ReviewFlow | Reputation Management PHP Script With Flutter App

ReviewFlow. Every review, handled.

ReviewFlow is a self hosted, multi tenant reputation platform for agencies, freelancers and local businesses. It pulls reviews from Google, Facebook, Trustpilot and Yelp into one inbox, helps you answer them fast, asks happy customers for new reviews, and shows the best ones on any website through an embeddable widget. Full source code is included for both the Laravel backend and the Flutter mobile app.

You install it on your own hosting. There is no phone home, no license server and no runtime dependency on us. Once the files are on your server and the database is migrated, the product is yours to run.

Live demo

• Demo URL: https://reviewflow.ezeematrix.com
• Workspace login: agency@demo.com / ReviewFlowDemo!
• Admin panel: https://reviewflow.ezeematrix.com/admin
• Admin login: superadmin@demo.com / ReviewFlowDemo!

Android build: the demo landing page carries a “Download for Android” button.

The demo is seeded with several locations, ninety eight reviews across Google, Facebook, Trustpilot and Yelp, campaigns, working widgets and a public review page, so every screen has real content in it. The sign in form is protected by hCaptcha, exactly as a buyer’s install would be.

Screens

Unified inbox. Every platform in one feed, filterable by rating, platform, sentiment and read state.

Reply center. A focused queue of unanswered reviews with brand voice, tone and one click AI drafting.

Campaigns. Email, SMS and WhatsApp review requests with per send tracking.

Widget builder. Configure a widget on the left, see the real thing render on the right.

Review gating. Happy customers go to the public platform. Unhappy ones go to a private form you read in the dashboard.

Public review page. A shareable, indexable page per location, carrying the workspace’s own branding.

White label. Each workspace sets its own product name, logo, color and custom CSS.

Admin panel. Tenants, users, plans, reviews, campaigns, AI usage and license status.

Mobile app. The same account on iOS and Android, with the workspace’s branding applied.

Please read before buying: external services and their costs

This item is software only. It does not include, and its price does not cover, any third party service. Several features work by connecting to outside providers. Those providers bill you directly, under your own account, at their own prices, and those prices can change at any time.

• SMS campaigns are an external, paid service. Sending text messages requires your own account with Twilio, Vonage or Africa’s Talking. Every message you send is charged per message by that provider, at rates that vary by destination country. This item includes no SMS credit of any kind.
• Email sending is an external service. The product does not send mail on its own. You supply either an SMTP mailbox or an HTTP API provider such as Mailgun, SendGrid, Postmark, Brevo or Resend. Free tiers exist, but volume sending is billed by that provider, not by us.
• WhatsApp campaigns rely on WhatsApp itself. The product generates click to chat links that open in WhatsApp; you and your customers need WhatsApp installed. If you later choose to use the official WhatsApp Business API instead, that is a paid Meta service billed per conversation.
• AI reply drafting and sentiment scoring are external, paid APIs. See the AI disclosure below.
• Review platform APIs such as Google Business Profile, Facebook, Trustpilot and Yelp require your own developer credentials and, for Google and Facebook, their own app review before a production app may read a business’s reviews. Some Trustpilot capabilities need their paid business tier.
• Stripe is only needed if you charge your own clients. Stripe’s transaction fees are theirs, not ours.

None of these fees are included in the purchase price, and we have no visibility into or control over them. Check each provider’s current pricing and terms before you rely on it. Every one of these integrations is optional: with all keys left blank the product still installs and runs, and the features that depend on them stay hidden.

AI usage disclosure

This item integrates third party artificial intelligence services. In line with Envato’s AI policy, here is exactly what that means.

• Which services. The product can call the OpenAI API and, as an alternative or fallback, the Google Gemini API. No other AI service is contacted.
• What they are used for. Two features only: drafting a suggested reply to a review, and scoring the sentiment of review text.
• Whose account, whose bill. You supply your own API key. All AI usage is billed to you by OpenAI or Google at their prices. No AI credits, keys or free allowance are included with this item.
• What is sent. When you request a draft, the review text, the business name and your chosen tone settings are sent to the provider you configured. Nothing is sent unless you trigger it, and nothing is sent to us.
• It is entirely optional. Leave both keys blank and the AI controls do not appear. Sentiment then falls back to a built in classifier that runs locally and contacts no one.
• Output is machine generated. AI drafted replies are suggestions. They are shown to you for editing and are never published to a review platform without you pressing publish.

What you get

• Unified review inbox. Google, Facebook, Trustpilot and Yelp in one feed, filterable by rating, platform, sentiment, location, date and read state.
• Reply center. A focused queue of unanswered reviews, worst rated first, so the ones that hurt get answered first. Publish replies straight back to the platform.
• AI reply drafting. Draft in a chosen brand voice and tone, in the language of the review itself. Regenerate, edit, then publish. Works with OpenAI or Google Gemini, and is entirely optional.
• Review request campaigns. Email, SMS and WhatsApp click to chat. CSV contact import, merge tags, send delays, scheduling, and per campaign funnel metrics for sent, opened, clicked and converted.
• Review gating. A branded rating page per location. Happy customers are forwarded to your public review link, unhappy ones land in a private feedback form that never leaves your install. Downloadable QR codes for print and counter cards.
• Public review page. A shareable, search indexable page of a location’s reviews, carrying the workspace’s own branding and schema.org markup. Example: https://reviewflow.ezeematrix.com/showcase/acme-dental
• Embeddable widget. Carousel, grid, badge or list. A dependency free script served by your own install, with scoped styles that cannot collide with the host page, dark mode support, and schema.org markup for rich snippets.
• Reputation dashboard. A weighted score out of 100, trend chart, sentiment split, per platform breakdown and downloadable PDF reports you can send to a client.
• Multi tenancy and white label. One install, many client workspaces, each isolated, each with its own logo, color, subdomain or custom domain. Per workspace custom CSS.
• Admin panel. Manage tenants, users, plans and global settings. Impersonate a user to reproduce a support issue, with every impersonation logged.
• Team roles. Owner, Manager and Staff, enforced on the server rather than hidden in the interface.
• REST API. Token authenticated with scoped abilities, for your own integrations.
• Native mobile app. Full Flutter source for iOS and Android, covering the inbox, reply center, campaigns, contacts, locations, widgets and reports.

