Effective date: October 25, 2026
This document is provided in English. If this translation conflicts with the English version, the English version controls.
Laudiva is operated by AI Augmented Software Development LLC, a Florida limited liability company ("we," "our," or "us"). Laudiva is an AI-powered Google Reviews widget platform that helps businesses collect, surface, and display their best Google Reviews on their websites.
This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and your rights regarding that information. By using Laudiva, you agree to the practices described here.
Laudiva is currently offered only to businesses in the United States.
When you create an account, we collect your name and email address via Google OAuth. We do not store your Google password.
We collect the name of your business or organization, the country it operates in, and the website domains you associate with your widget.
Billing is processed by Stripe. We do not store your credit card number, CVV, or full card details. Stripe provides us with a payment method token, last four digits, card brand, the country that issued the card, and subscription status. We use the card's issuing country and the business country you declare at signup to confirm eligibility for the service.
We collect your IP address, browser type, and session tokens to authenticate your account and protect against fraud. Session tokens are stored in a single HTTP-only cookie (see Section 6).
When you visit laudiva.ai, app.laudiva.ai or one of our other Laudiva websites, your browser sends us one usage record per page you view, plus the page's load-performance timings: the page address (with account and other identifiers removed), its title, the website that referred you (the site's name only, not the full address), your preferred browser language (taken from the request header), your country and region (derived by Cloudflare from your IP address, which is not kept with the record and is held for about a minute in a rate-limit counter), and your browser, operating system and device type (derived from the browser's user-agent header, which we do not store). We assign no visitor or session identifier, set no cookie for the counting itself and store nothing in your browser for it, and we do not share these records with anyone. Cloudflare keeps the raw records for three months; our self-hosted analytics tool keeps them for up to 13 months. To keep our statistics accurate and our service secure, we also classify each request as automated or internal using the user-agent header and the network that owns the connecting IP address; this happens at the edge and the network name is not stored, and the IP address is not kept with the record (it is held for about a minute in a rate-limit counter). For automated traffic we keep only that class and, for a known crawler, its name from a fixed list. A Laudiva team member can mark their own browser with a cookie so that their visits count as internal (see the Cookie Policy). Our legal basis is our legitimate interest in understanding and improving our own websites (Art. 6(1)(f) GDPR). You can opt out at any time: stop counting my visits. We also honor the Global Privacy Control signal (and the Sec-GPC header) from your browser and treat it as the same opt-out.
We also keep product-usage records so we can understand how Laudiva is used and support you. When you are signed in, certain actions in the dashboard (for example creating a widget, connecting a review source or starting an upgrade) are recorded together with your organization's identifier and, for some actions, the identifier of the business or widget involved. When you sign up or sign in, our servers record that event, the sign-in method (such as Google) and, for sign-ups, the page that referred you; when you complete a checkout, they record the plan and billing cycle, never a name, email address, amount or payment detail. On our marketing site we record clicks on key buttons such as starting a free account or watching the demo. These records are not shared with anyone. Records that carry your organization's identifier are kept for about three months; an event's business or widget identifier, where it has one, is also passed with the event to our analytics tool, which keeps events for up to 13 months. Your opt-out (or Global Privacy Control) covers all of these records: your browser sends nothing (page views, load timings and button and dashboard events), and our servers do not record your sign-up, sign-in or checkout while the browser you use for it has opted out (for a checkout, at the moment you start it).
We scrape publicly posted reviews from Google Maps on your behalf using your business's Google Maps listing. This data — reviewer display names, star ratings, and review text — is public information already visible to anyone on Google. We store it to build and serve your widget. If you are the author of one of these reviews — not a Laudiva account holder — and want your name removed or the review taken down, see Section 8.
If you connect your Google Business Profile, you authorize us (via Google OAuth) to: (a) fetch your reviews directly through Google's API on your behalf, and (b) monitor your listing for changes if your plan includes that feature. We store an encrypted refresh token to maintain this connection, protected with the same encryption used for other sensitive credentials in our systems. Removing the connected Google account entirely from your account settings deletes the stored token and revokes our access at Google on a best-effort basis; disconnecting an individual business location only stops that location from using the connection.
When the widget loads on your website or a visitor interacts with it, our widget embed script sends us a usage event: the widget was shown, a review scrolled into view, or the visitor clicked a link, a review photo, a location, a filter or the "Powered by Laudiva" badge. Each event records the widget and the review, location or filter choice involved, your website's domain, and the browser, operating system and device type, which we derive from the browser's user-agent header without storing the header itself. We also count widget visitors by country (derived by Cloudflare from the visitor's IP address) and by preferred browser language, in separate count records that carry no session or review identifier. Cloudflare's analytics store stamps each record with the time it was written, so a country and language count record shares that time with the event record written alongside it. Cloudflare keeps these records for three months; our long-term store keeps these counts only as daily totals. The widget sets no cookies and assigns no session or visitor identifier. If your website uses our site-wide embed code, the widget also sends us the full address of the page it appears on, including any query string or fragment, so we can decide which widgets to show on that page. To limit the rate of requests to our widget servers, we keep a keyed hash of the visitor's IP address, which is deleted from our live database within about 70 minutes (like other deleted data, it can remain in our encrypted database backups for up to 70 days); we do not store the raw IP address of widget visitors. If you configure your own Google Analytics 4 Measurement ID or Google Tag Manager Container ID in your widget settings, the widget also forwards widget views, review views, link clicks, badge clicks and filter clicks directly from your visitor's browser into your own GA4 property or Google Tag Manager container. This only happens if you provide your own ID; Laudiva does not load Google's scripts itself, and this forwarded data never passes through Laudiva's servers.
