Privacy Policy

1. Data we collect

Account. When you sign in (Google sign-in or an email magic link), we store your email address, the name from your provider, and the public @handle and display name shown on your activity.

Your contributions. The ratings and comments you post, and the reputation and Beecoins they earn. These are public by design (your display name and @handle are shown next to them).

Browser extension. When you click the Ratebee icon on a page, the extension reads that page's URL (and minimal public page metadata, e.g. schema.org markup) and sends it to our API to identify the business or product on that page so you can rate it. The extension uses the activeTab permission — it only accesses the page you are actively on, only when you click, and never reads your browsing in the background. Broad host access is optional and requested only if you grant it.

Usage analytics. To count unique visits we store a salted one-way hash of your IP address (never the raw IP) together with a coarse country code. These hashes are deduplicated per day and deleted after 90 days; only anonymous aggregate counts are kept after that.

Cookies. A sign-in session cookie (essential) and, if you arrive via a referral link, a short-lived referral cookie. No third-party advertising cookies.

2. Why we use it (legal bases)

• To provide the service — show ratings, let you post and manage your contributions (performance of a contract).
• Account & sign-in — based on your request/consent.
• Abuse prevention, moderation and analytics — our legitimate interest in keeping the platform trustworthy and understanding usage (using pseudonymous, short-lived data).
• Legal compliance where applicable.

3. Automated moderation & translation

Comments are checked on submission and can be translated on request using an AI provider (Anthropic). The comment text is sent for that processing only; it is not used to train models and is not sold. Suspicious comments are held for a human moderator.

4. Who we share it with (processors)

We do not sell your data. We use a small set of service providers, EU-region where possible, who process data on our behalf:

• Neon — PostgreSQL database hosting (Frankfurt, EU).
• Vercel — website hosting (Frankfurt, EU).
• Railway — API hosting (EU West).
• Scaleway — transactional email, e.g. magic-link sign-in (France, EU).
• Google — optional sign-in (OAuth).
• Anthropic — AI moderation and translation of comment text.

Where a provider processes data outside the EU, it is done under appropriate safeguards.

5. Retention

Account data is kept until you delete your account. Visit-analytics hashes are deleted after 90 days (aggregate counts are kept). Comment translations are cached to avoid re-processing.

6. Your rights

Under the GDPR you can access, correct, export, restrict or object to the processing of your data, and withdraw consent. You can delete your account yourself at any time on your profile page (choosing whether to keep or erase your contributions). You may also lodge a complaint with your supervisory authority — in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon).

7. Children

Ratebee is not directed at children under 16, and we do not knowingly collect their data.

8. Security

Data is hosted in the EU where possible; IP addresses used for analytics are stored only as salted hashes; access to administrative tools is role-restricted.

9. Changes

We may update this policy; we will revise the date above when we do.

10. Contact

The data controller is Valikvali Software OÜ (Estonian registry code 14245550), Estonia. Questions or requests: use the feedback form or email info@ratebee.app.