RiskStar

1. One-liner

Finds the review requests Google quietly outlawed in April 2026 before it strips your stars and brands your profile.

2. Trend signal — why now?

On 17 April 2026 Google rewrote the Maps Rating Manipulation policy and added two explicit prohibitions: directing staff to solicit a specific number of reviews, and asking customers to include specific content — including content that names a staff member. That sits on top of a February 2026 enforcement refresh that moved on-premises review pressure into active enforcement.

Five practices that were standard operating procedure in local services are now formal violations:

1. Asking for a review while the customer is still on the premises
2. Reception tablets, kiosks, and shared review devices
3. Staff review quotas (“get five reviews this week”)
4. Asking customers to mention a technician or practitioner by name
5. Review gating — routing happy customers to Google and unhappy ones to a private form

The enforcement is not theoretical. Google removed or blocked 292 million policy-violating reviews in 2025 using Gemini-powered detection that catches violations before publication. In February 2026 business owners started losing reviews in bulk with no notification. From the reporting:

“Lost 20+ reviews a couple weeks ago.. were at 994 or so, now at 974 with 0 reviews added after the beginning of Feb. I have customers that told us they gave us a great review.. nothing shows.” — Rob Brooks, 18 February 2026

“76 deleted reviews for a restaurant location… all over the last 4 years, and a mix of mostly 5 star but also 1, 2, 3 and 4 star reviews.”

“260 reviews last week, yet 100 of them were removed today” — with a 0.2 rating drop.

A medical practice dropped from 601 reviews at the end of 2024 to 521 in early 2026. A wedding photographer lost three five-star reviews and was left with “just the spam 1 star, and a 2 star review.”

The escalation ladder ends badly: temporary inability to receive new reviews → temporary unpublishing of existing reviews → a public warning banner telling every consumer that fake reviews were found on your profile → full suspension for repeated violations.

Two things make this a business rather than a blog post. First, Google’s automated systems remove non-compliant reviews without notifying the business owner — you find out by noticing your count went down. Second, the on-premises rule is enforced via GPS and IP signals on the reviewer’s device, so the violation is committed by a front-desk habit nobody wrote down, in a building the software vendor cannot see.

Provenance:

• Signal 1 (demand): Google’s April 17 2026 Rating Manipulation policy rewrite banning staff quotas and staff-name content direction; five formerly-standard practices now violations; 292M reviews removed/blocked in 2025; enforcement is silent — https://launchcodex.com/blog/seo-geo-ai/google-business-profile-review-policy-update/ — 2026-08-31
• Signal 2 (demand, verbatim): Business owners reporting bulk overnight review losses from February 2026 — 994→974, 76 deleted at one restaurant, 601→521 at a medical practice, 100 of 260 removed in a week with a 0.2 rating drop — https://almcorp.com/blog/google-reviews-being-removed-2026-what-business-owners-need-to-know/ — 2026-08-31
• Signal 3 (feasibility + economic): Clinic-based practices (physio, chiro, massage, osteo, dental) named as heaviest-hit because reception tablets and staff incentive systems were the norm; on-premises submissions now detected by GPS/IP; incumbent review platforms charge $299–449/location/month (Birdeye) and $399/mo for 2 locations (Podium), proving budget exists in this exact line item — https://newframedigital.com/google-review-policy-changes/ and https://wiserreview.com/blog/birdeye-pricing/ — 2026-08-31 Category: Platform shift

3. The opportunity

Every incumbent in this category — Birdeye, Podium, NiceJob, ReviewBuzz — sells the send side. They own the SMS template and the email blast, and they will happily tell you their sending is compliant. Birdeye markets exactly this: it “blocks incentivized requests, logs every invitation, and flags suspicious activity.”

That is not where the violations live.

