> How Reviews.io handles customer data, widget cookies and US data transfers, plus the consent and GDPR steps you need to deploy it on your store compliantly. > > Canonical: https://www.flowconsent.com/en/services/marketing/reviews-io Marketing # REVIEWS.io Preferences · [Official website](https://www.reviews.io) Reviews.io is an ecommerce reviews and ratings platform that collects verified company and product reviews and displays them on your store through embeddable widgets. [Block REVIEWS.io until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Preferences - Prior consent Required - Documented cookies 7 - Third-party domains 7 - Servers United Kingdom Overview ## What does REVIEWS.io do? ## **What Reviews.io is** Reviews.io is a UK based customer reviews and ratings platform used by ecommerce stores to collect verified company and product reviews. After a purchase, the merchant shares order and customer details so that Reviews.io can send automated review invitation emails, then gathers the responses and displays them through embeddable widgets. It is also a Google Licensed Review Partner, which means star ratings can flow into Google Search, Google Ads and Google Shopping. ## **What data and cookies it collects** To request and publish reviews, Reviews.io processes reviewer names, email addresses, order identifiers and purchase information, plus any photos or text a customer submits. When the widget loads on your storefront it executes JavaScript from the Reviews.io content delivery network and may set functional and session cookies that remember widget state and protect against abuse. Personal review data is typically retained for a limited period before deletion, in line with the platform retention policy. ## **GDPR and ePrivacy implications** Reviews.io acts as your data processor for the order data you send, while becoming a controller for published review content. Under the ePrivacy Directive, any non essential cookies the widget sets require prior consent, and under the GDPR you need a lawful basis for sending invitation emails and a signed data processing agreement. Publishing user generated content also raises fairness and transparency duties toward the reviewers themselves. ## **Consent requirements** Because the widget loads third party scripts and can set cookies, deploy it behind your consent banner so it only fires after the visitor accepts the relevant category. For review invitations, rely on consent or a clearly documented legitimate interest with an easy opt out. Keep an audit trail of how and when consent was captured so you can demonstrate compliance to a regulator. ## **Data transfers to the United States** Although the core service is hosted in the United Kingdom, syndicating ratings to Google means review data can be transferred to servers in the United States. Some sub processors and content delivery nodes may also sit outside the EEA. These transfers should be covered by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, supported by a transfer risk assessment. ## **Practical compliance steps** Sign the Reviews.io data processing agreement, list it in your record of processing, and gate the widget behind consent. Document the legal basis for invitation emails, set retention aligned with the supplier policy, and update your cookie and privacy notices to name Reviews.io and Google as recipients. Review the transfer mechanisms annually and confirm reviewers can exercise access and erasure rights. Compliance ## REVIEWS.io and the GDPR REVIEWS.io is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) - Risk level medium - Applicable regulations GDPR, UK GDPR, ePrivacy Directive ### Impact assessment (DPIA) A DPIA is advisable because Reviews.io processes customer contact and purchase data to solicit reviews and publishes user generated content. Assess the lawful basis for review invitation emails, the retention of reviewer data, and the onward syndication of ratings to Google in the United States. ### Sample text for your banner > We use Reviews.io to collect and display customer reviews. With your consent, the Reviews.io widget may set cookies and load content from its servers. You can accept or decline in our cookie settings. Cookies and trackers ## What REVIEWS.io sets and contacts - Tracking method Cookies and JavaScript - Server location United Kingdom - Data transferred outside the EU Reviews.io is a UK based processor and, as a Google Licensed Review Partner, syndicates rating data to Google services hosted in the United States. Widget assets and some sub processors may also operate outside the EEA, so transfers rely on the UK Addendum and the EU Standard Contractual Clauses. ### Cookies set (7) | Name | Type | Duration | Purpose | | --------------------- | ----------- | ---------- | ---------------------------------------------------------------------------------------------------------- | | RICHSNIPPETS\_SESSION | session | Session | Keeps the review widget state during a single browsing session. | | ri\_session | Functional | Session | Maintains the Reviews.io widget session state while a visitor browses and interacts with reviews. | | rio\_visitor | persistent | 1 year | Identifies a returning visitor so review prompts and widget behaviour stay consistent. | | ri\_visitor | Functional | 1 year | Recognises a returning visitor so the widget can avoid duplicate review prompts and remember interactions. | | \_\_cf\_bm | Security | 30 minutes | Cloudflare bot management cookie that protects the review widget endpoints from automated abuse. | | rio\_attribution | third-party | 1 year | Links a visit to a later review or invitation for marketing and attribution purposes. | | widget\_prefs | persistent | 6 months | Stores widget display preferences such as language and layout. | ### Third-party domains contacted (7) - `reviews.io` - `reviews.io` - `widget.reviews.io` - `widget.reviews.io` - `assets.reviews.io` - `assets.reviews.io` - `google.com` Questions ## Frequently asked questions about REVIEWS.io Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does REVIEWS.io set? REVIEWS.io typically sets functional cookies that keep its review widgets working and marketing or attribution cookies that link a visit to a later review or invitation. The exact names and number depend on which widgets you enable, so confirm the list in your own deployment. Treat the marketing and attribution cookies as non essential. ### Is consent required to use REVIEWS.io? Yes, consent is required before the marketing and widget cookies are set, because they are not strictly necessary under the ePrivacy rules. The review components should stay blocked until the visitor accepts the relevant cookie category. Aggregated star ratings that involve no visitor personal data may be shown more freely, but the widget itself should remain consent gated. ### What is the legal basis for processing? The main legal basis is consent under Article 6(1)(a) GDPR for the marketing and widget cookies. Legitimate interest may support purely aggregated display where no personal data of the visitor is processed. You should document the chosen basis and reflect it in your records of processing. ### Does REVIEWS.io transfer data to the US? Processing is primarily based in the UK and EU, so this is not a US first service. Some static widget assets may be delivered through a global CDN that can use edge nodes outside the EU. Where any such transfer occurs, confirm that standard contractual clauses or an adequacy decision are in place. ### Do I need a DPIA for REVIEWS.io? A full DPIA is usually not mandatory for standard review collection, but a documented risk assessment is recommended. Pay particular attention when photo and video reviews, buyer invitation lists, or attribution cookies are used. Record the data volume, the cookie footprint, and your mitigations. ### How do I implement REVIEWS.io compliantly? Load the widget only after consent for marketing cookies through your consent management platform, and block it by default. List the service and its cookies in your cookie policy and sign an appropriate data processing agreement. Make sure withdrawing consent stops the widget and clears its cookies. ### Are there alternatives to REVIEWS.io? Other customer review platforms exist, and some can be configured for lighter cookie use or stricter EU data residency. Whichever provider you pick, the same consent and transparency duties apply because review widgets generally involve third party cookies. Evaluate alternatives on data location, cookie footprint, and contractual terms. ### How do I update my cookie policy for REVIEWS.io? Add REVIEWS.io as a named third party in your cookie and privacy notices, describe the functional and marketing cookies it sets, and state the purposes and retention. Reference its domains such as reviews.io and widget.reviews.io and link to its own policy. Review the entry whenever you change the widget configuration. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [Wally](https://www.flowconsent.com/en/services/marketing/wally) [Wally is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Wally supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Wally ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/marketing/wally) [Preferences](https://www.flowconsent.com/en/services/marketing/wally) · ### [MadKudu](https://www.flowconsent.com/en/services/marketing/madkudu) [MadKudu is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. MadKudu enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, MadKudu empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/madkudu) [Marketing](https://www.flowconsent.com/en/services/marketing/madkudu) · ### [Mission Suite](https://www.flowconsent.com/en/services/marketing/missionsuite) [MissionSuite is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. MissionSuite provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, MissionSuite helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/missionsuite) [Marketing](https://www.flowconsent.com/en/services/marketing/missionsuite) · ### [Repuso](https://www.flowconsent.com/en/services/marketing/repuso) [Repuso is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Repuso integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Repuso helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/marketing/repuso) [Preferences](https://www.flowconsent.com/en/services/marketing/repuso) · ### [Perfex CRM](https://www.flowconsent.com/en/services/marketing/perfex-crm) [Perfex CRM is a customer relationship management (CRM) platform that helps businesses organize, track, and nurture customer interactions across the entire lifecycle. It provides contact management, sales pipeline tracking, and automated workflows. Perfex CRM centralizes customer data from multiple touchpoints, enabling personalized experiences, faster deal closing, and improved retention. With reporting dashboards and integrations, Perfex CRM empowers data-driven relationship management.](https://www.flowconsent.com/en/services/marketing/perfex-crm) [Marketing](https://www.flowconsent.com/en/services/marketing/perfex-crm) · ### [Freshworks CRM](https://www.flowconsent.com/en/services/marketing/freshworks-crm) [Freshworks CRM is a customer relationship management (CRM) platform that helps businesses organize, track, and nurture customer interactions across the entire lifecycle. It provides contact management, sales pipeline tracking, and automated workflows. Freshworks CRM centralizes customer data from multiple touchpoints, enabling personalized experiences, faster deal closing, and improved retention. With reporting dashboards and integrations, Freshworks CRM empowers data-driven relationship management.](https://www.flowconsent.com/en/services/marketing/freshworks-crm) [Marketing](https://www.flowconsent.com/en/services/marketing/freshworks-crm) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)