replefy

Privacy Policy

Last updated: October 2026

1. Who is responsible

The controller for the processing described here is:

Sammy Maier (Replefy)
Partida Enginent II, 7F
03710 Calpe, Spain
Email: support@replefy.com

We have not appointed a data protection officer, as we are not required to.

Two roles. For your own account data (name, email, login, plan), we are the controller. For the Google reviews of your business that we fetch and help you answer, we act on your behalf as a processor under Art. 28 GDPR: you decide which reviews to answer and what is published. The data processing agreement for this is part of our Terms of Service (Annex).

2. What we process, why, and on which legal basis

2.1 Your account

  • Data: email address, name (if you enter it), password (stored only as a hash by our database provider), the time you accepted our Terms, an optional profile photo.
  • Sign in with Google or Apple: if you choose it, we receive your name and email address from that provider. We do not receive your Google or Apple password.
  • Why: to create and run your account.
  • Legal basis: performance of a contract, Art. 6(1)(b) GDPR.

2.2 Your business and its Google reviews

  • Data: business name, type, city, country, your Google Maps link and Google place ID; a short business description if you write one.
  • Reviews: when you connect your business, we import reviews from Google: the reviewer's display name, the star rating, the review text, the review date and any existing owner reply. These reviews were published on Google by the reviewers themselves.
  • Where reviews come from: the Google Places API when you paste your link; the Google Business Profile API if you connect your profile (see 2.5); in some cases SerpApi (see section 4).
  • Why: to show you your reviews and draft replies to them.
  • Legal basis: performance of our contract with you, Art. 6(1)(b) GDPR. Processing the reviewers' names and texts is based on the legitimate interest of you as the business — and of us on your behalf — in reading and answering public reviews, Art. 6(1)(f) GDPR. We only use reviews for that purpose.

2.3 AI-drafted replies and posts

  • To draft a reply, we send the review text, the reviewer's display name, the star rating and the business details from 2.2 to an AI provider (section 4). For posts, we send your business details and what you typed in.
  • If you use AI Voice (Pro), we also send your example replies and rules.
  • A draft is a suggestion. Nothing is published unless you approve it — or, if you connect your Google profile and switch on automatic replies (Pro), within the limits you set, which you can switch off at any time. No decision with legal or similarly significant effect is made automatically (Art. 22 GDPR).
  • Under their API terms, our AI providers do not use this data to train their models.
  • Legal basis: Art. 6(1)(b) GDPR (and 6(1)(f) for the reviewer data, as above).

2.4 Emails

Account emails (confirmation, password reset) and service emails (for example a weekly summary, if enabled) are sent via Resend. We log the recipient, the template and the delivery status to detect failures and honour unsubscribes; an unsubscribed address is kept on a suppression list so we do not email it again.

Legal basis: Art. 6(1)(b) GDPR for account emails; Art. 6(1)(f) GDPR for the service summary and the suppression list (you can unsubscribe in every such email).

2.5 Connecting your Google Business Profile (optional)

If you connect your profile, you sign in with Google and grant the https://www.googleapis.com/auth/business.manage scope. We use that access only to read the reviews of the locations you connect and to publish replies — those you approved, or, if you switched on automatic replies, those within the limits you set. We store one encrypted OAuth refresh token per connected account and the IDs of the connected locations — nothing else from your Google account.

Data obtained through Google APIs is used only to provide these features. We do not sell it, use it for advertising, transfer it to third parties other than the service providers in section 4, or use it to train AI models. This complies with the Google API Services User Data Policy, including its Limited Use requirements.

You can disconnect at any time in Settings or at myaccount.google.com/permissions. On disconnection we delete the stored token immediately.

Legal basis: Art. 6(1)(b) GDPR.

2.6 Free Visibility Report (replefy.com/report)

  • Anyone can request a report for a Google Maps link without an account. We fetch public business data (rating, review count, photos, opening hours, recent reviews to check for owner replies) from Google and SerpApi and store the result for 7 days so repeated requests do not cost again.
  • To prevent abuse we limit requests per IP address. The IP address is stored with the request and deleted after 24 hours.
  • We count report visits by Google place ID and an optional campaign code — without IP address or device data.
  • If you enter your email address under the report, we store it on our contact list (the same list as the Pro waitlist, see 2.7) to get in touch with you about Replefy.
  • Legal basis: Art. 6(1)(f) GDPR (providing the free tool and protecting it from abuse).

2.7 Pro waitlist and contact requests

  • Data: your email address (and your account ID if you are signed in).
  • Why: to tell you when your Pro spot opens, or — if you left it under a Visibility Report — to contact you about Replefy.
  • Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time by emailing support@replefy.com; we then delete your entry.

