The short version
Reviewmy reviews websites. To do that we fetch the pages you point us at, run them through AI review passes, and let the people you invite comment on them. We collect the account details you give us, the addresses of the sites you review, and the comments and screenshots produced during a review.
We do not sell your data, we do not run advertising, and we do not use your clients' sites for anything other than reviewing them for you.
Two things are worth knowing up front because they are unusual:
- We deliberately do not forward your cookies or credentials. When we fetch a page for review, we strip
Cookie,Authorization,Originand forwarding headers from the browser's request before it leaves us. The only credential we ever send upstream is an access key a project owner sets up so their own pages behind a login can be reviewed, and section 4 says exactly where it goes. - We do not store IP addresses for free audits. We store a keyed hash of the address so we can rate limit, and never the address itself.
Section 1Who we are
Acutix LLC, doing business as Reviewmy, is the controller of the personal information described here.
- Entity: Acutix LLC, Colorado ID 20261554527
- Trade name: Reviewmy, Colorado trade name filing 20268095494
- Contact: info@acutixmarketing.com
Section 2What we collect
2.1Information you give us
When you create an account: your name, email address, phone number, business name if you provide one, and a password. The password is handled by our authentication provider and is stored as a hash. We never see or store your password in readable form.
When you consent: whether you accepted these terms and the privacy policy, the version you accepted, and the time you accepted it. Separately, whether you opted in to marketing email and when. These are recorded as timestamps rather than simple yes or no flags, so we can show exactly what was agreed and when.
When you set up a review: the web address of the site you want reviewed, any additional hosts you allow us to load assets from, and a project name.
When you connect a repository: an authorisation to read the GitHub repository you select, and the file paths and line numbers our review reports back.
When you ask us for something before you have an account: your email address, and, depending on what you asked for, the role you picked (optional, one tap), your name, the topic, how many sites you ship a month and your message (Talk to us only). If you tick the box for tips, we record that you did, the exact wording you agreed to, its version and the time. We also record where the form was: the ref and utm_ tags in the address of the page you submitted from, the host name of the site that sent you there if it was another site, and the page's path. These are read from the page at the moment you submit. Nothing is stored on your device to remember you, and if you later create an account with the same address, we link the two.
2.2Information produced by using the service
Review findings. The output of our review passes, including quoted text and measurements taken from the reviewed page.
Comments and markup. Comments left by you or by reviewers you invite, replies, status and priority, and any visual edits made on the page.
Automatic capture attached to a comment. Browser, operating system, viewport size, scroll position, and a screenshot of the page area being commented on. These are captured so that a comment is actionable without the reviewer having to describe their setup.
Screenshots are rasterised from the page structure rather than captured by the browser's screen recorder. They can therefore render some elements imperfectly, and they only ever cover the visible area, never the full page.
Images attached to a comment. A reviewer can attach an image of their own to a comment, from their phone or computer, usually the one they want used instead of a picture on the page. We keep it with the comment, as a JPEG or PNG of at most 4 MB, and show it to the project owner and to everyone on that review link. It is deleted when the comment or the project is deleted. Attach only images you have the right to share.
Usage counts. How many reviews, code reviews, image generations and copy rewrites your account has run in the current month, so we can apply your plan's allowance, and a record of what those runs cost us to serve.
2.3Information collected automatically
Session cookie. When someone opens a review link we set a cookie named wr_session holding a signed reference to their reviewer record. It is httpOnly, sameSite=lax, and marked secure in production. It carries a display name and a project reference, not an identity you can look up elsewhere.
Authentication cookies. Set by our authentication provider when you sign in.
Free audits. When someone runs a free audit without an account we store the address they submitted, the findings produced, and a keyed hash of their IP address for rate limiting. We do not store the IP address. If they unlock the full audit with an email address, the audit is linked to that address and given a private link that opens it without an account. Anyone they forward that link to can open it.
Two flags in your browser. On our marketing pages, session storage remembers that you closed the audit bar or have already been shown the checklist card, so neither comes back in that tab. They are cleared when the tab closes and are never sent to us.
