Privacy Policy

1. Who we are and what this policy covers

Grades.com is operated by Melen, LLC, a New Jersey limited liability company ("Grades.com", "we", "us"). This policy covers everything we run under the Grades.com name: this website, the dashboard at my.grades.com, the API at app.grades.com, the MCP server at mcp.grades.com, the Grades.com directory at reviews.grades.com, review pages, badges and the emails we send.

It does not cover review sites, AI assistants or other services you reach through Grades.com or connect to it, such as Google, Yelp, Facebook, Claude or ChatGPT. Their own privacy policies apply.

2. Our two roles

• We decide how the data is used (we are the "controller") for: your account and your team's accounts; website visitors and people who contact us; the Grades.com directory, including the public review data and business facts it is built from; claims, correction and removal requests; and AI answers about businesses.
• We work for the business (we are its "processor" or "service provider") for personal information a business gives us or collects through us about its own customers: contact lists for review requests, messages sent through its review page's feedback form, and the reviews, replies and notes in its account. We use that information only to provide the service to that business and as it instructs. If you are one of that business's customers, please contact the business; we will pass your request on to it and help it respond. Our Data Processing Agreement sets out these commitments for business customers.

3. What we collect

From you

• Account details: your name, email address, phone number if you give it, password (stored only as a hash), your role and the businesses you belong to.
• Business details: business name, locations, addresses, phone numbers, website, hours, categories, descriptions and photos, your settings, tone and reply rules for the review agent, replies, notes and edits to a directory listing.
• Billing details: plan, invoices and billing status. Card details go straight to our payment processor (Stripe); we only receive a reference and limited details such as the card brand and the last four digits.
• Contacts you upload for review requests (names, email addresses, phone numbers) and records of the messages sent, opt-outs and consent you give us. We process these for you (section 2).
• Claims and requests: when you claim a listing, the email address the code went to, a keyed hash of the code, your note and contact phone if you give them, and our decision. When you send a correction or removal request: your name, email, relationship to the business and what you tell us.
• Questions and support messages: if you write to us or use a question or support form, your name, email address and message. An AI assistant answers routine questions and our team handles the rest.
• Reviews left on Grades.com: if you write a review on a business's Grades.com review form, your name, your email address (used only to send the confirmation link), the rating, the text, and any photos or video you add. We keep these as part of the review, which is published on the business's profile only if the business uses Public mode and you confirm your email address. The email address is not shown. You can ask us to remove your review or delete your details at any time. If you also tick the separate box that allows the business to share your video review, we record that permission (the date and the version of the wording you agreed to) and prepare a copy of your video for the business with your first name and last initial, your rating and your review text as captions. You can withdraw that permission at any time by writing to support@grades.com; we then delete those copies and tell the business.
• Connected review-site accounts: when you connect an account so that we can act on a review site for you, the signed-in session (cookies), stored encrypted, the account label, and a screenshot record of each action. We never store the account's password.
• Sign-in to AI clients and the API: the AI clients you approved (client name and redirect address), access grants, and API keys (stored only as a hash).

Collected automatically

• Logs and device data: IP address, browser and device type, pages and API endpoints requested, and times, for running and securing the service.
• Audit records: who did what in an account (for example who approved a reply, created a key or changed a setting).
• Cookies as described in section 9.
• Badge loads: the website a badge was shown on (the referring domain) and a daily count. Badges set no cookies.
• Directory forms: a keyed hash of the sender's IP address (not the address itself), to limit abuse.

From public sources and other companies

• Reviews from review sites: the reviewer's name or username and profile photo as the site shows them, the rating, text, date, any owner reply, and the site. We keep a copy of reviewer profile photos to show them in the dashboard.
• Business facts from public listings, business websites, public registers, and data providers, and photos a business uploaded to its own Google Business Profile. Business facts sometimes include a person's name, for example a dentist's or a lawyer's.
• AI answers: what AI assistants (ChatGPT, Gemini, Claude, Perplexity and Google's AI Overview) answered to fixed questions about a business, the sites they cited and the competitors they named.
• Search results and web pages that mention a business's reviews (Review Radar), and public pages we use to check facts.
• From connected accounts: when you connect a Google Business Profile or a Facebook page, the reviews, replies and business details those platforms give us through their APIs.

4. How we use it

• To provide the service: collect and show reviews, draft and post replies, prepare and file reports you approved, run AI Reputation, the Competitor Map and Review Radar, send alerts and digests, run the MCP server and API.
• To publish the directory: build business profiles, scores, rankings and review summaries that help people choose a business, as described on the directory's policy pages.
• To bill you and manage plans and trials.
• To communicate: service emails (sign-in, alerts, billing, changes to these documents), the weekly digest (you can turn it off) and, with an unsubscribe link, occasional news about Grades.com.
• To keep the service safe: prevent fraud, abuse, fake reviews and spam; secure accounts; investigate problems.
• To improve the service, mostly from statistics that do not identify anyone.
• To meet legal obligations and enforce our Terms of Service.

If the GDPR or UK GDPR applies to you, our legal bases are: performing our contract with you (the service, billing); our legitimate interests, in particular publishing a public directory of businesses so that people can compare them, and running and securing the service, balanced against your rights; your consent where we ask for it (for example for cookies); and legal obligations.

