The Review Rubric

A review reads three documents: the company’s privacy policy, its terms of service, and (where one exists) its data processing agreement. Each of the six commitments is checked against those documents. A commitment is Met only when the reviewer can quote the company’s own published language satisfying every criterion below — verbatim citations are required in every review. Six Met is Aligned. Four or five is Partially Aligned, listed with the company’s own rationale for each gap. Three or fewer is not listed and not labeled.

01 Never sold, never shared.

The reviewer checks: the documents prohibit selling, renting, or sharing identifiable customer company data with any third party; the only carve-outs are contracted service providers and legal compulsion; no advertising or data-broker disclosure of any kind.

Evidence required: verbatim citation of the no-sale/no-share clause and its complete exception list.

Common shortfalls: default-on ad-tech “sharing” under CCPA definitions; affiliate-sharing clauses that move data across corporate family lines; “partners” or “select third parties” left undefined.

02 Sole-purpose use.

The reviewer checks: customer data is used only to deliver the contracted services; no mining of customer data for third-party products or insights; no using a customer’s own data to sell back to them beyond ordinary service administration.

Evidence required: verbatim citation of the purpose-limitation language, plus any aggregate/de-identified data clause and its re-identification safeguard.

Common shortfalls: open-ended “to improve our products and services” grants with no purpose limit; “marketing” listed as a processing purpose for customer business data; de-identification claims with no re-identification prohibition.

03 Removal on request.

The reviewer checks: customers can disconnect at any time; a published deletion schedule for synced data, with written confirmation; data export available at no charge.

Evidence required: verbatim citation of the deletion timeline and the export terms.

Common shortfalls: “we retain data as long as necessary” with no schedule; deletion promised only for legally mandated categories; export gated behind fees or an enterprise tier.

04 Survives acquisition.

The reviewer checks: the commitments bind any successor or acquirer; identifiable customer data does not transfer in a sale, merger, or bankruptcy without the customer’s written consent, or at minimum notice and a genuine exit window before transfer.

Evidence required: verbatim citation of the business-transfer clause and the successor-obligations language.

Common shortfalls: standard “business transfer” clauses that pass data to any acquirer automatically, with no customer notice and no exit window; commitments that expire at change of control.

05 Opt-in only.

The reviewer checks: nothing derived from a customer’s data appears to any third party in identifiable form without affirmative, revocable consent; consent is opt-in, not opt-out; no privacy choice affects the customer’s standing, score, ranking, or visibility on the platform.

Evidence required: verbatim citation of the consent mechanism and the non-retaliation language.

Common shortfalls: pre-checked boxes or consent buried in onboarding; benchmarking and “insights” products that expose identifiable performance data by default; visibility or ranking penalties for customers who opt out.

06 Enforceable.

The reviewer checks: the commitments are contractual, not aspirational; defined remedies — liquidated damages or equivalent — for data misuse; those remedies survive any general limitation-of-liability cap.

Evidence required: verbatim citation of the remedy clause and the liability-cap carve-out.

Common shortfalls: privacy promises living only in a policy the company can amend at will; liability caps with no data-misuse carve-out, so the remedy for a breach rounds to a month of fees; “commercially reasonable efforts” standards with no remedy at all.

Process rules

Right of reply. Every company sees its draft status, with the reviewer’s citations, before anything posts — and may respond with corrections, additional citations, or a public rationale for any unmet commitment.

Annual re-review. Every published status is re-reviewed at least annually.

Material changes. A review is repeated whenever the company’s documents materially change, whether the change is reported by the company or observed by the stewards.

Lapse. A Pending company whose 90-day implementation window passes without submitted documents is quietly removed — notified privately, never publicly labeled, welcome back when ready.