Page views. Our pages use Vercel Web Analytics to count visits. It records the page path, the referring address, the country, and the browser, operating system and device type. It sets no cookies. Vercel documents that visitors are counted using a hash it regenerates daily rather than a stored identifier, so the same person returning on a later day is counted again rather than recognised.
It does not follow you to other sites and we do not use it for advertising. We receive counts, not people: there is no view in which we can see an individual visitor, and nothing from it is passed on.
It does not act on a Do Not Track header, because the library we use does not read one. If you would rather not be counted, the script is a single first party file at /_vercel/insights/script.js and any content blocker that stops it will stop the counting. Nothing else on the site depends on it.
2.4Payment information
Payments are processed by Stripe. Card numbers go to Stripe directly and never reach our servers. We store the Stripe customer and subscription identifiers, your plan, and its status.
Section 3Reviewers who do not have accounts
If you send a review link to a client or colleague, they can comment without creating an account. For those people we collect the display name they type, the contents of their comments, and the automatic capture described in 2.2, and nothing else unless they buy headshots.
Headshot buyers. If a project's owner has switched headshots on, someone with the review link can buy a set of studio headshots. A buyer gives us their name and email address and pays through Stripe, as described in 2.4. If they are commenting through the link and have no email address on file, we also save that address on their reviewer record, so a later visit can be matched to their order. They then upload five to ten photos of their face. Google screens each photo and generates the headshots from the ones it accepts. The uploaded photos are kept with the order only until the set is finished, and are then deleted. Section 7 says how long the rest is kept.
They are your invitees. You control the link, and you can set a password on it, give it an expiry date, make it view only, or revoke it at any time. Revoking a link ends access immediately.
Section 4Pages we fetch on your behalf
When you submit an address, we fetch that page from our own servers and re-serve it so it can be annotated. While doing so:
- We never pass your cookies, authorisation headers or forwarding headers upstream, or those of anyone viewing a review link.
- We send a synthetic referrer pointing at the target's own origin rather than passing yours along.
- We refuse addresses that resolve to private, loopback, link local, carrier grade NAT, multicast or reserved network ranges, and we re-check on every redirect.
- We drop security and tracking headers from the response, including
set-cookie.
Access keys for pages behind a login. A project owner may set up an access key so their own pages behind a login can be reviewed. We store it encrypted, with AES-256-GCM under a key derived from a secret held on our servers, and we do not show it again once saved. We send it in the one request header the owner names, X-Review-Key unless they choose another, only over https, and only to the project's own domain, its subdomains and any further hosts the owner lists. We check every redirect and drop the key on any hop that leaves those hosts. It is sent when a page loads in the review frame and when we map the project's pages, and never by the AI review passes.
The practical effect is that we can only review pages a member of the public could already see, unless the site's owner has set up an access key. Where they have, everyone who opens that project's review links sees the pages the key opens.
Section 5Why we use it
| Purpose | What it covers |
|---|---|
| Providing the service | Running reviews, serving review links, storing comments and reports |
| Account and security | Signing you in, protecting accounts, preventing abuse and rate limiting |
| Billing | Applying plan allowances, taking payment, preventing runaway spend |
| Support | Answering you when something goes wrong |
| Service email | Sign-in links, receipts, notices about your account. These are not marketing and you cannot opt out of them while you hold an account |
| Requests made without an account | Sending the one thing you asked for: the full audit, the checklist, the plan comparison, or a reply from a person |
| Marketing email | Only if you opted in. You can withdraw at any time. If you ticked the tips box without an account, that is two follow-up emails at most, and they stop when you create an account |
| Improving the product | Understanding which review passes produce useful findings |
We do not use your content, your clients' sites, or review findings to train AI models.