5. AI processing

• To draft replies and report drafts, classify reviews, check drafts against your rules and summarize reviews, we send review text, the business's details and your instructions to the AI models listed in section 7. We do not send account passwords, payment details or uploaded contact lists to AI models.
• For AI Reputation and the Competitor Map we ask AI assistants fixed questions about a business. Those questions are about the business, not about you.
• We don't train AI models on your data, and our AI providers (OpenAI, Anthropic and Google) process it under paid API terms that don't allow them to train on it.
• Directory scores, grades and rankings are worked out by software from public evidence about businesses. They are decisions about businesses, not about individual people.

6. Who we share it with

• Service providers that process data for us under contract (section 7).
• Review sites, when you post a reply or file a report through Grades.com: the reply or report text goes to that site.
• AI clients you connect (for example Claude, ChatGPT or Cursor): they receive the data they ask for with the access you approved.
• Your team and your agency: people you invite, and an agency that manages your business, see the business's data.
• The public: the directory shows business facts, ratings, review counts, summaries and, where the business connected its own account, reviews with the reviewer's name as the source site shows it. Your review page and the public reviews API show what you publish there.
• For legal reasons: when the law requires it, to respond to valid legal process, or to protect people, our users or us.
• In a business transfer: if the service is sold or merged, to the new owner, under this policy.
• With your consent for anything else.

We do not sell personal information.

7. Service providers

We update this list when we add or replace a provider. The same list, with the data each provider receives and where it works, is on our Subprocessors page.

8. Google, Facebook and other connected accounts

• Grades.com's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Business Profile data only to show your reviews and business details to you and to post the replies you approve.
• You can disconnect Google, Facebook or any other connected account at any time in the dashboard, or revoke our access in that platform's own settings. To have us delete the data we received from a connected Facebook page or Google account, write to the address in section 17 and say which business it is; we delete it within 30 days of your request, except records we must keep by law.

9. Cookies

• Dashboard: cookies that keep you signed in and protect forms. They are needed for the service to work.
• This website (www.grades.com): no analytics or advertising cookies and no tracking scripts.
• The directory and badges set no cookies.

You can block or delete cookies in your browser settings. Blocking dashboard cookies stops you from signing in. We honor Global Privacy Control (GPC) signals as a request to opt out of the sale or sharing of personal information; we do not sell or share it in the first place.

10. How long we keep it

• Account and business data: while the account is open. After an account closes we delete or anonymize it within 90 days, except billing and tax records, which we keep as long as the law requires.
• Reviews in an account: while the account is open. A review that disappears from its site is marked as removed and kept in the account's history.
• Contacts and feedback-form messages: until the business deletes them or its account closes.
• Directory history: scores, monthly rankings, AI answers, competitor snapshots, generated summaries and earlier versions of business facts are kept as dated records, because people check a past grade or ranking later.
• Directory removals: when an owner has a business removed, we delete stored review text, reviewer names and summaries for it within 5 business days. We keep counts and score history (no text, no names) for 12 months, a suppression record so that we do not add the business again by accident, and a record of the request.
• Reviewer requests: if you wrote a review and ask us to remove your name or words from the directory, we do so within 5 business days.
• Questions and support messages: until you ask us to delete them.
• Claims and correction requests: kept as the record of who became an owner, and of each request and our answer.
• Connected review-site accounts: the session until you disconnect; screenshot records for 90 days.
• Logs: about 30 days. Database backups: up to 14 days.

11. Security

We encrypt data in transit, including connections to our database; keep secrets in a managed secret store; store passwords and API keys only as hashes; encrypt connected-account sessions with managed keys; and limit staff access to what their work needs. No system is perfectly secure. If a breach affects your personal information, we will tell you as the law requires.

12. Your rights

Depending on where you live, you can ask us to tell you what we hold about you and give you a copy, correct it, delete it, export it, or stop or limit how we use it, and you can withdraw a consent you gave. Many of these you can do yourself in the dashboard.

• How to ask: write to the address in section 17. We may need to confirm your identity first. We answer within 30 days, or sooner where the law requires.
• Reviewers and businesses in the directory: use Correct or remove a listing. Removing your details from Grades.com does not remove a review from the site where you wrote it.
• Customers of a business that uses Grades.com: contact the business; we help it answer (section 2).
• Appeals and complaints: if you disagree with our answer, reply to it and a second person reviews it. You can also complain to your data protection authority or state attorney general.

13. California and other US states

We apply the standard of the California Consumer Privacy Act, as amended by the CPRA, to everyone in the United States, whichever state you live in. You have the rights in section 12, and the right not to be treated differently for using them. You can use an authorized agent. In the last 12 months we collected the categories of information listed in section 3 (identifiers, commercial information about plans and billing, internet activity, and information about businesses and the reviews written about them), from the sources listed there, for the purposes in section 4, and disclosed them to the recipients in sections 6 and 7. We do not sell or share personal information, do not use it for cross-context behavioral advertising, and do not collect sensitive personal information to infer characteristics about anyone. We are not a data broker: the directory is about businesses, it shows a reviewer's name only as the source review site shows it, and we remove a reviewer's name or words on request.

14. People outside the United States

Grades.com is offered to businesses in the United States, and is run from and stores data in the United States. We do not target people in the European Economic Area, the United Kingdom or Switzerland, and we have no representative there. Where we process personal data of people there for a business customer, the Standard Contractual Clauses in our Data Processing Agreement apply.

15. Children

Grades.com is a service for businesses and is not meant for anyone under 16. We do not knowingly collect information from children. If you believe we have, write to us and we will delete it.

16. Changes to this policy

We may update this policy. We change the effective date at the top, and for a material change we tell account owners by email or in the dashboard before it takes effect.

17. Contact

Privacy questions and requests: