. For details on what we set and how to manage them, see our Cookie Policy at https://hifivestar.com/cookie-policy.

Data Retention Summary

Data Category	Retention Period
Account data	Life of account + 30 days after deletion
Review data	Life of account
Customer contacts	Until you delete them or close your account
Billing data	Life of account, then as required for legal, tax, and accounting obligations
Server/CDN logs	Limited period for security and diagnostics
Analytics data	Per provider retention policy
Affiliate data	Life of relationship, then as required for legal, tax, and accounting obligations

Your Rights Under GDPR (EU/EEA Users)

You have the right to:

Access (Article 15), Rectification (Article 16), Erasure (Article 17), Restriction (Article 18), Portability (Article 20), Object (Article 21), Withdraw consent (Article 7).

Email support@hifivestar.com to exercise these rights. We respond within 30 days.

Your California Privacy Rights (CCPA)

If you are a California resident:

Right to Know — request what personal information we collect and share.
Right to Delete — request deletion of your personal information.
Right to Opt-Out of Sale — we do not sell your personal information.
Right to Non-Discrimination — exercising these rights will not affect your service.

Email support@hifivestar.com to exercise these rights.

Categories collected: Identifiers, commercial information, internet activity, professional information.
Categories sold: None.

Children's Privacy

HiFiveStar is a B2B platform not directed at children under 16.

International Data Transfers

Data is processed in the United States. We use Standard Contractual Clauses for international transfers.

Changes to This Policy

We will notify you of material changes via email or website notice.

Contact

Email: support@hifivestar.com
Legal entity: details available on request via support@hifivestar.com