Checkout
Selected plan, contact details, deposit and activation status, subscription status, and transaction identifiers are connected to a private WordPress purchase record.
Card details stay with Stripe.DATA HANDLING & SECURITY
What goes where, and why.
This page gives clients a practical view of the information used in each QCR workflow. It supplements the Privacy Policy and does not replace the accepted Client Services Agreement.
Last updated: November 4, 2026Agreement
Business details, authorized representative, acceptance time, selected package, and exact agreement version are used to record checkbox acceptance and link it to verified payment. Existing signed agreement records are retained.
Completed copies go to QCR and the client.Onboarding
Business contacts, Google profile information, access status, goals, customer-list status, and setup notes are used to create the portal and plan fulfillment.
Access is limited to service delivery.Texting registration is completed through a private task in the same client account. Business identity, EIN where applicable, authorized-contact and opt-in-process details are encrypted, reviewed by QCR and shared with the messaging provider as needed for verification. Tax numbers and private form answers are not included in setup-notification emails.
Client portal
The portal stores QCR scores, review baselines, competitor comparisons, progress, reports, priorities, and billing entitlement.
Each client account is access controlled.Review intelligence
Public review text and relevant business context may be processed by an authorized AI provider to identify specific patterns and draft analysis.
QCR requires human review before publishing.CRM add-on
Authorized users may enter customer contact, appointment, service, price, tip, employee, status, and note information. Core review-request workflows use necessary customer and visit details in QCR’s automation system and messaging provider.
CRM data is not used for unrelated clients.Access controls
QCR uses separate customer accounts, private client pages, role-based WordPress permissions, signed post-payment setup sessions, and verified Stripe webhook events. Clients are responsible for protecting their own login credentials and promptly reporting suspected access issues.
Data minimization
Do not upload payment card details, Social Security numbers, medical records, account passwords, or unrelated sensitive information. Customer fields in the CRM should be limited to information needed for appointments, service tracking, authorized follow-up, and team reporting.
Service providers
QCR selects providers based on the function required and limits information shared to that function. Key providers may include Stripe, the website host and WordPress, email delivery providers, Google services, Render, Twilio, Backblaze, Resend or configured email providers, connected booking or CRM providers, and OpenAI. Provider availability and policies can change, and material changes will be reflected in the Privacy Policy.
Backups and continuity
Website and automation data use separate scheduled backups and private off-host storage. Backups expire through their retention cycles; they are not indefinite archives or a guarantee of uninterrupted service. Recovery depends on the available backup and the system affected. Email copies of agreements provide an additional business record; clients should keep their own copy of important records.
Security responsibilities
Do not share your password with QCR or other users. Use the authorized account and access process for each service. Clients should remove former staff access and notify QCR when authorized contacts change.
Incident response
Suspected incidents are investigated to identify affected systems and information, contain access, preserve relevant records, restore service, and provide required notices. Security concerns should be reported promptly to support@qualitycontrolreviews.com.