Privacy Policy

• We collect only what we need to provide the service.
• We do not sell or share personal information, and we do not use it for targeted advertising.
• Reviews and replies are not used to train artificial-intelligence models.
• We never ask for, or see, your Google password.
• We use only the cookies the service needs to work. There is no analytics or advertising tracking.

When someone scans one of your review QR codes, we record only that a scan happened and when. We store no IP address, device identifier or cookie for the scan, and we do not track whether a review was left.

• To provide the service: setting up accounts, retrieving reviews, drafting and publishing replies, showing statistics, sending service emails.
• To bill for subscriptions and keep financial records.
• To run the Partner Program: crediting businesses to the partners who introduced them, calculating and paying commissions, screening payees against sanctions lists and meeting tax reporting obligations.
• To secure the service: authentication, fraud and abuse prevention, rate limiting, audit logs.
• To support you, respond to messages and send notices about your account and our terms.
• To prepare your account: our team may gather public information about your business, such as your Google listing and website, to configure accurate replies.
• To improve the service, using aggregated or de-identified information.
• To comply with law, enforce our terms and protect our rights.

Authorized members of our team can see account data, reviews and replies when they set up or support an account, investigate a problem or enforce our terms.

To draft a reply, we send the review and the business's configured voice, facts and rules to our AI model provider. The provider processes them to return a draft and does not use content submitted through its API to train its models. We do not use reviews, replies or other customer content to train AI models. Replies are drafted, not decided, by AI: the business chooses whether each reply needs its approval before it is published.

• Service providers that host, process or deliver data for us under contract, listed on our sub-processor page.
• Google, to which replies are sent for publication on the business's Google Business Profile.
• Stripe, which processes payments as the merchant of record for subscriptions bought at checkout.
• The partner who introduced a business, if one did: the business name, the contact details the partner entered, whether the account is activated and subscribed, its plan, and the payments the partner's commission is based on. Never reviews, replies, Google data or payment details.
• Banks and payment providers, such as PayPal and Wise, that send payouts to partners, and tax authorities, such as the Internal Revenue Service, when the law requires us to report payments to partners.
• Legal and safety: when required by law or legal process, or to protect the rights, property or safety of our users, the public or us.
• Business transfers: to a successor in a merger, acquisition or sale of assets, subject to this policy.
• With your direction or consent.

We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not use or disclose sensitive personal information for any purpose that would give rise to a right to limit it.

We use only strictly necessary cookies: a secure session cookie that keeps you signed in, the security cookies that protect sign-in forms, and, for administrator accounts, a cookie recording that two-factor verification was completed. We use no analytics, advertising or third-party tracking cookies, and we do not track you across other websites. Because we do not sell, share or track, there is nothing for a Global Privacy Control or Do Not Track signal to switch off; we treat a Global Privacy Control signal as a valid opt-out request regardless.

Data is encrypted in transit and stored with providers that encrypt it at rest. Passwords are stored only as one-way hashes; activation and password-reset links are single-use and expire. Each business's data is isolated from every other's, administrator accounts require two-factor authentication, administrator actions and agreement acceptances are kept in records that cannot be altered, and partners' payout details and tax forms are encrypted by us before they are stored, so that only the team member who sends payouts can open them. No method of protection is perfect; if a breach affects your personal information, we will notify you as the law requires.

Depending on the state you live in, the law may give you rights over your personal information. We offer the following to every user, wherever in the United States they live:

• Know and access: the categories and specific pieces of personal information we hold about you, and how we use and disclose them.
• Correct inaccurate personal information.
• Delete personal information, subject to legal exceptions.
• Portability: a copy of your personal information in a portable format.
• Opt out of the sale or sharing of personal information, targeted advertising and significant automated profiling. We do none of these, so there is nothing to opt out of, but you may still make the request.
• Non-discrimination: we will not treat you differently for exercising your rights.

To make a request, write to support@replytune.com. We will verify your request by matching it to the email address on the account, respond within 45 days, and tell you if we need up to 45 more days. You may use an authorized agent; we may ask the agent for proof of authorization and ask you to confirm your identity with us directly.

Appeals. If we decline your request, you may appeal by replying to our decision or writing to support@replytune.com with "Privacy appeal" in the subject line. We will respond in writing within the time your state's law allows, generally 45 or 60 days. If you are not satisfied with the outcome, you may contact your state attorney general.

When you join the Partner Program, we ask only for your name, email address, password, country and, if you join for a company, its name and website. We use them to run your Partner account, credit the businesses you introduce to you and calculate your commissions.

We ask for financial and tax information only when you have money to be paid, before your first payout: your payout method and account details, your legal name, country of tax residence and tax classification, and the IRS form that applies to you (Form W-9, W-8BEN or W-8BEN-E). We use them only to pay you, to screen payees against U.S. sanctions lists and to meet tax obligations, such as reporting payments to the Internal Revenue Service. Your account details are shown back to you masked, and your tax form is never shown to anyone outside our team.

The contact details you enter for a business you introduce are used to invite that business and to provide our service to it, as Section 2 and Section 5 describe. If you live outside the United States, your information is transferred to and processed in the United States. We offer the rights in Section 9 to every partner, wherever they live.

When you post a public review on Google, the business you reviewed may use ReplyTune to read it and reply. We process your public display name, profile photo link and review for that business, as its service provider, under its instructions and our Data Processing Addendum. We do not use your review for any other purpose, and the reply is published by the business, in its name.

To exercise a privacy right over your review, contact the business you reviewed, or edit or delete the review on Google. If you write to us, we will forward your request to the business.

In the past 12 months we have collected the categories of personal information described in Section 2: identifiers, customer records information, commercial information, internet or other electronic network activity information, and professional or employment-related information (your role at your business), and, for partners only, the taxpayer identification number on a tax form and the account details a payout is sent to. We collected it from the sources and used it for the business purposes described above, and disclosed each category to the service providers listed on our sub-processor page for those purposes. We do not sell or share personal information, including that of consumers under 16. Under California's "Shine the Light" law, we do not disclose personal information to third parties for their direct marketing purposes.

ReplyTune is a service for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.

We are based in the United States, and personal information is processed in the United States. Our automation provider, which carries reviews and replies between Google and ReplyTune, processes them in the European Union. Each provider's location is listed on our sub-processor page.

Every version of this policy carries a version number and an effective date. If we make a material change, we will tell account holders by email or in the dashboard before it takes effect.

For privacy questions and requests, write to support@replytune.com or by mail to Primanza LLC, c/o Northwest Registered Agent Service Inc, 30 N Gould St Ste N, Sheridan, Wyoming 82801, United States.