ReviewFlow
Privacy policy
Last updated 8 August 2026.
ReviewFlow records your screen and your voice, so this policy is mostly about one question: what actually leaves your computer? The short answer is your voice and the words you said. Not the picture.
Who is responsible
ReviewFlow is operated by a sole trader in the United Kingdom, who is the data controller for the purposes of the UK GDPR.
- Contact: support@reviewflow.review
- Postal address: Office 20611, 182-184 High Street North, East Ham, London, E6 2JA, United Kingdom
What the app sends, and what it keeps back
When you finish a recording, ReviewFlow extracts the microphone track and sends only that for transcription. The transcript text is then used to work out which moments you were pointing at something on screen. Both steps need words; neither needs the image.
| Data | Sent off your machine | Purpose |
|---|---|---|
| Microphone audio | Yes | Speech-to-text transcription |
| Transcript text | Yes | Identifying which moments to capture, and titling the review |
| Screen recording (video) | No | Stays in the session folder on your machine |
| Screenshots | No | Cut from the local recording on your machine |
| Cursor positions | No | Used locally to draw the ring on each screenshot |
Nothing you record is used to train any model. The account that transcribes your audio is opted out of model training and benchmarking, so the recording is transcribed and nothing more. The provider that reads your transcript text is contractually prohibited from training on customer content. Your screen recording and screenshots never leave your machine at all, so the question does not arise for them.
Account data
We hold as little as the product can work with:
- Your email address, so you can sign in and we can reach you about the service.
- Whether your subscription is active, and the reference our payment provider uses for you.
- One record per computer you have signed in on, so you can sign out of one without signing out of the others. It holds no name, no location and nothing identifying the machine - only a random token and when it was last used.
We do not count how many recordings you make or how long they are.
We do not see or store your card details. Payment is taken by our payment provider, which acts as merchant of record and holds that information itself.
How long things are kept
- Audio: never written to disk by us. It is streamed straight through to the transcription provider, which deletes it 30 days after it arrives, on a timer we set rather than one we have to remember to run.
- Transcript text: never stored by us either - it is passed through, and your own copy stays on your machine. The provider's copy is deleted on the same 30-day timer.
- Account records: kept while your account is open, and for six years after your last payment where tax law requires it.
This website
No cookies, no analytics, and nothing stored on your device. There is no banner asking permission because there is nothing to ask about.
We do run ads, and we count whether they work. If you arrive from one, its link carries the name of the ad in the address bar, and we add one to a tally: on this day, this ad brought this many visits and this many downloads. That tally is the whole record. It holds no identifier, no address, and nothing that could be traced back to you or joined to anything else - which is also why there is nothing here for us to hand over, delete, or lose. Arriving any other way is counted not at all.
Who processes data on our behalf
| Provider | What it handles | Where |
|---|---|---|
| Speech-to-text provider | Transcribing your audio | United States |
| Language model provider | Selecting moments from transcript text | United States |
| Cloud hosting provider | This website, the service the app talks to, and the account database | Western Europe |
| Email provider | Sending your sign-in emails | Ireland |
| Payment provider | Subscriptions, invoices, tax. Merchant of record. | United States / Ireland |
Where a provider is outside the UK, transfers are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
We will name any of these on request - email support@reviewflow.review. They are described by role here rather than by name so that changing supplier is not a change to this policy.
Why we are allowed to process it
- Performance of a contract for everything needed to deliver the product: your account, your subscription, and processing a recording you chose to make.
- Legitimate interests for keeping the service secure and diagnosing crashes, balanced against keeping those records minimal and short-lived.
- Legal obligation for retaining financial records.
We do not use your data for advertising, and we do not sell it.
Your rights
Under the UK GDPR you can ask for a copy of your data, correct it, delete it, take it elsewhere in a portable form, or object to processing based on legitimate interests. Email support@reviewflow.review and we will respond within one month.
If you think we have handled your data badly, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first.
Children
ReviewFlow is a developer tool and is not intended for anyone under 16.
Changes
If this policy changes in a way that affects what leaves your machine, we will email you before it takes effect rather than quietly updating the date.