Google is not judging your vendor’s outbound template in isolation. It is judging the whole solicitation surface — and most of that surface is outside any vendor’s system:

• The iPad still sitting on the reception desk, bought in 2023, that nobody unplugged
• The printed sign in the waiting room offering 10% off your next visit for a review
• The verbal script the front desk uses — “if you could mention Dr. Sharma by name, that really helps her”
• The monthly bonus spiff the ops manager pays technicians per five-star review
• The satisfaction survey in the booking platform (Jane, GoHighLevel, ServiceTitan) that routes 4–5s to Google and 1–3s to a private form — textbook review gating, configured years ago by someone who left
• The review corpus itself, which already contains hundreds of reviews naming staff, written while the customer sat in the waiting room

That last one matters most and nobody is looking at it. Your existing published reviews are the evidence Google’s classifier reads. A profile where 40% of reviews name a specific practitioner and cluster into tight same-day bursts is a profile that looks manipulated whether or not you are still doing it. The violation is already sitting on your listing, visible to Google, invisible to you.

The 10× play: a screen that reads the actual review corpus, the actual physical premises, and the actual booking-platform automations, and returns a ranked list of what will get you penalised — with a remediation order. Incumbents structurally cannot do this. They would have to tell a paying customer that the process the incumbent itself installed is the liability. That is the classic vendor conflict-of-interest gap, and it holds for at least a year.

There is a second, sharper wedge. When Google does strip your reviews, the appeal guidance says to “document the pattern before filing, including which reviews were removed, when they were posted, and what your review request process looked like at the time.” You cannot document what you did not record. Localo and GLocal track deleted reviews going forward, but neither reconstructs the solicitation process that caused the removal — which is the part the appeal actually turns on.

4. Target market

Primary customer: Marketing/ops manager or practice owner at a 3–30 location clinic group (physiotherapy, chiropractic, dental, med-spa, veterinary) or home-services group (HVAC, plumbing, electrical) in the US and Canada, $2M–$30M revenue, already paying for review management software.

Why this band specifically:

• Under 3 locations: the owner knows every process personally; no discovery problem to solve, and $75/mo NiceJob is their whole budget.
• Over 30 locations: in-house marketing team, an agency of record, and legal review. Longer sale, and they’ll want SSO and a BAA.
• 3–30 is the gap: enough locations that nobody can personally audit every front desk, not enough to have a compliance function. This is exactly where the ban lands hardest — the reception tablet was rolled out as a chain-wide standard, so one bad process is replicated across every site.

Why they buy — the actual pain: The rating is the revenue. A one-star increase moves revenue 5–9%; for a $1M-revenue location, going 3.8 → 4.5 is worth roughly $35K–$63K per year. 92% of consumers require a 4-star minimum. The asymmetry is brutal: a group that loses 80 reviews across 6 locations and drops 0.2 stars has quietly given up six figures of annual revenue, and the public warning banner — if it lands — is worse than the star drop because it converts a rating problem into a trust problem.

The urgency is that they cannot tell whether it has happened. Removal is silent. Most owners in the February wave found out by accident.

Rough TAM reasoning: The US has on the order of 200K+ chiropractic, physiotherapy, dental and veterinary practice locations, plus a large HVAC/plumbing/electrical contractor base. Constrain to multi-location groups of 3–30 sites that already spend on reputation software — the segment paying Birdeye/Podium prices today — and a realistic reachable universe is in the tens of thousands of groups. At a $249–$599/mo group price, 400 groups is roughly $1.5M ARR. That is a comfortable bootstrapped market and far too small to interest a VC-funded entrant.

Why now for them: The policy changed four months ago. February’s bulk removals proved enforcement is real. Festive/peak-season demand cycles make Q4 the worst possible time to lose a star. And every one of them has an iPad on a reception desk right now.

5. Product sketch (MVP)

• Corpus risk scan. Reads every published review on each location’s profile and scores the listing on the signals Google’s classifier reads: share of reviews naming a staff member, same-day/same-hour clustering, burst velocity anomalies, generic-language density, and reviewer-account patterns. Output is a per-location risk grade with the specific reviews driving it.
• Solicitation walkthrough. A 12-minute guided audit the practice manager completes on their phone — photograph the reception area, upload your current SMS/email templates, answer eight questions about staff incentives and scripts. Returns a violation list mapped to the exact policy clause.
• Gating detector. Connects to the booking/FSM platform (Jane, GoHighLevel, ServiceTitan, Housecall Pro, Jobber) and inspects the review automation flow for conditional branching on satisfaction score — the single most common latent violation, usually configured years earlier.
• Remediation queue. Ranked fix list with effort and impact: unplug the tablet, rewrite three templates, kill the technician spiff, remove the waiting-room sign. Each item has copy-paste replacement language that is compliant.
• Silent-removal watch. Daily snapshot of every review on every location. When one disappears, you get the full record — text, rating, date, reviewer, capture timestamp — the same day, not three weeks later when you notice the count.
• Appeal file. When reviews are stripped or a banner lands, assembles the packet Google’s guidance actually asks for: which reviews went, when they were posted, and a dated record of what your solicitation process looked like at that time.
• Chain-wide rollout view. Which of your 14 locations still has a kiosk, which manager has not completed remediation, which site is trending toward a violation threshold.

