privacy policy

Effective date: 9 October 2026

1. Who we are

Review Hive ("we", "us") is Greg O'Sullivan, a sole trader trading as Review Hive, of Fairview Lawn, Shanganagh Vale, Cabinteely, Co. Dublin, Ireland. For anything to do with your personal data, contact Greg O'Sullivan at [email protected].

This policy explains what personal data we collect, why, who we share it with, how long we keep it and your rights. It applies to our website, our social media pages, our free resources and all our services.

2. When we act for our clients

We provide services that contact our clients' own customers. Examples are review requests, AI lead reactivation and managing a client's Instagram or Facebook messages. When we do this, the business you dealt with is the data controller and we are its data processor. We only use that data on the business's instructions, and their privacy notice applies. Please contact that business first about your data; we will help them respond.

The rest of this policy covers data we control ourselves: our website visitors, enquirers, people who download our free resources, people who message our social media pages, and our own clients.

3. What we collect and why

Visiting our website. We collect your IP address, browser and device type, the pages you view and time on site. We use this to run, secure and improve the site and to measure visits. Legal basis: legitimate interests.

Enquiry, demo or contact forms. We collect your name, email, phone, business name, your message and the date and time. We use this to answer your enquiry and arrange a call. Legal basis: steps you ask for before a contract, and legitimate interests.

Free 30-Day Social Media Plan download. We collect your first name, email, phone, business type and your marketing choice. We use this to send you the plan and 2 short follow-up emails about our services, as stated on the form. If you tick the box, we also send ongoing tips and updates by email or text. Legal basis: consent, given when you request the plan (follow-up emails) and by ticking the box (ongoing tips and updates).

Commenting on or messaging our Instagram or Facebook pages. We collect your name, username and profile ID as provided by Meta, and your comments and messages. We use this to reply to you, send you resources you asked for, and answer questions. Legal basis: legitimate interests.

Buying a plan at checkout. We collect your name, email and phone. Card details are handled by our payment provider, not by us. We use this to take payment and set up your service. Legal basis: contract.

Booking your kickoff call. We collect your name, phone, email, company, Instagram handle, website, notes and reminder preference. We use this to prepare for and deliver your service, and to send booking reminders. Legal basis: contract; consent for optional reminders.

Being our client. We hold the account access you give us, content, messages and billing records. We use this to deliver the service and support you. Legal basis: contract, and legal obligation (tax and accounting records).

Our emails. We record whether an email was opened and which links were clicked, so we can see which messages are useful and stop sending ones that aren't. Legal basis: legitimate interests.

We do not ask for special category data (such as health, religion or ethnic origin). Please don't send it to us in messages.

4. AI-assisted replies

When you message our Instagram or Facebook pages, replies may be written by an AI assistant that runs in our CRM. It answers common questions about our services and prices. It does not make decisions about you that have legal or similarly significant effects. You can ask to speak to a person at any time, and Greg will reply. AI replies can occasionally be wrong; anything you are charged is set out at checkout.

5. Marketing

We only send marketing emails or texts where you have agreed, or where the law otherwise allows it. Every email has an unsubscribe link, and you can reply STOP to any text. Unsubscribing does not affect messages we must send to deliver a service you have bought.

6. Who we share data with

We never sell your personal data. We share it only with service providers that help us run Review Hive, under contracts that require them to protect it:

HighLevel (LeadConnector) — our CRM, website, forms, calendars, email and text sending, and the AI chat assistant. HighLevel uses its own sub-processors, including AI model providers.

Stripe — processes card payments. Stripe is also an independent controller for its own legal duties, such as fraud and anti-money-laundering checks.

Meta Platforms Ireland (Instagram, Facebook) — hosts our pages and delivers comments and messages. Meta handles your data under its own privacy policy; we are joint controllers with Meta for page statistics.

Cloudflare — website security and cookie-free visit statistics.

Our accountant and professional advisers — bookkeeping, tax and legal advice.

We may also disclose data where the law requires it, for example to Revenue or a court.

7. International transfers

Some providers, including HighLevel, Stripe, Cloudflare and Meta, may process data outside the European Economic Area, mainly in the United States. Where they do, we rely on the EU–US Data Privacy Framework (where the provider is certified) or the European Commission's Standard Contractual Clauses. You can ask us for details.

8. How long we keep it

Enquiries, free-resource downloads and social media leads who don't become clients: 12 months after our last contact, then deleted.

Marketing consent: until you unsubscribe. If you haven't opened or clicked any of our emails for 12 months, we remove you from our list.

Clients: for as long as you use our services, then 6 years for tax and legal reasons. Data inside a client's CRM account is handled under Clause 19.9 of our Terms.

Website visit and attribution data: up to 14 months.

9. Your rights

You have the right to:

access the data we hold about you;

have inaccurate data corrected;

have your data deleted, in certain circumstances;

restrict how we use it, in certain circumstances;

receive data you gave us in a portable format;

object to processing based on legitimate interests — and always to direct marketing;

withdraw consent at any time, without affecting what we did before;

not be subject to decisions based solely on automated processing that have legal or similarly significant effects.

To use any of these rights, email [email protected]. We will reply within one month. We may ask for information to confirm your identity, but only where that is reasonably necessary.

10. Complaints

Please contact us first so we can try to put things right. You also have the right to complain to the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland — www.dataprotection.ie, (01) 765 01 00.

11. Security

We use reputable, secure providers, restrict access to people who need it, and use strong passwords and two-factor authentication on our accounts. No system is completely secure. If a breach affects your data and puts you at high risk, we will tell you.

12. Children

Our services and free resources are for businesses and are not aimed at anyone under 18. If we learn we hold data about a child, we will delete it.

13. Cookies

Our website uses cookies that are needed to make it work, for example for forms and the chat window. Our website platform, HighLevel, also uses cookies to record how visitors reach us, such as which page or link brought them. We do not use Google Analytics or advertising cookies.

14. Changes to this policy

We may update this policy. The current version, with its effective date, will always be on this page. If we make a significant change that affects clients, we will email them.