Privacy Policy

1. Who we are

Reply2Review is a Software-as-a-Service platform operated by Taj Limited ("Taj Limited," the legal entity behind the product). You can contact us at taj@reply2review.com.

2. Information we collect

We collect information from three sources: information you provide directly, information we receive from Google when you connect your account, and information collected automatically when you use the Service.

a. Information you provide directly

• Account information: When you create an account, you provide your email address, a password, and (if you choose to add it) a display name.
• Billing information: When you start a paid subscription, payment is processed by Stripe. We receive your billing email, subscription plan, and payment status from Stripe. We do not directly store your full credit card number.
• Support communications: If you email us for support, we keep the contents of those emails.

b. Google user data we access

When you connect your Google account to Reply2Review via Google's OAuth 2.0 flow, we receive access to the following data, depending on which consent step you complete:

• From the sign-in step (scopes: openid, email, profile):
  • Your Google account email address
  • Your Google account display name and profile photo
  • An authentication token that lets us establish a session for you
• From the Google Business Profile connection step (scope: business.manage):
  • A list of your Google Business Profile locations (business name, address, phone, hours)
  • Reviews posted to those locations (review text, author name, star rating, review date)
  • The ability to post replies to those reviews on your behalf (write access, only after you explicitly approve each reply in our dashboard)

We do not request or access any of the following, and you can verify this in the Google consent screen each time you sign in: Gmail, Google Drive, Google Calendar, Google Contacts, Google Photos, YouTube, Google Ads, Google Analytics, or any other Google service not listed above.

c. Information collected automatically

• Usage information: When you use the Service, our servers log information such as your IP address, browser type, the page or feature you used, and timestamps.
• Cookies: We use a single authentication session cookie (named r2r_session) to keep you signed in. We do not use third-party tracking cookies, advertising cookies, or analytics cookies.

3. How we use your information

We use the information we collect for the following purposes:

• To provide the Service: We use your Google Business Profile reviews, location data, and authentication tokens to draft and post AI-generated replies to your reviews after you approve them.
• To authenticate you: We use your email and OAuth tokens to keep you signed in and to associate your account with the correct Google Business Profile connection.
• To bill you: We use your subscription information to charge you via Stripe and to send you receipts and billing notifications.
• To support you: We use your account information and any support emails you send us to respond to your requests.
• To improve the Service: We use aggregated, non-identifying usage information to understand which features are used and to prioritize improvements. We do not use your reviews or business data for this purpose.
• To comply with legal obligations: We may use or disclose information to comply with applicable law, regulation, court order, or valid legal process.

4. AI and machine learning

We do not use any Google user data — including Google Workspace data or Google Business Profile data — to train, fine-tune, or otherwise develop any general-purpose AI or machine learning models. We do use a third-party AI service (Anthropic's Claude) to generate reply drafts in real time, in response to a specific review you have selected. Your review text is sent to Anthropic at the moment you click "Generate Draft," and is used solely to produce a draft reply in that moment. We do not give Anthropic permission to retain or train on your data. Anthropic's data usage terms confirm this: see Anthropic's Commercial Terms for details.

5. How we share your information

We do not sell, rent, or trade your personal information or Google user data to any third party. We share your information only in the following limited circumstances:

• Service providers: We use third-party services to operate Reply2Review: Anthropic (for AI draft generation, as described above), Stripe (for payment processing), and Google (for OAuth and Google Business Profile API access). Each of these providers receives only the information needed to perform their service and is contractually obligated to protect your data.
• Legal requirements: We may disclose information if required to do so by law or in response to a valid subpoena, court order, or similar legal process.
• Business transfers: If Reply2Review is acquired or merged with another company, your information may be transferred as part of that transaction. We will notify you by email before your information is transferred and becomes subject to a different privacy policy.
• With your consent: We may share your information for any other purpose disclosed at the time of collection, with your explicit consent.

6. Data security

We take the security of your information seriously and use industry-standard measures to protect it:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
• Encryption at rest: All data stored in our database (Neon Postgres) is encrypted at rest using industry-standard AES-256 encryption.
• OAuth token security: Google OAuth access tokens and refresh tokens are stored encrypted in our database. Refresh tokens are used only to maintain long-lived sessions; we do not share them with any third party.
• Access controls: Access to production data is restricted to a small number of authorized personnel who require it to operate the service. All access is logged.
• No password storage: We never store your Google password. Authentication is handled entirely by Google's OAuth 2.0 flow.
• Hosted on Vercel and Neon: Our application runs on Vercel and our database is hosted on Neon. Both providers maintain SOC 2 Type II compliance and other industry-standard certifications.

No system is 100% secure. If you become aware of a security incident affecting your account, please contact us at taj@reply2review.com immediately.

7. Data retention and deletion

We retain your information for as long as your account is active, and for a reasonable period afterward as needed to comply with our legal obligations, resolve disputes, and enforce our agreements.

• Account data: Retained for the life of your account. When you delete your account, we permanently delete your account record, authentication tokens, OAuth refresh tokens, and any cached data within 30 days.
• Reviews and replies: Retained for the life of your account so the Service can display your review history and analytics. Deleted with your account.
• Billing records: Retained for 7 years as required by tax and financial regulations (cannot be deleted on request during this period, but access is restricted).
• Support emails: Retained for 2 years for quality and training purposes, then deleted.
• Server logs: Retained for 30 days, then deleted or anonymized.
• Backups: Encrypted backups are retained for 30 days and then purged on a rolling basis.

How to delete your account: You can request account deletion at any time by emailing taj@reply2review.com. We will process your request within 30 days. You can also revoke our access to your Google account at any time from your Google Account permissions page, which immediately invalidates our OAuth tokens.

8. Your rights

You have the following rights regarding your personal information:

• Access: You can request a copy of the personal information we hold about you.
• Correction: You can correct inaccurate or incomplete information through your account settings.
• Deletion: You can request that we delete your personal information (subject to the retention exceptions in Section 7).
• Portability: You can request a machine-readable copy of your data.
• Objection: You can object to certain types of processing.
• Withdraw consent: Where we rely on your consent, you can withdraw it at any time.

To exercise any of these rights, email taj@reply2review.com. We will respond within 30 days.

9. International data transfers

Reply2Review is operated from the United States. If you are accessing the Service from outside the United States, please be aware that your information will be transferred to, stored in, and processed in the United States. By using the Service, you consent to the transfer of your information to the United States. We use service providers (Vercel, Neon, Anthropic, Stripe, Google) that maintain data centers in multiple regions; some of your data may be processed outside the United States as part of normal operation.

10. Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us at taj@reply2review.com so we can delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email at least 30 days before the changes take effect. The "Last updated" date at the top of this page reflects when the policy was last revised. Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated policy.

12. Contact us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Reply2Review (operated by Taj Limited)
Email: taj@reply2review.com