Legal
Privacy policy.
Last updated: 7 July 2026
that review app is operated by That Review App Pty Ltd ("we", "us"). We run performance reviews for Australian small businesses, which means businesses trust us with information about their staff. This page says exactly what we collect, why, where it lives, and how to get it removed. No legalese where plain English will do.
What we collect
From the business owner who creates the account:
- Your email address and password (the password is hashed — we never see it).
- Your business name and, if you upload one, your logo.
- Billing details are handled by Stripe. We never see or store card numbers.
About employees, entered by their employer:
- Name and email address (required — that's where review links go).
- Optionally: phone, date of birth, start date, address, and emergency contact — only if the employer chooses to record them.
- Review content: self-assessment and manager responses, ratings, meeting notes, and digital signatures, including the signing device's IP address and a timestamp (that's what makes the signature meaningful).
Why we collect it
One reason: to run performance reviews and produce the signed record both parties agreed to. We don't sell data, we don't build advertising profiles, and we don't use review content to train AI models.
Where it lives
Data is stored with Supabase (our database and file storage) in their Sydney, Australia region, and the application runs on Vercel. Emails are sent through Resend. Payments run through Stripe. Each of these providers processes data on our behalf under their own security and privacy commitments.
How long we keep it
Signed reviews are retained for seven years — that's the point of the product. Employment records of this kind carry long retention expectations in Australia, and a review you can't produce later is a review that didn't happen.
Everything else (draft reviews, archived employees, account data) is deleted when you delete it, or when the account closes.
Your rights
If you're an employee whose review lives in our system, your employer is the one who put it there — start with them. Under the Privacy Act 1988 (Cth) you can also contact us directly to access or correct information we hold about you.
Business owners can export any review as a PDF at any time, and can request full account deletion via contact.
Questions or complaints
Write to us via the contact page. If you're not happy with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).