Privacy Policy
Last updated: October 5, 2026 · Version 2026-10-05
Summary
- Customers: when you leave feedback, get a reward or use a loyalty card, the business sees your feedback, a short display name and your activity with it. It does not see your email address or phone number. DenAdvisor keeps those and contacts you on the business's behalf.
- Rewards never depend on your rating, and every customer is offered the business's public review link, whatever rating they give.
- Businesses: we use account, team and billing information to run your account. Card details go to Stripe, not to us.
- We do not sell personal information, and we do not use it for targeted advertising. Our website and app have no advertising or analytics trackers.
- You can delete your account in the app, unsubscribe from any business's offers with one click, and ask us to see, correct or delete your information at [email protected].
1. Who we are and what this policy covers
DenAdvisor ("DenAdvisor," "we," "us") is operated by VertexSpot LLC in the United States. DenAdvisor helps small businesses collect customer feedback, run digital loyalty cards and offer rewards and deals.
This policy covers our website (denadvisor.com), the business dashboard, our feedback, reply and unsubscribe pages, the emails we send, and the DenAdvisor mobile apps for iOS and Android (together, the "Service"). It applies to three groups of people:
- Customers: people who scan a business's QR code, leave feedback, receive a reward, use a loyalty card or reply to a business's message.
- App users: customers who create a DenAdvisor account in the mobile app to keep a wallet of loyalty cards, rewards and deals.
- Business users: owners, admins, managers and staff who use the dashboard or the app's business tools.
Businesses that use DenAdvisor are separate companies with their own privacy practices. Anything you post on Google or another review site is governed by that site's own terms and privacy policy.
2. Who is responsible for your information
Responsibility is shared between DenAdvisor and each business, and it depends on the information:
- DenAdvisor is responsible for (we are the "business" or "controller"):
- business user accounts, team access and billing;
- app accounts, the app wallet and app settings;
- the contact details customers give through DenAdvisor (email address and, at a loyalty counter, phone number). We keep these, we do not give them to the business, and we use them only to deliver what the customer asked for and the business's messages and offers, as described in Section 7;
- our website, security logs and support requests.
- Each business is responsible for how it uses what DenAdvisor shows it about its own customers: feedback, display names, visits and rewards (see Section 5), the offers and messages it chooses to send through DenAdvisor, and anything it does outside DenAdvisor. For this information DenAdvisor acts as the business's service provider (processor): we store and process it to provide the Service to that business, and for no unrelated purpose.
Where to send requests: because businesses cannot see your contact details, they usually cannot look you up. Send privacy requests about anything you gave through DenAdvisor to us at [email protected]. We handle them directly and tell the business where needed (see Section 12).
3. Information we collect
3.1 Customers (feedback, rewards and loyalty)
- Feedback: your star rating (1 to 5), comments, any private feedback you send the business, which business and location it is about, and whether you clicked through to a public review site.
- Email address and name (optional): if you enter your email to receive a reward or offers. A name is optional.
- Messages: messages a business sends you about your feedback through DenAdvisor, and your replies.
- Loyalty and rewards: your loyalty card at each business, punches, the time and location of each visit, any purchase amount staff record, rewards and deal codes issued to you and when they are used.
- At the counter: to find or start your loyalty card, staff can scan your card's QR code (which contains your email address) or type your email address or phone number. DenAdvisor stores it; it is not shown to staff afterwards.
- We do not ask for your birthday, payment details, government ID or any other sensitive information.
3.2 App users
- Account: your email address (for passwordless sign-in) and, if you give it, your name.
- Wallet: the loyalty cards, rewards and deals linked to your email address at the businesses you use. If you used the same email on a business's feedback page before you made an account, those records appear in your wallet.
- Settings: your notification switches (all push, deal alerts, loyalty updates, and opt-in review reminders).
- Device: a push token issued by Apple or Google if you allow notifications, and the device platform (iOS or Android).
- Location (optional): if you allow location access while using the app, the app sends your current location to our servers to sort nearby businesses by distance. We do not save it in our database (it can appear briefly in our hosting provider's request logs), and the app does not collect location in the background.
- Camera: used only to scan QR codes on your device. No photos are stored or sent.
