Client and brand boundaries
Every operational read and write is scoped to a Review Magic organization. Listings also carry their child-brand assignment. Agency access is checked against an active, client-authorized relationship rather than inferred from a name or email domain.
If a person is both an agency user and a direct member of a client, the direct client membership governs that client workspace.
Use the least-privileged role
- Give viewers and agency analysts read-only roles.
- Give managers operational access only when they need to change listings or case wording.
- Reserve billing-admin access for people responsible for payment and fee decisions.
- Keep client-owner access limited to accountable owners.
- Remove former employees from the relevant roster promptly.
Accountable actions and evidence
Sensitive actions record the acting user and tenant context. Agency actions also retain the agency and client relationship used for access. Agreement and client-authorization evidence is versioned rather than overwritten.
Confirmed removals retain a durable evidence snapshot so billing and support reviews do not depend on a transient source page alone.
Data lifecycle and privacy requests
Review Magic retains operational records while an account is active and applies the deletion and survival rules stated in the Privacy Policy and Terms after termination. Some billing, audit, dispute, or legal records may need to survive ordinary workspace deletion.
For an access, correction, deletion, or privacy request, contact the dedicated privacy address from the verified account email and identify the client organization. Do not attach identity documents unless support gives you a secure approved method.
Report a security concern
- Revoke the affected user or agency access if you can do so safely.
- Change marketplace credentials at the marketplace if they may have been exposed.
- Contact Review Magic support from the verified account email.
- Include the organization, approximate time, affected action, and visible reference ID—never the secret itself.
Continue the task