Built for real hosting

ReviewFlow is designed to run on ordinary shared hosting as well as a VPS. It uses a single database rather than one per tenant, a database queue driven by a single cron entry rather than a persistent worker, and file based cache and sessions, so there is no Redis requirement. Queries are paginated and imports are chunked to stay inside modest PHP memory limits.

Requirements

• PHP: 8.2 or higher. 8.3 recommended.
• Database: MySQL 5.7 or higher, or MariaDB 10.3 or higher.
• Web server: Apache 2.4 with mod_rewrite, or Nginx 1.18 or higher.
• PHP extensions: bcmath, ctype, curl, dom, fileinfo, gd, json, mbstring, openssl, pcre, pdo_mysql, tokenizer, xml, zip.
• Cron: one entry running every minute.
• Composer: needed once, to install dependencies.
• Node.js 18 or higher: only if you want to rebuild the front end assets after editing them.
• SSL: required for the Google and Facebook OAuth callbacks.
• Compatible with: cPanel and similar shared hosting, VPS, and any cloud host that runs PHP and MySQL.

What is in the package

• Full, unobfuscated source for the Laravel backend, the Livewire dashboard and the Filament admin panel.
• Full, unobfuscated source for the Flutter iOS and Android app.
• A step by step web installer: requirements check, database test, site details, mail setup, then migration.
• A demo data seeder, so you can look around a populated install before connecting anything real.
• A single page HTML manual with a sidebar, covering installation on shared hosting and on a VPS, configuration, every third party service, branding, the API, troubleshooting and known limitations.
• An automated test suite covering tenant isolation, the gating funnel, campaigns, widgets, plan limits and the installer.

Dependencies are not bundled. Marketplace rules prohibit shipping third party libraries, so the package contains source only and you install them once with Composer. The manual covers this, including what to do if your host gives you no terminal.

Which service does what

A reference for the services named above. To install and run the product you need only PHP, a MySQL database, a web server and one cron entry. Each service below is optional and adds one specific capability; all of them are billed by the provider, not by us.

• OpenAI or Google Gemini: AI reply drafting and sentiment scoring. Leave both keys blank and the AI controls hide themselves, while sentiment falls back to a built in classifier that needs no network.
• Google Business Profile: importing Google reviews and publishing replies to them.
• Facebook Graph: importing Facebook page reviews.
• Trustpilot: importing Trustpilot reviews. Publishing replies through their API needs their paid business tier.
• Yelp Fusion: importing Yelp reviews. Yelp caps how many reviews and how much text their public API returns.
• SMTP or an HTTP API mail provider: campaign and notification email. SMTP needs no third party signup, since a mailbox on your own domain is enough. The HTTP transport works with any provider that accepts a standard JSON send body, so Mailgun, SendGrid, Postmark, Brevo and Resend are all drop in choices.
• Twilio, Vonage or Africa’s Talking: SMS campaigns. Email and WhatsApp campaigns need no account at all.
• Stripe: only if you want to charge your own clients for workspaces. Leave billing off and assign plans by hand in the admin panel.
• hCaptcha: bot protection on public forms. Blank keys skip it.

All third party API and service fees are billed by those providers, under your own account, at their prices. They are not included in the price of this item, and we have no visibility into or control over them. Google and Facebook each require their own app review before a production application may read a business’s reviews, and that approval is between you and them. Providers change their pricing, their terms and their APIs, so check the current terms before you rely on one.

Who it is for

• Digital agencies managing reputation for a portfolio of local business clients.
• Freelancers packaging reputation management as a productized service.
• Local businesses such as restaurants, clinics, salons, trades and dealerships managing their own reviews.
• Resellers who want to rebrand the platform and sell access under their own name, under the Extended License.

Known limitations

Stated up front so there are no surprises. Competitor ratings are entered by hand rather than scraped, because automated scraping breaks those platforms’ terms. Replies publish back to Google; other platforms are read and answered inside the product, since their APIs do not offer reply publishing on the tiers most buyers hold. Custom domains per client need a certificate covering that hostname, which is practical on a VPS and usually not on shared hosting, where subdomains are the answer. The interface ships in English, with the standard translation mechanism in place and documented for adding your own.

Support and updates

Free updates for the lifetime of version 1.x. Support covers the product working as documented: installation problems, defects, and questions about the features described in the manual. It does not extend to third party service approval, custom development, or administering your own server. The manual ships inside the package and includes a troubleshooting section that resolves the majority of questions immediately.