3.3 Business users
- Account: name, email address, password (held by our authentication provider in hashed form; we never see it), your role and the businesses and locations you can access, and a record of when you accepted our terms and which version.
- Sign-in security: one-time email codes for multi-factor sign-in (stored only in hashed form), sign-in times, and security events such as failed sign-ins with IP address and user agent.
- Business profile: business name, address, phone, email, category, description, hours, review-site links, social links, logo and photos, average sale amount, and your reward, loyalty and offer settings. Business profiles and images are shown publicly in the app and on the feedback page.
- Team: email addresses of people you invite and their roles.
- Billing: your plan, billing interval, subscription status and trial dates, and Stripe customer and subscription IDs. Card details are entered into Stripe's form and go directly to Stripe. We can read limited card details from Stripe (brand, last four digits, expiry) to show them to you and warn you before a card expires.
- Alerts and preferences: your alert switches (new feedback, low ratings, private feedback and customer replies, redeemed codes, billing, daily summary), how you want them sent, your phone's time zone offset for the daily summary, and your alert inbox.
- Support: support tickets and the messages in them.
3.4 Everyone, including website visitors
- Request and security data: IP address, browser or device type, user agent, pages or API endpoints requested, and timestamps. Our hosting and security providers log these, and we record security events.
- Contact form: your name, email, phone number and message.
- We do not use analytics, advertising or social-media tracking tools on the website or in the app.
4. How we use information
- Provide the Service: deliver feedback to the business, issue and check reward and deal codes, run loyalty cards, show the app wallet and nearby businesses, and run business dashboards and reports.
- Send emails you need: reward and deal codes, redemption receipts, messages a business sends you about your feedback, team invitations, sign-in codes, trial, billing and renewal notices, and support replies.
- Send a business's offers to its customers when the business asks us to, unless the customer has unsubscribed (see Section 7).
- Send push notifications and alerts that you have allowed.
- Process subscriptions and payments through Stripe.
- Keep the Service secure: authenticate users, require multi-factor sign-in, limit request rates, keep audit logs, and prevent fraud and abuse such as reward farming.
- Answer support requests, fix problems and improve the Service.
- Moderate business images before they are shown publicly.
- Comply with law and enforce our Terms of Service.
We do not use personal information for targeted advertising, we do not sell it, and we do not send feedback to outside AI or large-language-model services.
5. What a business can see about its customers
A business, and the team members it invites, can see only its own customers. Staff can be limited to particular businesses, and some information is visible only to managers and above.
| Information | Visible to the business? | Details |
|---|---|---|
| Ratings, comments and private feedback you send | Yes | Shown with your display name |
| Your messages and replies about your feedback | Yes | The text only, not your email address |
| Your name | Partly | Shown as first name and last initial (for example "Maya K."), or "Customer #3F2A" if you gave no name. Staff at the counter see your first name only. |
| Visits, loyalty punches, amounts staff record, rewards and redemptions at that business | Yes | Only your activity with that business |
| Groups such as "new", "regular" or "at risk" | Yes | Based on your visits to that business |
| Your email address, phone number or birthday | No | DenAdvisor keeps these and contacts you on the business’s behalf |
| Your activity at other businesses, your app account or your location | No | Each business sees only its own customers |
DenAdvisor staff with platform-administrator access can see customer contact details to run and support the Service. Their access requires multi-factor sign-in and their actions are logged.
7. Emails, messages and notifications
Offers from businesses
If you give your email to a business through DenAdvisor, for example for a reward, by joining its loyalty card or by claiming one of its deals, that business can send you its offers by email through DenAdvisor. We send them for the business without revealing your address to it.
- Each offer email names the business it is from, includes the business's postal address when the business has given one, and has a one-click unsubscribe link.
- Unsubscribing takes effect immediately and applies to that business. Other businesses you have given your email to are not affected.
- You will still receive emails about things you already have, such as your reward code or a redemption receipt.
Messages about your feedback
A business can reply to your feedback through DenAdvisor, whatever rating you gave. We email the message to you with a private link (valid for 30 days) where you can read it and reply. Your reply goes back to the business in DenAdvisor. Replies cannot contain reward codes or offers.
