Privacy Policy
Last updated: October 12, 2026 · Version 2026-10-12
Summary
- Customers: when you leave feedback, get a reward or use a loyalty card, the business sees your feedback, a short display name and your activity with it. It does not see your email address or phone number. DenAdvisor keeps those and contacts you on the business’s behalf. We do not publish your feedback.
- Rewards never depend on your rating, and every customer is offered the business’s public review link, whatever rating they give.
- Businesses: we use account, team and billing information to run your account. Card details go to Stripe, not to us.
- We do not sell or share personal information for advertising, and we do no third-party behavioral profiling or ad tracking. Our website and app have no advertising or analytics trackers.
- Deleting your information: ask us at [email protected] and, within 45 days, we delete your contact details and everything you wrote at every business, keeping only de-identified counts and star ratings for the business’s reports, and a scrambled copy of your email address so you are never sent offers again (Section 11).
- You can delete your app account in the app, and unsubscribe from any business’s offers with one click.
1. Who we are and what this policy covers
DenAdvisor (“DenAdvisor,” “we,” “us”) is operated by VertexSpot LLC in the United States. DenAdvisor helps small businesses hear from their customers, run digital loyalty cards and offer rewards and deals.
This policy covers our website (denadvisor.com), the business dashboard, our feedback, reply and unsubscribe pages, the emails we send, and the DenAdvisor mobile apps for iOS and Android (together, the “Service”). It applies to three groups of people:
- Customers: people who scan a business’s QR code, leave feedback, receive a reward, use a loyalty card or reply to a business’s message.
- App users: customers who create a DenAdvisor account in the mobile app to keep a wallet of loyalty cards, rewards and deals.
- Business users: owners, admins, managers and staff who use the dashboard or the app’s business tools.
Businesses that use DenAdvisor are separate companies with their own privacy practices. Anything you post on Google or another review site is governed by that site’s own terms and privacy policy. Our Terms of Service explain the rules for using the Service.
2. Who is responsible for your information
Responsibility is shared between DenAdvisor and each business, and it depends on the information:
- DenAdvisor is responsible for (we are the “business” or “controller”):
- business user accounts, team access and billing;
- app accounts, the app wallet and app settings;
- the contact details customers give through DenAdvisor (email address and, at a loyalty counter, phone number). We keep these, we do not give them to the business, and we use them only to deliver what the customer asked for and the business’s messages and offers, as described in Section 7;
- our website, security logs and support requests.
- Each business is responsible for how it uses what DenAdvisor shows it about its own customers: feedback, display names, visits and rewards (see Section 5), the offers and messages it chooses to send through DenAdvisor, and anything it does outside DenAdvisor. For this information DenAdvisor acts as the business’s service provider (processor): we store and process it to provide the Service to that business, and for no unrelated purpose.
Where to send requests: because businesses cannot see your contact details, they usually cannot look you up. Send privacy requests about anything you gave through DenAdvisor to us at [email protected]. We handle them directly and tell the business where needed (see Section 12).
3. Information we collect
3.1 Customers (feedback, rewards and loyalty)
- Feedback: your star rating (1 to 5), comments, any private feedback you send the business, which business and location it is about, and whether you clicked through to a public review site. We do not record your IP address or your device’s location with your feedback.
- Email address and name (optional): if you enter your email to receive a reward, offers or a reply from the business. A name is optional.
- Messages: messages a business sends you about your feedback through DenAdvisor, and your replies.
- Loyalty and rewards: your loyalty card at each business, punches, the time and business location of each visit, any purchase amount staff record, rewards and deal codes issued to you and when they are used.
- Reward-abuse check: when a thank-you reward is issued, we keep a scrambled (keyed hash) form of the IP address it was requested from, with that reward, so a business can limit how many rewards one connection collects in a day. We delete it after 30 days.
- At the counter: to find or start your loyalty card, staff can scan your card’s QR code (which contains your email address) or type your email address or phone number. DenAdvisor stores it; it is not shown to staff afterwards.
- We do not ask for your birthday, payment details, government ID or any other sensitive information.
3.2 App users
- Account: your email address (for passwordless sign-in), if you give it your name, and a record of when you agreed to our Terms and this policy and which versions.
