Privacy policy

The data controller is [to be completed], [to be completed], with its registered office at [to be completed], registered under number [to be completed].

For any question about your data: privacy@reviewsly.co.

• Account: email address, password (stored hashed by our authentication provider), language, notification preferences.
• Google Business Profile data, accessible only after you authorise it: accounts and locations (name, address, category, identifiers, verification state), reviews (reviewer display name and profile photo, rating, text, dates) and their replies.
• Google access tokens (OAuth), encrypted before storage.
• Your writing instructions (prompt) and automation settings (ratings covered, reply time, time zone).
• The record of your automation authorisation: date, authorised scope, IP address and browser.
• Technical metrics about AI generations (model, token counts, cost, duration) — without the text of reviews or replies.
• Technical logs required for security and troubleshooting.

Access. We access your Google Business Profile data only after you connect your Google account through Google's authorisation screen. We request a single permission: https://www.googleapis.com/auth/business.manage, which is required to read your locations and reviews and to publish replies.

Use. This data is used exclusively to provide the service: displaying your reviews and statistics, generating replies, publishing the replies you have authorised, and alerting you when a review needs your attention. We do not use it for advertising or profiling, and we do not sell it.

AI generation. To write a reply, the review text, its rating, the reviewer's first name and your business name are sent to our processor OpenAI, solely for that purpose. Data sent through its API is not used to train its models. We do not use Google data to develop, improve or train generalised AI models.

Storage. Access tokens are encrypted (AES-256-GCM). Review content is kept in a temporary cache, refreshed regularly from Google, and deleted if it has not been re-validated for 30 days. It is deleted immediately when you disconnect your Google account or delete your Reviewsly account. We do not aggregate data across customers.

Human access. Our team does not access your Google data, except with your explicit agreement (for instance for a support request), for security or abuse-prevention purposes, or to comply with a legal obligation.

Limited Use commitment: "Reviewsly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements." — https://developers.google.com/terms/api-services-user-data-policy

Revocation. You can withdraw access at any time from Reviewsly (Locations → Disconnect) or from your Google account: https://myaccount.google.com/permissions.

• Providing the service (performance of the contract): account creation, review synchronisation, reply generation and publication, alerts.
• Automating replies (your express consent): no reply is published automatically without your prior, specific and express authorisation, which you can withdraw at any time.
• Security, abuse prevention and cookieless audience measurement (legitimate interest).
• Compliance with our legal obligations.

• Supabase — database and authentication, hosted in the European Union.
• Vercel — application hosting.
• OpenAI — reply generation.
• Resend — email delivery.
• Google — Business Profile API (source of reviews and destination of replies).

Where data is transferred outside the European Union, those transfers are covered by appropriate safeguards (European Commission standard contractual clauses or an equivalent mechanism).

• Account data: for the lifetime of the account, then deleted after closure.
• Google review content: temporary cache, deleted if not re-validated for 30 days, and immediately on disconnection.
• Google tokens: until the Google account is disconnected or the Reviewsly account is deleted.
• Automation authorisation records: for as long as needed as evidence, within applicable limitation periods.
• Technical logs: a limited period, proportionate to security and troubleshooting needs.

You have the right to access, rectify, erase, restrict, object to and port your data, and to withdraw your consent at any time. Write to us at privacy@reviewsly.co. You can delete your account from the application settings.

You may also lodge a complaint with your data protection authority (in France: the CNIL, www.cnil.fr).

Reviewsly only uses cookies strictly necessary for the service to work (session, language choice). Our audience measurement is cookieless. We use no advertising cookies.

Traffic is encrypted (HTTPS). Google tokens are encrypted before storage. Each account's data is isolated at database level, and access to systems is restricted.

Reviewsly is intended for professionals. The service is not directed at minors.

We may update this policy. For significant changes, we will notify you by email or in the application before they take effect.