1. OUR PLATFORMS AND SERVICES

Shout About Us, Inc. operates the following platforms:

1.1 Enterprise Infrastructure Platforms

These platforms operate on dedicated cloud infrastructure with enterprise-grade security controls described in Section 5.

• Review Management — our review management infrastructure platform, accessible at shoutaboutus.com and via the SAU Enterprise Dashboard at app.shoutaboutus.com.

1.2 Other Shout About Us Platforms

Shout About Us, Inc. also operates the following platforms, each governed by its own separate privacy policy rather than this one:

• Online Review Manager (Review Navigator) — hosted at online-review-manager.com. Serves direct brands, individual locations, and resellers and their partners under white-label agency accounts. Privacy notice: online-review-manager.com/page/orm/privacy_policy.
• Response Scribe — hosted at responsescribe.com. Privacy notice: responsescribe.com/privacy-policy.

If you're a customer or reseller of Online Review Manager (Review Navigator) or Response Scribe: this policy does not govern your data practices. Please refer to the privacy notice at your platform's login page instead.

2. INFORMATION WE COLLECT

2.1 Through Enterprise Platform Services

When providing Review Management infrastructure services to enterprise partners, we process:

• Contact information of end customers — names, email addresses, phone numbers
• Review content, ratings, and metadata from third-party review platforms
• Platform usage data — API activity, login events, feature usage
• Account information — business names and billing contact details of partner organizations
• Verification data — where a partner asks us to confirm that a reported first-party review submission actually reflects a real interaction (for example, matching a reviewer to a listing, transaction, or address on the partner's behalf), we process the specific data elements necessary to perform that match
• Review content submitted directly by consumers through review collection flows operated by SAU on a partner's behalf, whether presented under the partner's own branding or otherwise

For review content sourced from third-party review platforms: this content is publicly available information originally published by the reviewer on that platform, not information provided to SAU directly. Because this content originates from, and may continue to exist on, that third-party platform, SAU cannot guarantee that its copy remains complete, current, or available if the underlying content changes or is removed independently of SAU.

Supported Platforms (such as Google, Facebook, Yelp, and others) maintain their own separate privacy policies governing how they collect and handle personal information on their own sites. Those practices are outside SAU's control, and this Privacy Policy does not apply to any Supported Platform's own collection or use of personal information.

2.2 Online Review Manager and Response Scribe

Online Review Manager (Review Navigator) and Response Scribe are governed by their own separate privacy policies, not this one. Their data collection, use, and sharing practices are described in those documents, linked in Section 1.2 above.

2.3 From Website Visitors

When you visit shoutaboutus.com, we may collect:

• Usage data — IP address, browser type, pages visited, time on page, referring URLs
• Contact form submissions — name, email address, company name, and message content
• Cookie data as described in Section 8

2.4 From Business Partners

When organizations enter into a commercial relationship with us, we collect:

• Business contact information — names, email addresses, and phone numbers of authorized representatives
• Billing information — company name, billing address, and payment method details (we do not store payment card numbers)
• Communication records — emails, support tickets, and other correspondence

2.5 SMS Opt-In Data

If you opt in to receive SMS messages, we collect your mobile phone number and a record of your consent. This data is used solely to deliver SMS messages you have requested and will not be shared, sold, rented, or transferred to any third party for their own marketing purposes.

2.6 From Employees, Contractors, and Job Applicants

We collect employment-related personal information from current and prospective employees and independent contractors, including:

• Contact information — name, address, phone number, and email address
• Employment history and qualifications — resume, work history, education, and references
• Information necessary to administer the employment or contractor relationship — payroll, benefits, and tax information, and emergency contact details

We use this information solely to evaluate candidates, administer the employment or contractor relationship, and comply with applicable employment law. We retain this information only as long as legally required. California residents who are employees, contractors, or job applicants have the same rights described in Section 11 of this policy.

2.7 Information We Do Not Collect

We do not knowingly collect:

• Payment card numbers (handled by our payment processor)
• Government-issued identification numbers
• Sensitive personal information such as health data or biometric data
• Personal information from children under 13 years of age

3. HOW WE USE PERSONAL INFORMATION

We use personal information only for the purposes for which it was collected. We never sell personal information to third parties, and we never use personal information for automated decision-making that produces legal or similarly significant effects on individuals without human review.