- Wallet: the loyalty cards, rewards and deals linked to your email address at the businesses you use. If you used the same email on a business’s feedback page before you made an account, those records appear in your wallet.
- Settings: your notification switches (all push, deal alerts, loyalty updates, and opt-in review reminders).
- Device: a push token issued by Apple or Google if you allow notifications, and the device platform (iOS or Android).
- Location (optional): if you allow location access while using the app, the app sends your current location to our servers to sort nearby businesses by distance. We do not save it in our database (it can appear briefly in our hosting provider’s request logs), and the app does not collect location in the background.
- Camera: used only to scan QR codes on your device. No photos are stored or sent.
3.3 Business users
- Account: name, email address, password (held by our authentication provider in hashed form; we never see it), your role and the businesses and locations you can access, and a record of when you agreed to our Terms and this policy, which versions, and the IP address and browser or app you used.
- Sign-in security: one-time email codes for multi-factor sign-in (stored only in hashed form), sign-in times, and security events such as failed sign-ins with IP address and user agent.
- Business profile: business name, address, phone, email, category, description, hours, review-site links, social links, logo and photos, average sale amount, and your reward, loyalty and offer settings. Business profiles and images are shown publicly in the app and on the feedback page.
- Team: email addresses of people you invite and their roles.
- Billing: your plan, billing interval, subscription status and trial dates, and Stripe customer and subscription IDs. Card details are entered into Stripe’s form and go directly to Stripe. We can read limited card details from Stripe (brand, last four digits, expiry) to show them to you and warn you before a card expires.
- Alerts and preferences: your alert switches (new feedback, low ratings, private feedback and customer replies, redeemed codes, billing, daily summary), how you want them sent, your phone’s time zone offset for the daily summary, and your alert inbox.
- Support: support tickets and the messages in them.
3.4 Everyone, including website visitors
- Request and security data: IP address, browser or device type, user agent, pages or API endpoints requested, and timestamps. Our hosting and security providers log these, and we record security events.
- Contact form: your name, email, phone number and message.
- We do not use analytics, advertising or social-media tracking tools on the website or in the app.
4. How we use information
- Provide the Service: deliver feedback to the business, issue and check reward and deal codes, run loyalty cards, show the app wallet and nearby businesses, and run business dashboards and reports.
- Send emails you need: reward and deal codes, redemption receipts, messages a business sends you about your feedback, team invitations, sign-in codes, trial, billing and renewal notices, and support replies.
- Send a business’s offers to its customers when the business asks us to, unless the customer has unsubscribed (see Section 7).
- Send push notifications and alerts that you have allowed.
- Process subscriptions and payments through Stripe.
- Keep the Service secure: authenticate users, require multi-factor sign-in, limit request rates, keep audit logs, and prevent fraud and abuse such as reward farming.
- Keep a record that you agreed to our Terms and this policy.
- Answer support requests and reports of concerns, fix problems and improve the Service.
- Review business profiles and images before they are shown publicly.
- Comply with law and enforce our Terms of Service.
We do not use personal information for targeted advertising or third-party behavioral profiling, we do not sell it, and we do not send feedback to outside AI or large-language-model services.
5. What a business can see about its customers
A business, and the team members it invites, can see only its own customers. Staff can be limited to particular businesses, and some information is visible only to managers and above.
| Information | Visible to the business? | Details |
|---|---|---|
| Ratings, comments and private feedback you send | Yes | Shown with your display name |
| Your messages and replies about your feedback | Yes | The text only, not your email address |
| Your name | Partly | Shown as first name and last initial (for example “Maya K.”), or “Customer #3F2A” if you gave no name. Staff at the counter see your first name only. |
| Visits, loyalty punches, amounts staff record, rewards and redemptions at that business | Yes | Only your activity with that business |
| Groups such as “new”, “regular” or “at risk” | Yes | Based on your visits to that business |
| Your email address, phone number or birthday | No | DenAdvisor keeps these and contacts you on the business’s behalf |
| Your activity at other businesses, your app account or your location | No | Each business sees only its own customers |
DenAdvisor staff with platform-administrator access can see customer contact details to run and support the Service. Their access requires multi-factor sign-in and their actions are logged.
