Privacy Policy
Last updated: October 14, 2026
This Privacy Policy explains how Li Weifeng ("we", "us", "our"), the operator of ReviewKiln (the "Service") available at https://reviewkiln.withchandra.com, collects, uses, shares and protects personal data. If you have questions, contact us at support@withchandra.com.
We are based in China. For the purposes of the EU/UK General Data Protection Regulation ("GDPR"), we are the controller of account and website data, and a processor of the review content you upload on your behalf (see Section 4).
1. Summary
- We only analyze reviews you upload or paste. We do not scrape Amazon or any other marketplace.
- Raw uploaded files are deleted automatically 30 days after upload.
- Review text is sent to AI model providers only to generate your results, under terms that prohibit them from using it to train their models.
- We do not sell personal data and do not use your content to train our own AI models.
- Payments are handled by Creem, our Merchant of Record. We never see your full card details.
2. Data we collect
a) Account data — name (optional), email address, login method (e.g., Google sign-in identifier), password hash if applicable, team membership.
b) Billing data — Creem processes your payment and collects your payment details, billing address and tax information. We receive limited information from Creem, such as your customer ID, plan, subscription status, country and transaction records.
c) Content you provide ("Customer Content") — CSV files and pasted text containing product reviews (for example rating, title, body, date, variant), product names or identifiers (such as ASINs or SKUs) you enter, and the reports and listing drafts generated from them. Reviews may contain personal data of third parties (e.g., reviewer names). Our importer excludes reviewer-name columns by default and we apply automated redaction of obvious identifiers such as email addresses and phone numbers, but you should avoid uploading personal data that is not needed.
d) Usage and technical data — IP address, browser and device type, pages visited, feature usage, error logs and approximate location derived from IP. We use privacy-friendly analytics and only strictly necessary cookies (e.g., to keep you logged in). If we ever use non-essential cookies, we will ask for consent where required.
e) Communications — messages you send to support@withchandra.com and your email preferences.
3. How and why we use data (legal bases)
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and manage your account; provide the Service, including analyzing Customer Content and generating reports and listing drafts | Performance of a contract |
| Process subscriptions, quotas and cancellations (with Creem) | Performance of a contract; legal obligation |
| Send service emails (e.g., report ready, billing notices, policy changes) | Performance of a contract |
| Security, fraud and abuse prevention, debugging | Legitimate interests |
| Improve the Service using aggregated, de-identified usage statistics | Legitimate interests |
| Product news and marketing emails (you can opt out anytime) | Consent or legitimate interests, as permitted by law |
| Comply with legal, tax and accounting obligations | Legal obligation |
We do not use Customer Content to train AI models, and we do not make decisions producing legal or similarly significant effects about you based solely on automated processing.
4. Customer Content and your responsibilities
You decide what reviews to upload and why. For personal data contained in Customer Content, you are the controller and we process it on your instructions to provide the Service. You confirm that you have the right to upload and process this content, including that you obtained it in compliance with the terms of the platform it came from. A Data Processing Addendum (DPA) is available on request at support@withchandra.com.
5. Subprocessors and sharing
We share data only with service providers that help us run the Service, under contracts that require them to protect it:
| Provider | Purpose | Data |
|---|---|---|
| Creem (creem.io) — Merchant of Record and reseller | Checkout, payments, taxes, invoices, subscription management, customer portal | Billing and transaction data, email |
| Cloudflare, Inc. | Hosting, database, file storage, queues, CDN, security | All Service data |
| Our AI model providers | AI processing to generate analyses and listing drafts | Review text and product context you submit (no billing data) |
| Our email delivery provider | Transactional emails | Email address, message content |
| [Error monitoring, e.g., Sentry] | Error tracking | Technical data, limited account identifiers |
| Our analytics provider | Privacy-friendly website analytics | Aggregated usage data |
AI providers process data via their business/API offerings, which do not use API inputs to train their models by default and retain inputs only for limited periods (e.g., for abuse monitoring) according to their terms. We will update this list when subprocessors change; material changes will be notified by email or in-app.
We may also disclose data (a) if required by law or valid legal process, (b) to protect our rights, users or the public, or (c) to a successor in a merger, acquisition or asset sale, subject to this Policy. We do not sell or rent personal data, and we do not "share" it for cross-context behavioral advertising as defined by the CCPA/CPRA.
6. International transfers
Our providers may process data in the United States and other countries. Where personal data from the EEA, UK or Switzerland is transferred to countries without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum) or the EU-U.S. Data Privacy Framework where the provider is certified.
7. Retention
- Raw uploaded files: deleted automatically 30 days after upload.
- Reports, extracted review data and listing drafts: kept until you delete them or close your account.
- Account data: kept while your account is active; deleted within 30 days after account deletion.
- Backups: rolling backups are overwritten within 35 days.
- Billing records: kept as long as required by tax and accounting law (Creem keeps its own records as Merchant of Record).
- Logs: typically kept up to 90 days.
You can delete individual projects, uploads and reports at any time in the app, and delete your account in Settings → Account.
8. Security
We use TLS encryption in transit, encryption at rest provided by our infrastructure, per-account access controls, least-privilege credentials and regular updates. No system is perfectly secure; if a data breach affects your personal data, we will notify you and authorities as required by law.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, export (portability), restrict or object to processing of your personal data, and to withdraw consent at any time. California residents may request to know, delete and correct personal information and will not be discriminated against for exercising these rights. To exercise your rights, email support@withchandra.com; we will respond within the time required by law (generally within 30 days). You may also lodge a complaint with your local data protection authority.
If your personal data appears in reviews uploaded by one of our customers, please contact that customer first; we will assist them in responding to your request.
10. Children
The Service is intended for businesses and is not directed to anyone under 16. We do not knowingly collect personal data from children.
11. Changes
We may update this Policy. We will post the new version with an updated date and notify you of material changes by email or in-app before they take effect.
12. Contact
Li Weifeng Longshan Tingyuan, Ping'an Subdistrict, Handan (Shexian County), Hebei, 056400, China Email: support@withchandra.com