2.8 Review cards (QR/NFC)

If you use Replefy review cards, each scan is counted with a timestamp and the device type (iOS/Android/other) only — no IP address, no user agent, no data about the person scanning. Legal basis: Art. 6(1)(b) GDPR.

2.9 Payments

Paid plans are not available yet. When they are, payments will be handled by Stripe; we will never see or store your card details. We will update this policy before that happens.

2.10 Website hosting and server logs

When you visit replefy.com, our server receives technical data your browser sends (IP address, time, requested page, browser type) in order to deliver the page. We do not keep access logs; our server only records errors, without IP addresses.

Our automation server keeps a record of each processing run (which can include the review text being answered) for up to 14 days for troubleshooting, then deletes it automatically.

Fonts are served from our own server. Our public pages load no content from third-party servers; the signed-in app only talks to our own service providers (section 4). We use no analytics and no tracking.

Legal basis: Art. 6(1)(f) GDPR (secure and stable operation of the website).

3. Cookies and local storage

We only use what is strictly necessary for the service: the login session of our authentication provider (stored in your browser's local storage) and a note that you have seen our cookie notice. No advertising or analytics cookies, no tracking pixels. Strictly necessary storage does not require consent (Art. 22(2) LSSI, Art. 5(3) ePrivacy Directive).

4. Service providers and international transfers

We use the following providers to run Replefy. They receive personal data only as far as needed for the service they provide to us.

  • Supabase (Supabase Pte. Ltd., Singapore; Supabase, Inc., USA)

    Database, authentication, file storage, server functions

    Data stored in London, UK (EU adequacy decision); operations and support access from the USA and Singapore under the EU Standard Contractual Clauses

  • Hetzner Online GmbH

    Server for our website and automation workflows (these process review texts and business details); encrypted backups

    Germany (EU)

  • OpenAI Ireland Ltd. (with OpenAI OpCo, LLC, USA)

    Drafting replies and posts

    Ireland (EU); onward transfers to the USA under the EU Standard Contractual Clauses

  • Anthropic Ireland, Limited (with Anthropic, PBC, USA)

    Drafting replies and posts (alternative provider)

    Ireland (EU); onward transfers to the USA under the EU Standard Contractual Clauses

  • Resend (Plus Five Five, Inc.)

    Sending emails

    Sending region Ireland (EU); company in the USA

  • Google (Google Ireland Ltd. / Google LLC)

    Places API and Business Profile API (business data, reviews); Sign in with Google

    EU / USA

  • Apple Inc.

    Sign in with Apple (only if you choose it)

    USA

  • SerpApi, LLC

    Fetching public Google business data and reviews

    USA

  • Namecheap, Inc.

    Forwarding of emails sent to our @replefy.com addresses

    USA

  • Google (Gmail)

    Our inbox: forwarded emails are stored there

    USA / EU

  • Stripe

    Payments, once paid plans exist

    EU / USA

Transfers outside the EU/EEA: for providers in the USA and Singapore, transfers are based on the EU–U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). For the UK, the European Commission's adequacy decision applies. You can request a copy of the safeguards at support@replefy.com.

We do not sell personal data and do not use it for advertising.

5. How long we keep data

  • Account and business data, reviews, drafts, posts: as long as your account exists.
  • Deleting your account (Settings → Account → Delete account) removes your account and all associated data immediately. Encrypted nightly backups of our database are stored on our server in Germany (Hetzner) and deleted after 7 days, so a deleted account disappears from all backups within 7 days.
  • Email delivery log: 12 months; the suppression list for as long as needed to respect your unsubscribe.
  • Waitlist: until you withdraw consent or Pro launches and you have been informed.
  • Visibility Report: results 7 days in the cache, IP addresses 24 hours.
  • Automation run records: up to 14 days.
  • Where the law requires longer retention (for example tax records for paid plans), we keep the data for that period only.

6. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): where we process your data on the basis of legitimate interests (Art. 6(1)(f)), you can object at any time on grounds relating to your particular situation. If you are a reviewer whose public Google review was imported by a business using Replefy, you can also contact us directly; we will forward your request to that business and stop processing where your interests prevail.

To exercise your rights, email support@replefy.com. We answer within one month.

You also have the right to lodge a complaint with a supervisory authority — in Spain the Agencia Española de Protección de Datos (aepd.es), or the authority in your country of residence.

7. Security

Data is encrypted in transit (TLS) and at rest by our database provider. Google OAuth tokens are additionally encrypted before storage. Access is restricted per account by database row-level security.

8. Minimum age

Replefy is a service for businesses and is not intended for anyone under 18.

9. Changes

We will update this policy when our service or the law changes. For material changes we inform registered users by email in advance.

Questions or requests? support@replefy.com