Rating Bee: roadmap review and recommendations

What you're building: a review site where the stars come from people who actually paid. The restaurant's own receipt proves the visit. The score shows how the place is doing now, not how it did years ago. A restaurant that had a bad night can win the customer back in the open. And paying Rating Bee never buys a better score. That's "Honest Reviews. Fair Ratings. Second Chances." and it's a real gap. Google and Yelp can't tell you who actually ate there, and they don't really give a business a second chance.

Verdict: the plan is sound and unusually disciplined: each stage has a gate, you have honest revenue expectations, and trust rules apply from day one. It can be built. I checked the riskiest technical assumption, receipt QR codes on Clover, against Clover's own documentation, and it works roughly the way you hoped (details below). The changes I recommend are mostly about order and integrity, not size.

Full directory, city by city. Every restaurant gets a page from day one, loaded from Foursquare Open Source Places (Apache 2.0, free, covers the US, and we're allowed to keep it). Bay Area first, then one city at a time. The US has roughly a million restaurants, and adding listings costs nothing per listing. Owners can claim and correct their page. Search engines index a page once it's claimed or has a Rating Bee review, so we don't publish thousands of thin pages.

"On Google" box. Each restaurant page has a clearly labeled box showing Google's rating, review count, a few reviews and photos, loaded live from Google when the visitor taps it. Google's rules: only Place IDs may be stored; everything else is fetched fresh, shown with the Google logo and each author's name and profile link, and on a Google map if a map is used. It's never counted in FreshScore or mixed with Rating Bee reviews, so "verified" keeps its meaning.

Google cost (list prices checked Oct 24). Free amounts are per month and count page views, not businesses. Rating and review count: 1,000 free, then $20 per 1,000. Reviews: 1,000 free, then $25 per 1,000. Photos: 1,000 free, then $7 per 1,000 each. Example: 10,000 box openings a month with 3 photos each is about $425. Tap-to-load and a 3-photo limit keep this tied to real interest.

Founding Critics, now in the pilot. An invite-only group of 10–25 Bay Area people you pick, each with a critic badge and profile. Critics pay for their own meals by default, and those reviews count normally. Hosted (free or discounted) visits get a visible "Hosted visit" label and don't count toward FreshScore. No one is rewarded for a positive review, and restaurants can't preview or approve a critic's review. The full marketplace, where restaurants invite and host critics, comes later.

1. Three verification levels, shown on every review: "Receipt verified" (POS-confirmed automatically), "Business confirmed" (owner confirmed a manual invitation or receipt) and "Unverified". Only the first two count toward FreshScore. Show "how reviews were collected" on every profile.
2. Lock the FreshScore formula now and publish it (proposed formula below, and you can try it in the prototype). Fix one contradiction in the plan: reviews older than 36 months can't stop counting toward a "current" score that only uses 12 months anyway. The 36-month rule really affects the all-time rating. Pick one: keep "all-time" truly all-time (my recommendation; the archive is only a display tab), or rename it "3-year rating".
3. One person, one current vote: FreshScore uses each customer's latest verified review of a business. A return visit is a new review, which is a natural second chance.
4. Every review waits the same short hold (for example 24 hours for fraud checks), whatever its stars. The business is notified of all reviews the same way. Never hold back only negative reviews.
5. Sign-in without passwords: email magic link at first, phone only for higher reviewer levels. This avoids SMS registration fees and delays in the pilot.
6. No native apps in year one. A fast mobile website covers scan → review in under 60 seconds.
7. Add a website badge/widget to the free or paid tier. It's the one thing every restaurant can use on day one, it brings traffic back to Rating Bee, and it fits your web-design client base. (Google won't show star snippets for a business's own reviews of itself, so sell the badge as trust, not SEO.)
8. Move sponsored placements, coupons and promotions from Stage 5 to Stage 9. Start Stage 5 with reputation features.
9. Set targets by channel. A QR code at the bottom of a receipt will convert at a much lower rate than an invitation handed over with a request. Track "receipts printed → scans → completed reviews" separately from hand-delivered invitations. A single 10% target will mislead you.
10. Clear the names before printing stickers: run a trademark search on "Rating Bee" and "FreshScore" (food and review marks crowd the "fresh" space).
11. Legal basics before public launch: Terms, Content Guidelines (the rules every removal cites), a Privacy Policy, a takedown/appeal process, and a California-licensed attorney's review. Use them in every sales conversation, because Yelp-style "pay us or else" accusations are the main reputational risk for this business model.
12. Keep sales and moderation separate from day one, even if you're both people for now: a written rule that subscription status is never visible in moderation tools.

1. The customer's review publishes on the normal schedule. Nothing waits on the business.
2. On a 1–3 star review, the customer can choose "Let the business contact me". Only then does the business see a private way to reach them.
3. The business can reply publicly and/or privately. An offer (refund, visit) must be unconditional. The platform shows: "Offers can't depend on changing your review."
4. The customer, and only the customer, marks the case "Resolved" or "Not resolved" and may post an update. The original stays visible under "Original review".
5. FreshScore uses the customer's current rating. The profile shows a public "resolution rate". This is your differentiator: it rewards fixing problems, not hiding them.
6. Any message asking a customer to change or remove a review is reportable and can lead to suspension.

• Keep: Next.js + TypeScript, PostgreSQL + PostGIS, Stripe, managed auth, object storage. You already run Next.js + Supabase + Stripe + Resend in production (wdm-portal), so I recommend Supabase (Postgres, PostGIS, auth, storage and row-level security in one) on Vercel, with Resend for email and Sentry for errors.
• Not Cloudflare D1 (used for the CCA portal) for this project: it's SQLite and has no PostGIS for "restaurants near me".
• Adjustment 1: treat reviews as an append-only history (every edit is a new version, every moderation action is a logged event). That makes "auditable" and "the original stays" automatic.
• Adjustment 2: one "verification adapter" interface (verifyEvidence(location, evidence) → verified | confirmed | rejected) with Clover, Square, Toast and Manual behind it. New POS systems plug in without touching reviews or scoring.
• Adjustment 3: store the minimum transaction evidence (POS name, merchant/location, order and payment IDs, amount, time, status). Never store card data, and never store customer phone or email from the POS.

Q7, API costs by volume: if Rating Bee keeps its own directory, a business search costs almost nothing (your own database). Calling Google on every search is what gets expensive: Text Search Pro is $32 per 1,000 after 5,000 free a month, so 100,000 Google-powered searches would be about $3,000/month. Store the Place ID, show your own data, and call Google only for "Directions". Pay-per-use costs: Stripe 2.9% + 30¢ per charge plus 0.7% Billing (about $1.40 on a $29 plan). Clover-billed plans: you keep 70%. Window stickers and printing are a separate marketing cost.

• Clover Dev Kit device (from Clover's developer store) to prove a printed receipt end to end, plus a sandbox test merchant.
• A functional demo video for Clover's app review (about 1 day).
• Before the public launch: an outside security review or penetration test of sign-in, invitations and the admin area (a budget line in the low thousands; get quotes).
• Attorney review of Terms, Content Guidelines and Privacy; consider media/cyber liability insurance.
• Fraud checks built in: one review per order or payment, invitation expiry, rate limits per device/IP (stored hashed), blocking owners/staff from reviewing their own business, and alerts for unusual bursts of reviews.