6. AI angle — what’s load-bearing

Two places, both genuinely load-bearing.

Corpus classification. Scoring hundreds-to-thousands of reviews per group for staff-name mentions, solicitation fingerprints, generic-language density, and temporal clustering is a language task at a volume no human will do. This is the core of the product and it does not exist without a model. The interesting part is that we are building an adversarial approximation of Google’s own classifier — inferring what Gemini-powered detection flags from the observable evidence of what it has already removed. Every removal we capture in the watch feed is a labelled training example.

Premises and template reading. The manager photographs a reception desk and uploads three SMS templates; a vision-plus-language pass identifies the review kiosk, the incentive signage, and the prohibited phrasing, and maps each to a policy clause. Without this the product is a static PDF checklist that nobody completes.

Strip the AI out and you have a questionnaire — which is what the agency blog posts already give away free. The AI is what turns “here are the five rules” into “here are the 340 reviews on your profile that look manipulated and the tablet in your Fairview lobby that is generating more of them.”

7. Localization angle (if any)

N/A — this is a US+Canada play. The trigger is a Google Maps policy, which is global, but the willingness to pay $250–600/month for review-risk management concentrates in North America where the incumbent price points ($299–449/location) have already trained the market. The UK is a credible second market — the CMA investigation into fake reviews created parallel pressure and Google made public commitments there — but it is a phase-two expansion, not a wedge.

8. Business model — path to $1M–$5M ARR

• Pricing: $199/mo for 3 locations, $349/mo for 4–10, $599/mo for 11–30. Priced deliberately below one Birdeye seat so it reads as insurance rather than a platform swap. One-time $499 audit for single-location practices as a lead-gen product and a trojan horse into agencies.
• ACV: ~$4,200 blended (mix weighted toward the $349 tier).
• Rough math to $1M ARR: 240 groups × $349/mo × 12 = $1.0M.
• Rough math to $5M ARR: ~1,000 groups at a blended $420/mo. Realistically this needs the agency/franchise channel doing the selling — 40 agencies each managing 25 client groups. Achievable but it is the harder half.
• Expansion path: per-location pricing grows naturally as groups add sites. Then upsell the appeal service (a fixed $750 per stripped-review or banner incident, which is trivially worth it against a $35K–63K revenue swing), and a white-label tier for agencies who want to sell this under their own brand at 3× markup.

Margins are good — this is API cost plus scraping infrastructure. The main variable cost is corpus scanning, which is bounded by review volume and runs cheap at these scales.

9. Go-to-market wedge — first 100 customers

1. Free public risk grade as the entire top of funnel. Enter a Google Business Profile URL, get a graded risk score in 60 seconds — share of reviews naming staff, clustering anomalies, burst patterns. This is a scan of public data, requires no signup, and produces a number the owner did not know and cannot un-see. Run it in bulk across every multi-location clinic group in the top 40 US metros, then email the 500 worst-scoring groups their own grade. This is the whole play — the diagnostic is the marketing, and unlike the free-calculator trap, the diagnostic here is genuinely hard to reproduce and only opens the problem rather than solving it.

2. The February cohort. Business owners who publicly reported bulk review losses in Feb–Aug 2026 are findable in the Google Business Profile Help Community, r/smallbusiness, r/juststart, and local-SEO Facebook groups. These are people actively describing the exact pain, by name, with dates. Reply with their free grade. Expect a high reply rate because they are still angry and nobody has offered them an explanation.