7. Emails, messages and notifications
Offers from businesses
If you give your email to a business through DenAdvisor, for example for a reward, by joining its loyalty card or by claiming one of its deals, that business can send you its offers by email through DenAdvisor. We send them for the business without revealing your address to it. If you leave your email only so the business can reply to your private feedback, we use it only for replies, not offers.
- Each offer email names the business it is from, includes the business’s postal address, and has an easy one-click unsubscribe link.
- Unsubscribing takes effect immediately and applies to that business. Other businesses you have given your email to are not affected.
- You will still receive emails about things you already have, such as your reward code or a redemption receipt.
- If you asked us to delete your information, or never to send you offers, no business can send you offers through DenAdvisor, even if you give it your email address or phone number again (Section 11).
- We use offer emails only to deliver the business’s offer. We do no third-party behavioral profiling or advertising tracking.
Messages about your feedback
A business can reply to your feedback through DenAdvisor, whatever rating you gave. We email the message to you with a private link (valid for 30 days) where you can read it and reply. Your reply goes back to the business in DenAdvisor. Replies cannot contain reward codes or offers.
Push notifications
- App users can turn all notifications off, or turn off deal alerts or loyalty updates, in the app. Reminders to leave feedback after a visit are off unless you turn them on.
- Business users choose which alerts they get, for both email and push, in their notification settings. Staff do not receive business alerts.
- You can also turn notifications off in your device settings.
Service emails
We send account, security, billing and legal notices that you cannot unsubscribe from while you have an account, because they are needed to run it.
9. Automated processing
- Feedback themes: a keyword-based tool on our own servers labels feedback as positive, neutral or negative and picks out themes (such as service or wait time) for the business’s reports.
- Customer groups: visit frequency and recency at a business place customers in groups such as new, regular, loyal or at risk, which the business can use to choose who gets an offer.
- Reward value: if a business sets a discount range, the reward value within that range is based on the customer’s visit history with that business.
None of these is based on the star rating you give, none decides whether you receive a reward you were promised, and none has a legal or similarly significant effect on you.
10. How long we keep information
We keep information only as long as we need it for the purposes in this policy. We do not yet delete inactive accounts on a fixed schedule.
| Information | How long we keep it |
|---|---|
| Business user account and profile | Until the account is deleted |
| Business data (profile, locations, images, offers, loyalty programs, team) | While the account exists. If the owner cancels and chooses to delete data, it is deleted when the subscription ends. Accounts whose trial or subscription has ended are kept, so the owner can come back, until the owner deletes the account or asks us to. |
| Customer records, feedback, messages, visits and rewards at a business | Until the business or its account is deleted, or until you ask us to delete them (then handled as Section 11 describes) |
| Consumer app account (login, name, app notification settings, device tokens) | Until you delete the account |
| Record of your agreement to our Terms and Privacy Policy (versions, time, IP address, browser or app) | For the life of the account, plus 3 years after it is deleted. After deletion we keep it with your user ID and email address replaced by scrambled (hashed) values. |
| Scrambled (hashed) IP address kept with a thank-you reward, to limit rewards per connection | 30 days, then deleted automatically |
| Security and audit logs (sign-ins, admin actions, IP address, user agent) | 24 months, then deleted automatically. When an account is deleted sooner, its log entries are disconnected from it. |
| Our hosting and security providers’ request logs | A limited period set by each provider (Section 6) |
| In-app notification history | Until the related account or customer record is deleted |
| Reply links in emails | Stop working 30 days after they are sent |
| Multi-factor sign-in codes | Stored only in scrambled (hashed) form, valid for 5 minutes, then removed |
| Rate-limit counters | Held briefly in server memory or a cache, not in our database |
| Support tickets and contact-form messages | Until the related account is deleted, or until you ask us to delete them |
| Records of privacy requests (what was asked, how we checked it was you, and what we did) | 24 months after the request is closed, then deleted automatically |
| Do-not-contact list: a scrambled, one-way copy of the email address (and phone number, if given) of people who asked us to delete their information or never to send them offers | Until you ask us to remove it, so you are never sent offers again. It is not deleted automatically (Section 11). |
| Billing records | Stripe keeps invoices and payment records. We keep the Stripe IDs that link them to your account, and records needed for tax and accounting law. |
| Backups | Deleted data can stay in our database provider’s backups for a limited period before it is overwritten |
We may keep de-identified or aggregated statistics that cannot reasonably be linked to you.
