# Review Privacy and Customer Data for Local Businesses > Share only the customer details your review tools need, keep them out of public replies, and know what to do if something goes wrong. Canonical: https://vassalmarketing.com/information/reviews-reputation/review-privacy-and-customer-data/ **Maintained by Vassal Marketing** · Last updated on September 26, 2026 Reviewed at least quarterly and whenever a platform or rule it cites changes. General information, not legal or professional advice. Check rules that affect your business with a qualified professional. Give your review tools only the customer details they need, such as a first name and phone number. Keep private details out of public replies, limit who can see customer records, and delete what you no longer need. ## Why this matters A review request might pull names and phone numbers from your scheduling, invoicing, or point-of-sale system. Replies and disputes can add screenshots, notes, and vendor access. Every time customer details move to a new tool, more people and companies can see them. The FTC advises businesses to know what personal information they have, keep only what they need, protect it, dispose of it properly, and plan for mistakes. For reviews, that means a short written list of what goes where, not an export of your whole customer database into a marketing tool. ## Responsible practices ### Write down where customer details go List each system that sends customer details to a review tool, which details it sends, who can see them, and how long they are kept. One page is usually enough. ### Share the minimum A review request usually needs only a first name, a phone number or email, and the job date. Leave out addresses, job notes, payment details, and anything about health, children, or legal matters. ### Keep private details out of public replies Knowing something about a customer does not make it OK to post. Check every reply for private details before it goes live, and move the conversation to a private channel. ### Limit who has access Give each person and vendor their own login with only the access they need. Turn on two-step verification where available, and remove access promptly when someone leaves. ### Delete what you no longer need Decide how long to keep request lists, screenshots, and exports. Delete them on schedule, including copies in vendor tools and downloads, unless there is a specific reason to keep them. ### Know what to do if something goes wrong Decide ahead of time who pauses sending, removes a wrong reply, changes passwords, and contacts affected customers or advisers. Walk through one practice run, such as a message sent to the wrong customer. ## Worked example: A one-page list of where customer details go Hypothetical example: a two-location salon sends review requests from its booking software through a review tool. The owner writes down each step. ### Booking software to review tool Sends: first name, mobile number, visit date, location. Does not send: services received, notes, birthday, payment details. ### Review tool Who can see it: owner and front-desk manager. Kept for: 90 days, then deleted. Opt-outs are kept so no one gets a second message. ### Public replies Never mention the service, stylist notes, visit time, or anything the customer did not post themselves. ### Dispute screenshots Stored in one folder only the owner can open. Deleted once the report is closed, unless an attorney says to keep them. ### If something goes wrong The owner pauses the review tool, removes the problem reply, changes passwords if needed, and calls the salon's IT or legal adviser. If you can't say where a customer detail goes and why, it probably shouldn't be there. ## Review privacy checklist ### What you can do yourself 1. List every system that sends customer details to a review tool. 2. Remove any detail the review request doesn't need. 3. Give each person their own login with two-step verification. 4. Set a date to delete old request lists and screenshots. 5. Decide who acts first if a message or reply goes wrong. ### What to ask your provider or staff to handle 1. Tell you exactly which customer details their tool collects, where they are stored, and who can see them. 2. Explain how and when they delete your customer data, including when you stop working with them. 3. Tell you promptly about any security problem that affects your customers' details. ## Avoid these mistakes - Uploading your full customer database when the tool needs only names and contact details - Putting appointment, health, address, or payment details in messages, file names, or replies - Sharing one admin password with an agency instead of giving them their own login - Keeping request lists and screenshots forever because no one set a delete date - Assuming a vendor's privacy policy covers how you actually use the tool Customers decide what they write and review sites decide what stays up, so ratings, review counts, and removals are not guaranteed. ## Questions business owners ask ### What customer details does a review request need? Usually just a first name, a phone number or email address, the job date, and whether the customer has opted out. Add anything else only if you have a clear reason. ### Can I mention a customer's records in a reply? Being able to see a detail does not make it OK to publish. A short acknowledgment with a phone number or email for private follow-up is safer. Health, legal, and financial businesses should get qualified advice on their reply policy. ### How long should I keep review screenshots and records? There's no single rule for every business. Set a period for each type of record, delete on schedule, and ask a qualified adviser if legal, insurance, or professional rules require you to keep something longer. ### If I hire a reputation company, are they responsible for privacy? Not entirely. Your business still needs to know what data the vendor uses, who can see it, and how it gets deleted. Check their answers against what the tool actually does. ## Primary guidance - [FTC: Protecting Personal Information—A Guide for Business](https://www.ftc.gov/business-guidance/resources/protecting-personal-information-guide-business) - [FTC: Start with Security—A Guide for Business](https://www.ftc.gov/business-guidance/resources/start-security-guide-business) - [NIST Privacy Framework](https://www.nist.gov/privacy-framework) - [Google Maps: Prohibited and restricted content](https://support.google.com/contributionpolicy/answer/7400114?hl=en) ## Connected guidance - [Replying to reviews](https://vassalmarketing.com/information/reviews-reputation/responding-to-customer-reviews.md): Sample replies that leave private details out. - [Small business website security](https://vassalmarketing.com/information/website-stewardship/small-business-website-security.md): Logins, two-step verification, and access removal for the accounts your review tools connect to. - [Forms, calls, and booking paths](https://vassalmarketing.com/information/website-stewardship/forms-calls-and-booking-paths.md): Make sure the private contact path you offer in replies actually reaches your team.