3. Agency channel — the real scale lever. Local-SEO and home-services marketing agencies each manage 20–80 GBP listings and are currently being blamed by clients for review losses they did not cause and cannot explain. Sell them a white-label multi-client dashboard at $499/mo. Forty agencies is 1,000+ locations. Reach them through the local-SEO conference circuit, the LocalU / Sterling Sky orbit, and existing agency Slack/Discord communities — this is a small, tightly-networked professional community where a genuinely novel tool travels fast.

4. FSM/PMS platform ecosystems. Jane, Housecall Pro, Jobber, GoHighLevel all have marketplaces and partner directories. The gating detector is the natural integration hook — “audit your Jane review automation for the April 2026 policy.” Listing in three marketplaces is cheap and puts the product in front of exactly the right buyer at the moment they are configuring the flow.

5. Franchise and DSO group HQs. A 25-location dental support organisation or a chiropractic franchisor has one buyer who controls the process for every site. One close is 25 locations. Slower than the self-serve motion but this is where the $599 tier lives.

10. Build complexity — justification

Low. The corpus scan is public data collection plus a classification pass — no proprietary access needed, and the GBP data is scrapeable at the scale required. The premises audit is a mobile-web form plus a vision call. The gating detector needs OAuth integrations against 4–5 booking/FSM platforms, which is the only genuinely fiddly work and can ship with two platforms at launch. The daily snapshot watcher is a scheduled job and a diff.

A technical pair ships a credible v1 in 8–10 weeks. The free public grader — which is the marketing engine — is a 2-week build and should ship first, standalone, before the paid product exists.

The real work is not engineering. It is building and continuously maintaining the mapping between observable review-corpus signals and what Google’s classifier actually punishes. That is research, and it is also the moat.

11. Gating checklist

Gate	Pass?	Note
Legal in target market	✅	Scanning public review data and advising businesses on policy compliance. The product actively steers customers toward Google’s rules — the opposite of a manipulation service.
Ethical — no harm / dark patterns	✅	Helps businesses stop soliciting reviews in ways that mislead consumers. Explicitly refuses review-removal or review-generation requests.
Market exists (evidence above)	✅	Incumbents charging $299–449/location/month; documented bulk removals with named business owners; quantified revenue impact of star ratings.
1–5 person team can build this	✅	Two people, 8–10 weeks.
Launchable with <$50K / ₹40L	✅	Under $15K — API costs, scraping infrastructure, a domain.

All five pass.

12. Feasibility score

Axis	Weight	Score	Notes
Problem intensity	20	16/20	Real money — 0.2 stars is five to six figures annually for a multi-location group, and the warning banner is worse than the star drop. Docked because the pain is invisible until it fires; many owners do not yet know they have the problem, which is a selling cost.
Demand evidence	15	12/15	Strong: dated policy change, named business owners reporting losses with specific numbers, incumbent pricing proving budget in this exact line item. Docked because nobody is yet searching for “review policy audit” — the category does not exist, so demand is inferred from adjacent spend rather than observed directly.
Build feasibility	15	13/15	Public data, off-the-shelf models, standard web stack. The FSM OAuth integrations are the only real drag.
Distribution clarity	15	12/15	The free public grader is a genuinely strong, cheap, self-qualifying wedge and the agency channel is a real multiplier. Docked because the agency motion is unproven and the self-serve grader→paid conversion rate is a guess.
Revenue mechanics	15	11/15	Pricing is benchmarked below a well-established incumbent line item, and $1M needs only 240 groups. Docked because this may sell as a one-time audit rather than a subscription — retention after remediation is the central unknown.
Time to first revenue	10	8/10	The $499 one-time audit can be sold manually before the product is finished. Subscription revenue within 6–8 weeks of the grader launching.
Defensibility	10	4/10	Honestly weak. The checklist is public. What compounds is the removal corpus — every stripped review the watcher captures makes the risk model better — but that takes a year to matter, and Birdeye could ship a “policy check” tab in a quarter if they chose to. They probably will not, because it indicts their own product, but “probably will not” is not a moat.
Total	100	76/100

13. Qualitative modifiers

Founder-fit tags

technical-heavy · content-heavy

Technical for the corpus classifier and the integration work. Content-heavy because winning this category means becoming the reference source on the April 2026 policy — the local-SEO community reads and cites obsessively, and the free grader only spreads if it comes wrapped in credible analysis.