Some review cards show a reviewer's profile picture, or a video and its preview image, that Google hosts. When a widget on your website shows one, the visitor's browser requests that file directly from Google, so Google receives the visitor's IP address and browser details such as the user-agent header. For profile pictures and video preview images, the browser is told not to send the address of the page it is on. A review video is requested only when the visitor chooses to play it, and that request may identify your website. Review photos are not loaded from Google: Laudiva copies them and serves them itself. When a reviewer's profile link is not an image address, the widget shows the reviewer's initials and makes no request to Google.
We do not sell your personal information. We share data only with the following processors, strictly to operate the service:
| Recipient | Purpose |
|---|---|
| Stripe | Payment processing and subscription management |
| Amazon Web Services (Amazon Bedrock) | AI review scoring, negative-review urgency triage, translation, insight summaries, business summaries, widget setup assistance (natural-language configuration, category-label normalization, and the site-scan wizard's recommendations and business-profile extraction), and scoring-weight calibration for new business categories — our AI provider. Requests route through our own self-hosted AI gateway to Amazon Bedrock, which runs the model for us by In-Region AWS inference in the United States (first in the us-east-1 region, then in us-west-2 if that region is unavailable). Amazon Bedrock does not store our prompts or the model's output and does not use them to train any model, and processes them under the AWS Data Processing Addendum. The data sent can include review text, star rating, source, and published date (never the reviewer's name); your business name and Google Business Profile category (including secondary categories); any scoring guidance you write for your business; page titles, descriptions, and headings from your own website when our site-scan feature reads it, together with page addresses, the content management system it appears to use, and the names and layouts of the Laudiva widgets you have already created for that business; free text you type into our AI setup assistants; and category labels and highlight phrases derived from your reviews; and the language your widget is translated into, when a review is translated. The specific model and regions are runtime-configurable and may change. |
| Fetching your reviews, and (for plans that include that feature) monitoring your listing for changes, via your connected Google Business Profile — only for organizations that connect one | |
| Apify | Google Maps review scraping on your behalf |
| Cloudflare | Content delivery and edge hosting for widget files and review photos (R2, CDN, Workers), bot protection on our signup and login forms (Turnstile, which briefly sees your IP address), pseudonymous, aggregate usage analytics (Analytics Engine), and short-lived rate-limiting keys that briefly hold the IP addresses of visitors to Laudiva's own websites and forms, not of visitors to the widget on your website (KV, short TTL). For organizations with our edge search feature provisioned, review content is also mirrored to a Cloudflare D1 database to speed up in-widget filtering |
| Bunny.net | Secondary CDN for our public embed script (embed.js), served to the browsers of website visitors whose site still carries a previously installed fallback install snippet; it can receive those visitors' IP addresses and request metadata. |
| Amazon SES | Email delivery: account, billing and alert emails to account holders; review-request emails to your customers when you send them; digests, product updates and waitlist emails. |
| Amazon SNS | SMS delivery (transactional alerts to account holders who have opted in) |
| Amazon Web Services (S3) | Encrypted backups of our databases (the main database and widget usage analytics), stored in Amazon S3 in the United States. Data deleted from our live systems may persist in these backups for up to 70 days |
| Discord | Internal operational alerts. Alerts carry internal identifiers and error codes; error text is filtered and rarely includes a business name. No payment card data. |
| Migadu-Mail GmbH | Mail handling for our privacy@/support@/legal@ inboxes — the channel you use to exercise your data subject rights |
| Hosting provider | Our application and databases run on dedicated servers in the United States, operated by a third-party hosting provider |
Where these providers rely on their own subprocessors, those subprocessors may be subject to the providers' own data protection terms.
We may disclose information if required by law or to protect the rights and safety of our users.
| Data | Retention |
|---|---|
| User accounts | Until deletion request or 90 days after subscription cancellation |
| Sessions | 7 days |
| Review data | Until the associated business is deleted from your account |
| Widget analytics | 12 months raw / 24 months aggregated |
| Website and app usage analytics | Cloudflare: 3 months; our analytics tool: up to 13 months |
| Audit log | 24 months |
After you cancel your subscription, your account and data remain available during a 90-day grace period. After 90 days, your account is eligible for deletion.
Even after data is deleted from our live systems, it may persist in encrypted database backups for up to 70 days before those backups themselves expire.
