Privacy policy

This policy explains what personal data CandorRated (candorrated.com and its community at community.candorrated.com) collects, why, who we share it with, how long we keep it and what rights you have. In this policy "we" and "us" mean CandorRated. Questions: privacy@candorrated.com.

What we collect

• Account details: name, username, email address and a scrambled (hashed) password. Optionally a profile photo, short bio and country. If you sign in with Google we receive your name and email address from Google.
• What you publish: reviews (including the date of your experience), replies, questions, answers, votes and reports. Reviews and posts are public and show your name and username.
• Business owners: the work email address used to verify a claim, and the details you add to your company page.
• Proof in disputes: files you upload to support a review. Only our moderators can see them.
• Messages you send through the contact form (name, email address, message).
• Technical data: to fight fake reviews and spam we keep a one-way scrambled code (a salted hash) of your network address and of its wider network range — not the address itself. Our web host keeps standard server logs for a short time for security.

Why we use it

• To run your account and publish what you write (our agreement with you — the Terms of use).
• To keep reviews trustworthy: detecting fake accounts, self-reviews, duplicates and coordinated attacks (our legitimate interest, and yours as a reader).
• To send emails you need: confirming your address, password resets, the outcome of your review, replies and notifications (community notification emails can be turned off in Account settings).
• To answer messages and legal requests, and to meet legal obligations.

We do not sell personal data, we do not use it to target advertising, and we do not use tracking or advertising cookies. Sponsored placements are the same for every visitor.

Who we share it with

• The public: anything you publish, with your name and username.
• Service providers who process data for us: our web host and email provider (Hostinger), and Cloudflare Turnstile, which checks that forms are filled in by a person and processes technical signals from your browser for that purpose. Google, if you choose to sign in with Google.
• Authorities, when the law requires it (for example a court order).

How long we keep it

• Account data: while your account exists.
• Reviews and posts: while they are published. If you delete your account, they stay on the site but are shown as written by "Former member", with your name, username, email, photo, bio and country removed.
• Network codes used against fraud: 12 months after your last activity.
• Contact messages: 24 months. Dispute proof: 6 months after the dispute is closed.

Your rights

You can see and correct your details in Account settings, download all your data as a file, and delete your account there yourself. You can also ask us to correct or erase data, withdraw consent, or nominate someone to act for you, by emailing privacy@candorrated.com or using the contact form. Under India's Digital Personal Data Protection Act, 2023 you may complain to us (grievance@candorrated.com) and then to the Data Protection Board of India. If you are in the EU or UK you also have the rights given by the GDPR, including complaining to your local data protection authority.

Children

CandorRated is not meant for anyone under 18, and we do not knowingly collect data about children.

Security

Passwords are hashed, the site uses encrypted connections (HTTPS), staff accounts use two-factor sign-in, and uploaded images are re-processed to remove hidden data such as location.

Changes

We will update the date at the top of this page when the policy changes, and email account holders about important changes.