4. HOW WE SHARE PERSONAL INFORMATION

We share personal information only in the following circumstances:

4.1 With Sub-processors

We engage trusted third-party service providers to assist in delivering our services. All sub-processors are bound by Data Processing Agreements. Our current sub-processors include:

We maintain a current sub-processor list and will notify our enterprise partners at least 30 days before engaging any new sub-processor that processes their customers' personal data.

4.2 With Business Partners

For enterprise platform services, we share personal information with the partner organization on whose behalf we are processing that data, in accordance with our contractual terms. At a partner's direction, review content may also be publicly displayed through embeddable widgets on websites operated by the partner's own end customers (for example, an individual business embedding its reviews on its own website). The underlying data remains hosted on our infrastructure; the widget only displays it within the end customer's page.

4.3 For Legal Compliance

We may disclose personal information if required to do so by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect rights, protect safety, or investigate fraud.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will notify affected parties prior to any such transfer.

4.5 No Sale of Data

We do not sell, rent, or lease personal information to any third party for their own marketing or commercial purposes.

4.6 Aggregated and De-Identified Data

We may create aggregated or de-identified information from personal information we process, such as industry benchmarking data, sentiment trends, or usage statistics, from which individuals can no longer reasonably be identified. We may use and share this aggregated or de-identified information at our discretion, including with partners and for our own analytics and product development, since it is no longer personal information.

5.  DATA SECURITY

We implement and maintain appropriate technical and organizational security measures to protect personal information. Our security posture differs across our platform types.

5.1 Enterprise Platform Security

Our enterprise infrastructure platform, Review Management, operates on dedicated cloud infrastructure with the following controls:

• Data Encryption — all data encrypted in transit using TLS 1.2 or higher, and encrypted at rest using industry-standard encryption methods.
• Access Controls — role-based access controls enforcing least-privilege principles, with multi-factor authentication (MFA) required for all personnel with access to live platform environments.
• Network Security — perimeter protection and continuous threat detection monitoring.
• Secrets Management — credentials and API keys managed through a dedicated secrets management system.
• Monitoring and Logging — comprehensive audit logging and application-level monitoring.
• Security Assessment — annual third-party penetration testing is conducted.

5.2 Other Shout About Us Platforms

Online Review Manager (Review Navigator) and Response Scribe are hosted on separate infrastructure and maintain their own security practices, described in their respective privacy policies linked in Section 1.2 above.

No method of transmission over the internet is completely secure. In the event of a security incident affecting personal information, we will notify affected parties and relevant regulatory authorities without undue delay, and in the case of EEA and UK supervisory authorities, within 72 hours of becoming aware of the incident where feasible, in accordance with applicable law.

6.  OUR ROLE AS CONTROLLER AND PROCESSOR

Shout About Us acts in different capacities depending on the nature of the data relationship:

Data Processor (Enterprise Platform Services). When providing enterprise infrastructure services, SAU acts as a data processor operating on behalf of the partner (the data controller). We process personal information solely in accordance with our partners' documented instructions and our contractual terms.

Data Controller (Website). When operating shoutaboutus.com, SAU acts as the data controller responsible for determining the purposes and means of processing personal information. Online Review Manager (Review Navigator) and Response Scribe describe their own controller and processor roles in their respective privacy policies.

Data Controller (Business Partner Relationship Data). When collecting business contact information, billing details, and account administration information directly from our partner organizations to establish and manage our commercial relationship with them, SAU acts as the data controller of that information. This is separate from the personal information we process on a partner's behalf regarding their own end customers, described above.

7. DATA RETENTION

We retain personal information for as long as necessary to fulfill the purposes for which it was collected and to satisfy legal, regulatory, and contractual requirements.

When personal information is deleted from our active systems, we work to remove it as quickly as reasonably possible. Some information may continue to exist for a limited period in encrypted backup copies before being permanently purged in the ordinary course of our backup rotation schedule.

8. COOKIES AND TRACKING TECHNOLOGIES

Our website at shoutaboutus.com uses cookies and similar tracking technologies to improve your browsing experience and analyze website traffic.

You can control cookie preferences through your browser settings. We do not use cookies for cross-site advertising or behavioral tracking.