Push notifications
- App users can turn all notifications off, or turn off deal alerts or loyalty updates, in the app. Reminders to leave feedback after a visit are off unless you turn them on.
- Business users choose which alerts they get, for both email and push, in their notification settings. Staff do not receive business alerts.
- You can also turn notifications off in your device settings.
Service emails
We send account, security, billing and legal notices that you cannot unsubscribe from while you have an account, because they are needed to run it.
9. Automated processing
- Feedback themes: a keyword-based tool on our own servers labels feedback as positive, neutral or negative and picks out themes (such as service or wait time) for the business's reports.
- Customer groups: visit frequency and recency at a business place customers in groups such as new, regular, loyal or at risk, which the business can use to choose who gets an offer.
- Reward value: if a business sets a discount range, the reward value within that range is based on the customer's visit history with that business.
None of these is based on the star rating you give, none decides whether you receive a reward you were promised, and none has a legal or similarly significant effect on you.
10. How long we keep information
We keep information only as long as we need it for the purposes in this policy. We do not yet delete inactive accounts on a fixed schedule.
| Information | How long we keep it |
|---|---|
| Business user account and profile | Until the account is deleted |
| Business data (profile, locations, images, offers, loyalty programs, team) | While the account exists. If the owner cancels and chooses to delete data, it is deleted when the subscription ends. Accounts whose trial or subscription has ended are kept, so the owner can come back, until the owner deletes the account or asks us to. |
| Customer records, feedback, messages, visits and rewards at a business | Until the business or its account is deleted, or until you ask us to delete them |
| Consumer app account (login, name, app notification settings, device tokens) | Until you delete the account |
| In-app notification history | Until the related account or customer record is deleted |
| Reply links in emails | Stop working 30 days after they are sent |
| Multi-factor sign-in codes | Stored only in scrambled (hashed) form, valid for 5 minutes, then removed |
| Rate-limit counters | Held briefly in server memory, not in our database |
| Security and audit logs (sign-ins, admin actions, IP address, user agent) | 24 months, then deleted. When an account is deleted sooner, its log entries are disconnected from it. |
| Support tickets and contact-form messages | Until the related account is deleted, or until you ask us to delete them |
| Billing records | Stripe keeps invoices and payment records. We keep the Stripe IDs that link them to your account, and records needed for tax and accounting law. |
| Backups | Deleted data can stay in our database provider’s backups for a limited period before it is overwritten |
We may keep de-identified or aggregated statistics that cannot reasonably be linked to you.
11. Deleting your account and data
- In the app: Profile → Settings → Delete Account. Deletion is immediate and permanent.
- App users: deletes your login, profile, app notification settings and device tokens. Your loyalty cards, rewards and feedback at each business are kept as that business's customer records, linked to your email address. To delete those too, email us (below).
- Account owners: also deletes every business on the account with its feedback, customer records, offers, loyalty programs and cards, locations and team access, and ends the subscription at once without a refund. There is no self-service export, so contact us first if you need a copy.
- By email or the web: follow the steps on our account deletion page, or email [email protected] with the subject "Privacy request". This works whether or not you have an account. We can delete the contact details and records linked to your email address at every business, and we will tell you if anything must be kept by law.
- Businesses that cancel can choose "delete my data when the subscription ends". Their business data is then deleted when the subscription ends.
12. Your choices and privacy rights
Whatever state you live in, you can ask us to:
- Access the personal information we hold about you, and get a copy in a portable format.
- Correct inaccurate information. App users and business users can edit their profile themselves.
- Delete your information (see Section 11).
- Opt out of the sale of personal information, targeted advertising and profiling with significant effects. We do none of these.
Residents of California and of other states with comprehensive privacy laws (including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia) have these rights under their state law to the extent it applies. We will not discriminate against you for using them.
How to make a request
- Email [email protected] with the subject "Privacy request", or use our contact form.
- Verification: we confirm that you control the email address on the account or record, for example by replying from it or using a link we send. We may ask for more if needed, and we use it only to verify you.
- Authorized agents may make a request for you with your signed permission. We may still ask you to confirm your identity with us.
- Timing: we respond within 45 days. If we need more time, we will tell you why, and take up to 45 more days where the law allows.
