Privacy policy

1. Who is responsible

This policy explains how RateGate handles personal data, in line with the EU General Data Protection Regulation (GDPR) and French data protection law.

• For data of our clients (shop owners) and of people who use our contact form, RateGate is the data controller.
• For feedback left by customers rating a shop, the shop is the data controller, and RateGate processes the data on the shop's behalf.

2. If you rate a shop

What we collect: your star rating and the time you gave it. If you send a private message, we also collect your message, the topics you select, and only if you choose to enter them, your phone number or email address. To prevent abuse, your IP address is used briefly in the server's memory to limit repeated submissions. It is not stored with your rating.

Why: so the shop can understand its customers' experience, improve, and reply to you if you asked for it. Legal basis: the shop's legitimate interest in improving its service, and your consent when you leave contact details.

Who sees it: only the shop you rated (and our technical team, strictly when needed to operate the service).

Google: if you choose to leave a public review, you are sent to Google. What you post there is public and governed by Google's own privacy policy.

3. If you are a client (shop owner)

What we collect: your email address, an encrypted version of your password (we never see your actual password), your business details (name, type, city, colours, Google review link), payment records (amounts and dates of your licence and maintenance payments), and the dates of your last logins.

Why: to provide your account and the Service, manage payments, keep your account secure, and contact you about the Service. Legal bases: performance of our contract with you, our legal accounting obligations, and our legitimate interest in securing the Service.

4. If you contact us

We collect your name, email, and optionally your phone number, business name and message, only to answer you and, if you wish, to provide the Service. Legal basis: our legitimate interest in answering requests, or steps taken at your request before a contract. We never add you to marketing lists.

5. How long we keep data

• Ratings and private messages: as long as the shop's account exists. Everything is deleted when the account is deleted.
• Client accounts: while the Service is used. Deleted after the end of the Service or non-payment.
• Payment records: as long as required by French accounting law (up to 10 years), without the rest of the account data.
• Contact form messages: up to 12 months after our last exchange, unless you become a client.
• Technical security logs: a few weeks at most.

6. Who we share data with

We never sell or rent personal data and we show no advertising. Data is only shared with our hosting provider, which stores it on our behalf under a data processing agreement. If a provider is located outside the European Union, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses. We may disclose data if the law requires it.

7. Cookies

We use one essential session cookie that keeps you logged in and protects our forms against misuse, and one that remembers your chosen language. They contain no advertising or tracking information and do not require consent. The customer rating page does not set cookies. We do not use analytics or advertising cookies.

8. Security

Data is transmitted over encrypted connections (HTTPS). Passwords are stored with strong one-way hashing, access to the administration area is restricted, and we apply regular security updates. No system is perfectly secure: if a breach affects your data, we will inform you and the authorities as required by law.

9. Your rights

You have the right to access, correct and delete your data, to restrict or object to its processing, and to receive it in a portable format. If you rated a shop, you can contact the shop directly or contact us and we will pass your request on. To exercise your rights, use our contact form. We may ask you to confirm your identity. We answer within one month.

If you are not satisfied, you can file a complaint with the French data protection authority, the CNIL (cnil.fr).

10. Children

The Service is not directed at children, and we do not knowingly collect data from children under 15.

11. Changes

We may update this policy. The date at the top shows the latest version. Significant changes will be announced to clients.