Key assumptions to validate (3–5)

1. Assumption: Multi-location groups will pay a recurring fee rather than treating this as a one-time cleanup. How to test: Sell 15 one-time $499 audits first. At delivery, offer the monitoring subscription. If under 30% convert to recurring, the business is a services shop, not SaaS — reprice around the audit and the appeal service.
2. Assumption: The public risk grade produces a number alarming enough to drive a reply. How to test: Grade 300 clinic groups, email 100 their score cold. Measure reply rate. Under 8% and the grader is not the wedge; the pain is too abstract.
3. Assumption: Review-corpus signals meaningfully predict what Google removes. How to test: Snapshot 500 profiles daily for six weeks. When removals occur, check whether the removed reviews were disproportionately in the high-risk buckets the model flagged. If the model has no discriminating power, the core claim is false and this collapses into a checklist.
4. Assumption: Agencies will white-label rather than build it themselves. How to test: Pitch 20 local-SEO agencies directly. Three paid pilots validates the channel.

Risk flags

1. Platform dependency — total. The product exists because of one Google policy and dies if Google reverses it, or if Google ships an in-console compliance checker inside Google Business Profile. The second is a genuine possibility; Google has been adding proactive owner alerts. Mitigation is thin — expand into Yelp, Apple Business Connect, and Trustpilot policy surfaces to diversify the risk.
2. Incumbent response. Birdeye or Podium adding a policy-audit tab would compress this fast. The conflict of interest protects it for a while, not forever. Speed and the agency channel are the answer.
3. Category doesn’t exist yet. Nobody wakes up searching for this. Every customer must be told they have the problem before they will consider paying, which makes CAC entirely dependent on the free grader working. If the grader underperforms there is no cheap second channel.
4. Scraping fragility. The corpus scan and daily watcher depend on collecting public GBP data at volume. Google actively discourages this. Expect ongoing maintenance and accept it as a recurring operational cost, not a solved problem.
5. Adjacent-service temptation. Customers will ask for review removal and review generation. Both are the business Google is destroying. Saying no costs revenue and must be a standing policy from day one.

14. Structured verdict

Score:                  76/100
Verdict:                GO
Confidence:             Medium
Best-fit builder:       Technical founder who can also write — needs the local-SEO
                        community's trust as much as the classifier
Time to revenue:        6–8 weeks (one-time audits sellable before the product ships)
Capital to launch:      $10–15K
Top 3 assumptions to validate first:
  1. Recurring vs one-time — sell 15 $499 audits, measure subscription conversion at delivery
  2. Grader alarm value — cold-email 100 graded groups their score, need >8% reply
  3. Model discrimination — snapshot 500 profiles for 6 weeks, check whether removed
     reviews cluster in the flagged buckets
Kill criteria:
  - Abandon if <30% of one-time audit buyers convert to a monitoring subscription
  - Abandon if the risk model shows no discriminating power against actual removals
    over a 6-week 500-profile observation window
  - Abandon if Google ships a native policy-compliance checker inside Google Business
    Profile before v1 launches

15. Next step — 1-week validation sprint

• Day 1–2: Build the corpus scanner as a script only — no UI. Pull every public review for 300 multi-location clinic and home-services groups across 5 metros. Score each on staff-name share, temporal clustering, and burst velocity. Produce a ranked risk list. This is the asset; everything else is packaging.
• Day 3–4: Take the 100 worst-scoring groups and cold-email each their own grade — the actual number, the actual flagged review count, the specific pattern. No pitch, no link to a product, just the finding and one question: “did you lose reviews in February?” Measure reply rate and read what comes back.
• Day 5: Get on the phone with every replier. Ask one thing directly: would you pay $499 today for the full audit and the remediation list? Take the money if they say yes.

Falsifiable outcome: ≥8 replies from 100 emails, and ≥3 people who verbally commit to $499 on a call. Below that, the pain is real but too abstract to sell cold — and the idea has to be re-cut around the agency channel or dropped.