Section 6Who we share it with
We share only with service providers who process data on our behalf, under contract, for the purposes above.
| Provider | What they handle |
|---|---|
| Supabase | Database, authentication, sign in email and file storage |
| Resend | Delivery of notification and service email |
| Vercel | Hosting, content delivery, and cookieless page view counts |
| Stripe | Payment processing |
| Anthropic | AI review passes |
| NVIDIA | AI model serving for the review passes, the free audit and, where Google is not used, the code review |
| Image generation; screening and generating headshots from the face photos a buyer uploads; the code review, which receives source from the repository you connect; and the free audit when NVIDIA cannot answer, which receives the content of the page being audited | |
| OpenAI | Logo concepts, from the prompt you write and up to four reference images you choose |
| Together AI and Pollinations | Image generation from a written prompt, only when Google's image service is out of quota or unavailable |
| GitHub | Only if you connect a repository, and only the repository you select |
If you connect a destination yourself, such as a webhook endpoint, Zapier, Make, n8n, Slack, Discord, Microsoft Teams or a task tool, it receives the event payloads you subscribe it to: identifiers, counts, names, page paths and finding titles. You choose these destinations, and what happens to a payload once it arrives is governed by that service and by you.
We also disclose information where we are legally required to, and to a buyer or successor if the business is sold, in which case we will say so before your information moves.
We do not sell personal information, and we do not share it for cross context behavioural advertising.
Section 7How long we keep it
| Data | Retention |
|---|---|
| Account details | While your account exists, then deleted on request |
| Projects, comments, screenshots, attached images, reports | Until you delete the project, which cascades to its share links, comments, screenshots, attached images and media. There is no separate expiry, so a project you keep, we keep |
| Agent Console run history | Kept until you ask us to delete it, or until your account is deleted. Runs belong to your account rather than to a project, so deleting a project or revoking a key does not remove them, and there is no way to delete them from inside the product yet. Write to info@acutixmarketing.com and we will. We do not age this data automatically today, so we do not state a period we would not be keeping |
| Consent records | Kept after account closure, because they are the evidence of what was agreed |
| Billing records | Kept as long as tax and accounting rules require |
| Free audit results | Kept until we remove them. A free audit is not attached to an account, so there is nothing to delete it alongside. Write to info@acutixmarketing.com and we will remove a specific audit |
| Requests made without an account | Your email address, role, the tips consent, where the form was and any message are kept until you ask us to delete them. Unsubscribing stops the follow-ups at once and marks the record so we do not write to you again; it does not delete it. Write to info@acutixmarketing.com and we will remove the rest |
| Headshot orders | The buyer's name and email address and the finished headshots are kept until we remove them, including after the project is deleted, because the order belongs to the buyer. The face photos a buyer uploads are deleted once their set is finished. Write to info@acutixmarketing.com and we will remove an order |
Section 8Your choices and rights
You can, at any time:
- See and correct your account details from your account settings.
- Delete a project, which removes its comments, screenshots, share links and reports.
- Revoke a share link, which ends access for everyone holding it.
- Unsubscribe from marketing email using the link in any marketing message, or by asking us. This does not stop service email.
- Stop any email we send you without an account using the one-click link in it. Every one carries it.
- Close your account and ask us to delete your data. Write to info@acutixmarketing.com. We will delete what we are not required to keep and tell you what remains and why.
Depending on where you live you may also have the right to a copy of your data in a portable form, to object to or restrict certain processing, to withdraw consent, and to complain to a regulator. To exercise any of these, write to info@acutixmarketing.com. We will not treat you differently for asking.
Section 9Security
Passwords are hashed by our authentication provider. Share link passwords are hashed before storage. Access tokens are stored as hashes and shown once. Session tokens are signed and time limited. Row level security is switched on for our database tables, which limits a signed in session to its own account's records. Most of our server code reads and writes with a service key that is not subject to it, and limits each query to the account making the request in our own code.
No system is perfectly secure, and we do not claim ours is. We do not hold a SOC 2 report or any comparable certification, and we will not imply otherwise.
Section 10Children
Reviewmy is a business tool and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has given us information, write to info@acutixmarketing.com and we will delete it.
Section 11International transfers
We are based in the United States and our providers process data in the United States. If you are outside the United States, using Reviewmy means your information is transferred there, where privacy law differs from your own.
Section 12Changes
If we change this policy we will update the date at the top. If a change materially affects how we handle your information we will tell account holders by email before it takes effect.
Section 13Contact
info@acutixmarketing.com
Acutix LLC, doing business as Reviewmy