9. SMS/TEXT MESSAGING AND OPT-IN DATA

Program Name: ORM

SAU delivers SMS messages to platform users and end customers who have opted in, including review solicitation requests, account notifications, and service updates. The following applies to all SMS communications sent by or through SAU:

• No Sharing of Opt-In Data: No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the above categories exclude text messaging originator opt-in data and consent. This information will not be shared with any third parties.
• Collection:  We collect mobile phone numbers and opt-in consent records when users register for SMS communications through account settings or registration. SMS opt-in is voluntary and separate from account registration.
• Use:  Phone numbers are used exclusively to deliver SMS messages users have opted to receive. They are not used for advertising or shared with advertising partners.
• Storage and Protection:  Phone numbers are stored securely within our platform infrastructure and protected by the security controls described in Section 5. SMS messages are delivered via Bandwidth Inc., our carrier service provider, which is bound by a Data Processing Agreement with SAU.
• Carrier Liability: SMS delivery is dependent on effective transmission by mobile network operators and upstream telecommunications carriers. Neither SAU nor its carrier partners (including Bandwidth Inc.) are liable for delayed, undelivered, or blocked messages resulting from carrier filtering, network conditions, or recipient device limitations. Delivery is not guaranteed.
• Communications Metadata: To route SMS messages, SAU shares transaction data with telecommunications carriers including source and destination phone numbers, IP addresses, message timestamps, and delivery logs. This sharing is required for message delivery and does not constitute a sale of personal information.
• Opt-Out:  You may opt out of SMS communications at any time by replying STOP to any message or contacting support@shoutaboutus.com. Full opt-out instructions are also set forth in the End User License Agreement presented at login.
• Help: Reply HELP to any SMS message or contact support@shoutaboutus.com.
• Supported Carriers: Major US carriers including AT&T, Verizon, T-Mobile, and others. Carrier support may vary.

10. INTERNATIONAL DATA TRANSFERS

Shout About Us is headquartered in the United States. Personal information is primarily stored and processed in data centers in the United States.

Australian Residents.  For personal information transferred from Australia to the United States, we have implemented contractual protections equivalent to the Australian Privacy Principles under the Privacy Act 1988 (Cth), consistent with the requirements for cross-border disclosure under APP 8.

EEA and UK Residents.  For personal information transferred from the European Economic Area or the United Kingdom to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable.

EU/UK Representative. SAU has not appointed an Article 27 representative under the GDPR or UK GDPR, as it does not currently process EEA, UK, or Swiss personal information at a scale that requires one. This will be addressed prior to any engagement that changes that.

11. YOUR PRIVACY RIGHTS

To exercise any of these rights, contact us using the details in Section 13. EEA and UK residents will receive a response within one month of a verified request, extendable to three months for complex requests. California residents will receive a response within 45 days of a verified request, extendable by an additional 45 days where necessary. Australian residents will receive a response within a reasonable period as required under the Privacy Act 1988.

11.1 Australian Residents (Privacy Act 1988 / APPs)

• Access — request access to personal information we hold about you
• Correction — request correction of inaccurate or incomplete personal information
• Complaint — lodge a complaint with the OAIC at www.oaic.gov.au

11.2 EEA and UK Residents (GDPR / UK GDPR)

• Access, rectification, erasure, restriction, and portability of your personal information
• Object to processing based on legitimate interest
• Withdraw consent at any time where processing is based on consent
• Lodge a complaint with your local supervisory authority

11.3 California Residents (CCPA / CPRA)

• Know, delete, and correct personal information we have collected
• Opt out of sale or sharing — we do not sell or share personal information for cross-context behavioral advertising. We honor Global Privacy Control (GPC) signals as a valid opt-out preference signal where applicable
• Limit use of sensitive personal information as defined under CPRA
• Non-discrimination — we will not discriminate for exercising your rights

11.4 All Users

• Opt out of marketing communications by clicking unsubscribe in any marketing email or contacting us directly
• Access and correction requests — we will respond to reasonable requests

Third-party review content: For review content originally published on a third-party platform, SAU's copy reflects what was publicly available at the time of collection. Individuals seeking correction or removal of a specific review should contact the platform where it was originally posted, as that is the authoritative source of the content.

Enterprise partner customers: If you are a customer of one of our enterprise partners, your privacy rights should be exercised directly with that partner, who acts as the data controller for your personal information. We will cooperate with our partners in fulfilling such requests.

12. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. We will post the updated policy at shoutaboutus.com/privacy-policy with a revised "Last Updated" date.

For material changes, we will provide at least thirty (30) days notice to our business partners and customers via email.

13. CONTACT US

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or wish to make a complaint:

Regulatory Contacts

Australian privacy complaints: Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au | 1300 363 992

GDPR complaints: Your local supervisory authority in the EU or UK.

California privacy complaints: California Privacy Protection Agency (CPPA) — cppa.ca.gov

PLATFORM QUICK REFERENCE

All Shout About Us, Inc. platforms and how they relate to this Privacy Policy: