The short version
Reviewmy reviews websites. To do that we fetch the pages you point us at, run them through AI review passes, and let the people you invite comment on them. We collect the account details you give us, the addresses of the sites you review, and the comments and screenshots produced during a review.
We do not sell your data, we do not run advertising, and we do not use your clients' sites for anything other than reviewing them for you.
Two things are worth knowing up front because they are unusual:
- We deliberately do not forward your cookies or credentials. When we fetch a page for review, we strip
Cookie,Authorization,Originand forwarding headers before the request leaves us. This is why pages behind a login cannot be reviewed. It is a limitation and a privacy protection at the same time. - We do not store IP addresses for free audits. We store a keyed hash of the address so we can rate limit, and never the address itself.
Section 1Who we are
Acutix LLC, doing business as Reviewmy, is the controller of the personal information described here.
- Entity: Acutix LLC, Colorado ID 20261554527
- Trade name: Reviewmy, Colorado trade name filing 20268095494
- Contact: info@acutixmarketing.com
Section 2What we collect
2.1Information you give us
When you create an account: your name, email address, phone number, business name if you provide one, and a password. The password is handled by our authentication provider and is stored as a hash. We never see or store your password in readable form.
When you consent: whether you accepted these terms and the privacy policy, the version you accepted, and the time you accepted it. Separately, whether you opted in to marketing email and when. These are recorded as timestamps rather than simple yes or no flags, so we can show exactly what was agreed and when.
When you set up a review: the web address of the site you want reviewed, any additional hosts you allow us to load assets from, and a project name.
When you connect a repository: an authorisation to read the GitHub repository you select, and the file paths and line numbers our review reports back.
2.2Information produced by using the service
Review findings. The output of our review passes, including quoted text and measurements taken from the reviewed page.
Comments and markup. Comments left by you or by reviewers you invite, replies, status and priority, and any visual edits made on the page.
Automatic capture attached to a comment. Browser, operating system, viewport size, scroll position, and a screenshot of the page area being commented on. These are captured so that a comment is actionable without the reviewer having to describe their setup.
Screenshots are rasterised from the page structure rather than captured by the browser's screen recorder. They can therefore render some elements imperfectly, and they only ever cover the visible area, never the full page.
Usage counts. How many reviews, code reviews, image generations and copy rewrites your account has run in the current month, so we can apply your plan's allowance, and a record of what those runs cost us to serve.
2.3Information collected automatically
Session cookie. When someone opens a review link we set a cookie named wr_session holding a signed reference to their reviewer record. It is httpOnly, sameSite=lax, and marked secure in production. It carries a display name and a project reference, not an identity you can look up elsewhere.
Authentication cookies. Set by our authentication provider when you sign in.
Free audits. When someone runs a free audit without an account we store the address they submitted, the findings produced, and a keyed hash of their IP address for rate limiting. We do not store the IP address.
2.4Payment information
Payments are processed by Stripe. Card numbers go to Stripe directly and never reach our servers. We store the Stripe customer and subscription identifiers, your plan, and its status.
Section 3Reviewers who do not have accounts
If you send a review link to a client or colleague, they can comment without creating an account. For those people we collect only the display name they type, the contents of their comments, and the automatic capture described in 2.2.
They are your invitees. You control the link, and you can set a password on it, give it an expiry date, make it view only, or revoke it at any time. Revoking a link ends access immediately.
Section 4Pages we fetch on your behalf
When you submit an address, we fetch that page from our own servers and re-serve it so it can be annotated. While doing so:
- We never send cookies, authorisation headers, or forwarding headers upstream.
- We send a synthetic referrer pointing at the target's own origin rather than passing yours along.
- We refuse addresses that resolve to private, loopback, link local, carrier grade NAT, multicast or reserved network ranges, and we re-check on every redirect.
- We drop security and tracking headers from the response, including
set-cookie.
The practical effect is that we can only review pages a member of the public could already see.
Section 5Why we use it
| Purpose | What it covers |
|---|---|
| Providing the service | Running reviews, serving review links, storing comments and reports |
| Account and security | Signing you in, protecting accounts, preventing abuse and rate limiting |
| Billing | Applying plan allowances, taking payment, preventing runaway spend |
| Support | Answering you when something goes wrong |
| Service email | Sign-in links, receipts, notices about your account. These are not marketing and you cannot opt out of them while you hold an account |
| Marketing email | Only if you opted in. You can withdraw at any time |
| Improving the product | Understanding which review passes produce useful findings |
We do not use your content, your clients' sites, or review findings to train AI models.
Section 6Who we share it with
We share only with service providers who process data on our behalf, under contract, for the purposes above.
| Provider | What they handle |
|---|---|
| Supabase | Database, authentication, sign in email |
| Resend | Delivery of notification and service email |
| Vercel | Hosting and content delivery |
| Stripe | Payment processing |
| Anthropic | AI review passes |
| Image generation | |
| NVIDIA | AI model serving |
| GitHub | Only if you connect a repository, and only the repository you select |
We also disclose information where we are legally required to, and to a buyer or successor if the business is sold, in which case we will say so before your information moves.
We do not sell personal information, and we do not share it for cross context behavioural advertising.
Section 7How long we keep it
| Data | Retention |
|---|---|
| Account details | While your account exists, then deleted on request |
| Projects, comments, screenshots, reports | Until you delete the project, which cascades to its share links, comments, screenshots and media. There is no separate expiry, so a project you keep, we keep |
| Agent Console run history | Kept until you delete the project it belongs to or close your account. We do not age this data automatically today, so we do not state a period we would not be keeping |
| Consent records | Kept after account closure, because they are the evidence of what was agreed |
| Billing records | Kept as long as tax and accounting rules require |
| Free audit results | Kept until we remove them. A free audit is not attached to an account, so there is nothing to delete it alongside. Write to info@acutixmarketing.com and we will remove a specific audit |
Section 8Your choices and rights
You can, at any time:
- See and correct your account details from your account settings.
- Delete a project, which removes its comments, screenshots, share links and reports.
- Revoke a share link, which ends access for everyone holding it.
- Unsubscribe from marketing email using the link in any marketing message, or by asking us. This does not stop service email.
- Close your account and ask us to delete your data. Write to info@acutixmarketing.com. We will delete what we are not required to keep and tell you what remains and why.
Depending on where you live you may also have the right to a copy of your data in a portable form, to object to or restrict certain processing, to withdraw consent, and to complain to a regulator. To exercise any of these, write to info@acutixmarketing.com. We will not treat you differently for asking.
Section 9Security
Passwords are hashed by our authentication provider. Share link passwords are hashed before storage. Access tokens are stored as hashes and shown once. Session tokens are signed and time limited. Database access is restricted by row level security so an account can only read its own records.
No system is perfectly secure, and we do not claim ours is. We do not hold a SOC 2 report or any comparable certification, and we will not imply otherwise.
Section 10Children
Reviewmy is a business tool and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has given us information, write to info@acutixmarketing.com and we will delete it.
Section 11International transfers
We are based in the United States and our providers process data in the United States. If you are outside the United States, using Reviewmy means your information is transferred there, where privacy law differs from your own.
Section 12Changes
If we change this policy we will update the date at the top. If a change materially affects how we handle your information we will tell account holders by email before it takes effect.
Section 13Contact
info@acutixmarketing.com
Acutix LLC, doing business as Reviewmy