Laudiva sets a few first-party cookies — for authentication, language preference, consent detection and to remember your analytics opt-out (plus, for Laudiva team members only, an internal-traffic marker). Our own usage analytics set no cookie. We do not use advertising cookies or third-party tracking cookies. For the full list of cookies we set, their purpose, and how long each is kept, see our Cookie Policy, which is the single source of truth for cookie details.
The Laudiva widget embed script that runs on your visitors' websites sets no cookies of any kind.
To avoid re-validating your website's domain and re-issuing an access token on every page view, the widget embed script caches that validation response in visitors' browser local storage for up to 4 minutes. This is not a cookie — it contains only widget and organization identifiers and a short-lived access token, never anything that identifies an individual visitor, and it expires automatically. Separately, when a placement's target selector matches nothing on a page, the embed keeps one more entry in local storage: the widget identifier, the page path and the CSS selector, mapped to the time of the last report. Unlike the entry above, it has no expiry; it is used to send at most one report a day. The widget also sends us an error report containing that selector, the page path, the widget identifier and your website's domain. It is kept in our error log until 30 days after the last such report once resolved, or up to 90 days after the last such report if not, and is deleted at our next weekly cleanup after that.
Laudiva offers optional SMS notifications to account holders who provide a mobile number, verify it via one-time passcode, and check the SMS consent box in their dashboard settings. Messages are transactional and tied to alert preferences you select (negative review alerts and Google Business Profile listing changes). Frequency depends on review activity at your business — typically 0–10 messages per week.
Reply STOP to opt out at any time, or HELP for assistance. Standard message and data rates from your carrier may apply. Consent to SMS is not required to use Laudiva, and you can disable SMS in Settings → Notifications without losing access to any other feature.
We do not share mobile numbers or SMS opt-in status with third parties or affiliates for marketing purposes. Phone numbers are processed only by Amazon Web Services (AWS SNS) for delivery. SMS opt-in data is stored with your account preferences and deleted when you delete your account.
If you wrote a Google review of a business that uses Laudiva, and Laudiva stores and displays a copy of that review, Laudiva is an independent controller of that stored copy — separate from Google and separate from the business you reviewed. Your right to object to or request removal of that copy runs against Laudiva directly. It is not conditioned on deleting or editing the review at its original source.
You may request one of two remedies for any review that names you:
To make a request, email privacy laudiva.ai or use our self-service review removal form (available in English, Spanish, French, German, and Portuguese), which is also linked from every review we display. Either way, we email a confirmation link to the address you give us. Clicking it shows only that you control that mailbox — it does not remove or change anything by itself, and the review stays visible while a member of our team reviews your request. We may ask you for more information to verify that you wrote the review, and we email you our decision. If we remove the review, our systems remember the removal so a later re-sync of your business's Google reviews does not bring it back.
We respond to removal requests without undue delay, and in any case within one month. A member of our team reviews each request made by email or through the form before we act on it, and some need additional verification — we will tell you if yours does, and explain why. The one exception is a reviewer who proves authorship by editing their own Google review to carry the marker phrase shown on our review removal form: we act on that automatically the next time we see the edited review. A review's star rating is never a reason to honor or refuse a removal request; our abuse checks record it as one signal, alongside things like request volume, for the person who reviews the request, and it never decides a request by itself.
You also have the right to object to Laudiva's processing of your review (GDPR Article 21) and to request its erasure (Article 17) using the same channels above.
This section is written for people whose Google reviews Laudiva stores and displays on behalf of a business — not for Laudiva account holders (see Sections 2–8 for that). Because we did not collect this data directly from you, GDPR Article 14 requires us to tell you the following:
We do not attempt to contact every review author individually — doing so is not practicable given how this data is collected, at the scale it is collected. Instead, we publish this notice here and provide a public means (Section 8) for any review author to find and act on it. GDPR Article 14(5)(b) allows this "publicly available information" approach in place of individual notice when direct contact is disproportionate; this is our current position and remains subject to ongoing legal review.
If you are a California resident, you have the right to know what personal information we collect and how it is used, and the right to request deletion of your personal information.
Laudiva does not sell or share personal information as defined by the CCPA.
To submit a data request, email privacy laudiva.ai.
Laudiva's infrastructure is located in Kansas City, USA (AdvinServer).
Review text and the other data listed in Section 4 are also sent to our AI provider, Amazon Bedrock (Amazon Web Services), which processes each request by In-Region AWS inference in the United States (in the us-east-1 region, or in us-west-2 if that region is unavailable). Amazon Bedrock does not store our prompts or the model's output and does not use them to train any model.
Laudiva is not directed to children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us through our contact form and we will delete it.
We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page and may notify you by email if the changes are material. Continued use of Laudiva after changes are posted constitutes your acceptance of the updated policy.
For privacy inquiries, data requests, or questions about this policy, contact us at:
privacy laudiva.ai
AI Augmented Software Development LLC, d/b/a Laudiva
Registered Agents Inc, 7901 4th St N STE 300
St. Petersburg, FL 33702, USA