11. Deleting your account and data
Deleting your app or business account
In the app: Profile → Settings → Delete Account. Deletion is immediate and permanent.
- App users and team members: deletes your login, profile, app notification settings and device tokens. Records a business holds about you as its customer (feedback, loyalty cards, rewards) are not removed by this; ask us to delete them as described below.
- Account owners: also deletes every business on the account with its feedback, customer records, offers, loyalty programs and cards, locations and team access, and ends the subscription at once without a refund. There is no self-service export, so contact us first if you need a copy.
- We keep the record of your agreement to our Terms and this policy for 3 years after the deletion, with your user ID and email replaced by scrambled values (Section 10).
Asking us to delete your information at every business
Email [email protected] with the subject “Privacy request”, or follow our account deletion page. This works whether or not you have an account. We apply the deletion rights of the California Consumer Privacy Act to everyone who asks, wherever they live and whether or not that law applies to us. Within 45 days of receiving your request, once we have verified it:
- we delete your contact details (email address, phone number and name) and the text you wrote (comments, private feedback and replies to businesses) at every business;
- we keep only de-identified information for each business’s reports: counts, such as visits, punches and rewards used, and star ratings. These can no longer be linked to you;
- we keep a scrambled copy of your email address, and of your phone number if you give it with your request, on our do-not-contact list. This is so no business can send you offers through DenAdvisor again, even if you give that email address or phone number to a business later. It is scrambled one way, so it can’t be turned back into your address: we can only use it to check an address someone gives us. Rewards, codes and messages you ask for yourself are still sent. We keep it until you ask us to remove it; if you want offers again, email [email protected] and we will remove it;
- unused rewards, deal codes and loyalty punches linked to you stop working;
- we tell you when it is done, and tell you if the law requires us to keep anything.
Deleted data can stay in backups for a limited period before it is overwritten.
Businesses that cancel
A business that cancels can choose “delete my data when the subscription ends”. Its business data is then deleted when the subscription ends.
12. Your choices and privacy rights
Whatever state you live in, you can ask us to:
- Access the personal information we hold about you, and get a copy in a portable format.
- Correct inaccurate information. App users and business users can edit their profile themselves.
- Delete your information (see Section 11).
- Opt out of the sale of personal information, targeted advertising and profiling with significant effects. We do none of these.
Residents of California and of other states with comprehensive privacy laws (including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia) have these rights under their state law to the extent it applies. We honor these requests for everyone. We will not discriminate against you for using them.
How to make a request
- Email [email protected] with the subject “Privacy request”, or use our contact form.
- Verification: we confirm that you control the email address on the account or record, for example by replying from it or using a link we send. We may ask for more if needed, and we use it only to verify you.
- Authorized agents may make a request for you with your signed permission. We may still ask you to confirm your identity with us.
- Timing: we respond within 45 days. If we need more time, we will tell you why, and take up to 45 more days where the law allows.
- Appeals: if we decline your request, you can appeal by replying to our decision within 45 days. We will answer the appeal within 60 days. If you are not satisfied, you can contact your state attorney general.
Requests about a business’s records
For information you gave through DenAdvisor, contact us and we will handle it (see Section 2). For information a business holds outside DenAdvisor, contact the business directly.
Other choices
- Unsubscribe from any business’s offers with the link in its email, or ask us at [email protected] never to send you offers from any business (you can ask us to undo this later).
- Change notification switches in the app, or turn off notifications, location or camera access in your device settings.