- Appeals: if we decline your request, you can appeal by replying to our decision within 45 days. We will answer the appeal within 60 days. If you are not satisfied, you can contact your state attorney general.
Requests about a business's records
For information you gave through DenAdvisor, contact us and we will handle it (see Section 2). For information a business holds outside DenAdvisor, contact the business directly.
Other choices
- Unsubscribe from any business's offers with the link in its email.
- Change notification switches in the app, or turn off notifications, location or camera access in your device settings.
13. Notice for California residents
In the last 12 months we collected the categories of personal information below. We have not sold any of them, or shared any for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the information of anyone under 16.
| Category | Examples | Sources | Purposes | Disclosed for a business purpose to | Retention |
|---|---|---|---|---|---|
| Identifiers | Name, email address, phone number (if you give it at the counter), account ID, IP address, device push token | You, your device, business staff at the counter | Accounts, rewards, messages, security | Service providers. Businesses see a display name only. | See Section 10 |
| Customer records (Cal. Civ. Code §1798.80) | Name, email, phone, limited card details for business billing (brand, last four digits, expiry) | You, Stripe | Accounts, billing | Service providers | See Section 10 |
| Commercial information | Plan and payment history; rewards, deals and redemptions; visits; amounts staff record; loyalty activity | You, businesses, Stripe | Running the Service, billing, business reporting | The business you interact with (your activity there only); service providers | See Section 10 |
| Internet or network activity | Request and security logs, user agent, in-app activity | Your device | Security, fraud prevention, troubleshooting | Hosting and security providers | See Section 10 |
| Geolocation | Approximate or precise device location, only if you allow it in the app | Your device | Sorting businesses by distance | Not disclosed | Not stored |
| Professional information | Business name, your role, business contact details | Business users | Running business accounts | Service providers. Business profiles are public. | See Section 10 |
| Inferences | Feedback themes and sentiment, customer groups by visit pattern | Derived from feedback and visits | Business reporting | The relevant business | Same as the underlying data |
| Feedback and messages | Ratings, comments, private feedback, replies | You | Delivering feedback and messages to the business | The relevant business | See Section 10 |
Sensitive personal information: the only sensitive personal information we collect is account sign-in credentials, plus precise location only if you allow it in the app (used at the moment you search and not stored). We use them only to provide the Service, not to infer characteristics about you, so the right to limit their use does not apply.
You can make requests as described in Section 12.
14. Children
The Service is not directed to children. You must be at least 13 to use the app or leave feedback, and at least 18 to use a business account. We do not knowingly collect personal information from children under 13. If we learn that we have, we delete it. If you believe a child under 13 has given us information, contact [email protected].
15. Security
- Encryption in transit (HTTPS/TLS) and encryption at rest by our database provider.
- Business-level access controls: every request is checked against the businesses the user may access, and customer contact details are withheld from business users.
- Multi-factor sign-in by email code, on by default for account owners and required for DenAdvisor platform administrators.
- Sign-in sessions in the app are kept in the device's secure storage.
- Rate limits on sign-in, codes, claim codes and public forms; single-use reward codes checked and redeemed in one locked database step.
- Audit logs of security events and administrative actions.
- Uploaded images are checked against their declared file type, and new images for a live business are reviewed by our team before they appear publicly.
No system is completely secure. If a breach affects your personal information, we will notify you and the authorities where the law requires, and we will notify affected businesses without undue delay.
16. Where we operate
DenAdvisor is operated from the United States, and information is stored and processed in the United States. The Service is intended for users in the United States and is not directed to people in the European Union or the United Kingdom. If you use it from outside the United States, your information will be processed in the United States, where privacy laws may differ from those where you live.
17. Changes to this policy
We review this policy at least once a year. When we change it, we post the new version here with a new date and version. If a change is material, we will tell account holders by email or in the app before it takes effect and, where the law requires, ask for your consent. Changes apply going forward only.
18. Contact us
DenAdvisor (operated by VertexSpot LLC)
Mail: VertexSpot LLC, 920 US 64 W, Apex, NC 27523
Privacy requests and questions: [email protected] (subject "Privacy request")
Billing: [email protected]
Contact form: denadvisor.com/about#contact
Delete your account: denadvisor.com/delete-account