Privacy Policy — ReplyMark

🔐 The short version: We store the minimum we need to run the service (your email, plan, and business config). When you click "AI Reply", the review text is sent to Google Gemini in real-time and is not retained on our servers. We do not sell your data and do not train AI on it.

1. What We Collect

To operate ReplyMark, we store:

Your email address and (hashed) password — for sign-in
Your business name, city, and primary service — used to generate accurate, SEO-rich replies
Optional secondary keywords for keyword rotation
Your Fact-Sheet (services, hours, pricing notes, certifications, "do not promise" rules, team names, custom notes) — improves reply accuracy
Your subscription plan (Free / Pro), founding-member status, and monthly reply count — for billing and feature gating
The Gumroad sale ID associated with your Pro subscription, if any

We do NOT store the customer review text, the reviewer's name, or your generated replies. When you click "AI Reply", the review text is sent to Google Gemini for processing, the response is sent back to your browser, and nothing is persisted on our servers.

2. Google Gemini API

AI Processing — Important

Replies are generated via the Google Gemini API. When you click "AI Reply", the customer review text and your business config are sent to Google's infrastructure for processing. Google's API terms govern how they handle that data — please review them at ai.google.dev/terms. ReplyMark itself does not retain the review text after the API call completes.

Note: the customer review you are replying to is already public on Google Maps. ReplyMark is acting on your behalf to draft a reply to that public content.

3. How We Use Your Data

To generate AI replies (real-time call to Google Gemini, not retained)
To run your account, fact-sheet, and reply-count meter
To check whether a review may violate Google's review policies (Pro feature)
To process your subscription via Gumroad and apply your plan
To send you essential service emails: signup confirmation, password reset, subscription confirmations, and account deletion notices

4. Third-Party Services

Google Gemini API — review text passes through for reply generation. Governed by Google's API terms.
Supabase — account data, business config, and Fact-Sheet are stored here. GDPR-compliant, ISO 27001 certified.
Gumroad — payment processing for Pro subscriptions. Gumroad receives your email and payment details directly; we never see your card number. Gumroad handles VAT/GST automatically.
Resend — transactional email delivery (signup confirmation, password reset, subscription notices, account deletion notices). Resend processes only the email address and the message contents.
Vercel — hosts our web app and serverless API. Standard request logs (IP, user agent, timestamp) are retained for security purposes per Vercel's policy.

5. Data Retention & Your Control

Your account data is retained while your account is active. We do not retain raw review text or generated replies on our servers.

You have full control over your data:

Access & correction: sign in to your dashboard and the Fact-Sheet to view or update your business config at any time
Account deletion: use the "Delete account" button in your dashboard's Danger Zone. After confirmation we schedule deletion 14 days out. You can cancel within those 14 days. After 14 days, all your data is hard-deleted from our database via cascade delete.
Active Pro subscription: deletion does NOT cancel your Gumroad subscription. You must cancel it on Gumroad separately to stop future charges.
Data export: if you would like a portable export (JSON) of your stored business config and Fact-Sheet, email us at hello@replymark.app with subject "Data Export Request" — we will action within 7 days.

6. Your Rights (GDPR — EU / UK)

If you are in the EEA, UK, or Switzerland, you have the right to access, correct, export, or delete your personal data at any time. The dashboard's Danger Zone gives you a self-serve deletion path. For anything else, contact us at hello@replymark.app.

Customer data is stored in Supabase's Northeast Asia (Tokyo) region.

7. AI Training

We do not train AI models on your data. ReplyMark is an API consumer. Whether Google uses Gemini API calls for training is governed by Google's terms (see Section 2 above).

8. Chrome Extension

The ReplyMark Chrome extension is injected only on Google Business Profile review pages (business.google.com/* and www.google.com/local/*). It reads the review text and reviewer information visible to you on the page, sends it to our API along with your business config when you click "AI Reply", and inserts the generated reply into your browser's reply box. The extension does not log, cache, or transmit any other data from those pages.

The extension stores your sign-in token and a copy of your business config locally in chrome.storage for offline rendering. This is cleared on sign-out.

9. Cookies & Tracking

We do not use third-party tracking cookies or analytics. Supabase sets a session cookie for sign-in. Vercel may set a CDN cookie for routing. That is the full extent of cookies on our web app.

10. Children's Privacy

ReplyMark is intended for business owners and is not directed at anyone under 16. We do not knowingly collect data from minors.

11. Changes to this Policy

If we make material changes to this policy, we will email all active users at least 14 days before the change takes effect. Trivial wording changes will not trigger a notification.

12. Contact

All privacy questions, data requests, and complaints: hello@replymark.app
Data Controller: LogicLooms Lab · Akshay Sharma · India