13. Notice for California residents
In the last 12 months we collected the categories of personal information below. We have not sold any of them, or shared any for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the information of anyone under 16.
| Category | Examples | Sources | Purposes | Disclosed for a business purpose to | Retention |
|---|---|---|---|---|---|
| Identifiers | Name, email address, phone number (if you give it at the counter), account ID, IP address, device push token | You, your device, business staff at the counter | Accounts, rewards, messages, security | Service providers. Businesses see a display name only. | See Section 10 |
| Customer records (Cal. Civ. Code §1798.80) | Name, email, phone, limited card details for business billing (brand, last four digits, expiry) | You, Stripe | Accounts, billing | Service providers | See Section 10 |
| Commercial information | Plan and payment history; rewards, deals and redemptions; visits; amounts staff record; loyalty activity | You, businesses, Stripe | Running the Service, billing, business reporting | The business you interact with (your activity there only); service providers | See Section 10 |
| Internet or network activity | Request and security logs, user agent, a hashed IP address kept with rewards, in-app activity | Your device | Security, fraud and reward-abuse prevention, troubleshooting | Hosting and security providers | See Section 10 |
| Geolocation | Approximate or precise device location, only if you allow it in the app | Your device | Sorting businesses by distance | Not disclosed | Not stored |
| Professional information | Business name, your role, business contact details | Business users | Running business accounts | Service providers. Business profiles are public. | See Section 10 |
| Inferences | Feedback themes and sentiment, customer groups by visit pattern | Derived from feedback and visits | Business reporting | The relevant business | Same as the underlying data |
| Feedback and messages | Ratings, comments, private feedback, replies | You | Delivering feedback and messages to the business | The relevant business | See Section 10 |
Sensitive personal information: the only sensitive personal information we collect is account sign-in credentials, plus precise location only if you allow it in the app (used at the moment you search and not stored). We use them only to provide the Service, not to infer characteristics about you, so the right to limit their use does not apply.
You can make requests as described in Section 12.
14. Children and teens
- The Service is not directed to children. You must be at least 13 to use the app or leave feedback, and at least 18 to use a business account.
- If you are 13 to 17, a parent or guardian must agree to our Terms for you. A parent or guardian can ask us to see or delete a teen’s information at [email protected].
- We do not knowingly collect personal information from children under 13. If we learn that we have, we delete it. If you believe a child under 13 has given us information, contact [email protected].
15. Security
- Encryption in transit (HTTPS/TLS) and encryption at rest by our database provider.
- Business-level access controls: every request is checked against the businesses the user may access, and customer contact details are withheld from business users.
- Multi-factor sign-in by email code, on by default for account owners and required for DenAdvisor platform administrators.
- Sign-in sessions in the app are kept in the device’s secure storage.
- Rate limits on sign-in, codes, claim codes and public forms; single-use reward codes checked and redeemed in one locked database step.
- Audit logs of security events and administrative actions.
- Uploaded images are checked against their declared file type, and new images for a live business are reviewed by our team before they appear publicly.
No system is completely secure. If a breach affects your personal information, we will notify you and the authorities where the law requires, and we will notify affected businesses without undue delay.
16. Where we operate
DenAdvisor is operated from the United States, and information is stored and processed in the United States. The Service is intended for users in the United States and is not directed to people in the European Union or the United Kingdom. If you use it from outside the United States, your information will be processed in the United States, where privacy laws may differ from those where you live.
17. Changes to this policy
We review this policy at least once a year. When we change it, we post the new version here with a new date and version. If a change is material, we will tell account holders by email or in the app before it takes effect and, where the law requires, ask for your consent. Changes apply going forward only.
18. Contact us
DenAdvisor (operated by VertexSpot LLC)
Mail: VertexSpot LLC, 920 US 64 W, Apex, NC 27523
Privacy requests and questions: [email protected] (subject “Privacy request”)
Billing: [email protected]
Contact form: denadvisor.com/about#contact
Delete your account: denadvisor.com/delete-account
What changed in this version
October 12, 2026:
- When you ask us to delete your information, we now keep a scrambled, one-way copy of your email address (and phone number, if you give it) so you are never sent offers again. You can ask us to remove it (Sections 7, 10 and 11).
- Section 10 now says we keep records of privacy requests for 24 months after they are closed.
October 7, 2026:
- Section 11 now says exactly what happens when you ask us to delete your information: contact details and everything you wrote are deleted within 45 days, and only de-identified counts and star ratings stay for the business’s reports.
- Section 10 adds how long we keep the hashed IP address used against reward abuse (30 days) and the record of your agreement to our Terms (the account’s lifetime plus 3 years).
- We no longer accept a device location with feedback.
- Clearer wording on legal requests, Global Privacy Control, offer emails and teens.