1. Who we are
Replykar ("we", "us", "our") is an AI-powered Google Business review management web application for small and medium businesses. We are operated by Replykar, India.
If you have any questions about this Privacy Policy, contact us at replykar27@gmail.com.
2. What data we collect
2.1 Account information
- Your full name and email address (provided by Google sign-in)
- Your Google profile picture
- Business name and business type (entered during onboarding)
- Owner name or signature used in review replies
2.2 Google Business data
- Your Google Business Profile location name and address
- Customer reviews on your Google Business listing
- Replies posted to those reviews through Replykar on your behalf
- Your Google Business account name (account ID)
2.3 Usage and technical data
- Pages visited within the Replykar dashboard
- Features used (reply tone selection, QR downloads, settings changes)
- Log data: IP address, browser type, device type, timestamps
- Session data stored in encrypted cookies
2.4 Payment data
All payment processing is handled by Paddle, our Merchant of Record. We never receive or store your card number, bank account details, or any payment credentials. Replykar only stores your subscription status (trial / active / cancelled) and Paddle transaction reference IDs for our records. Paddle separately collects billing details (such as your billing address and country) needed to calculate and collect any applicable sales tax/VAT.
3. How we use your data
- To provide the Replykar service — fetching your Google reviews, generating AI replies, and posting approved replies on your behalf
- To send email alerts when 1–3 star negative reviews arrive on your listing
- To show your reputation analytics on the dashboard (rating trend, reply count, review breakdown)
- To generate your QR code linked to your Google review page
- To process your subscription payments through Paddle
- To send important service communications (subscription renewal, trial expiry warnings)
- To improve our AI reply quality — only using anonymised, aggregated patterns, never individual review content tied to your account
- To measure how visitors find and use our marketing pages, and to measure the effectiveness of our advertising, using Google Analytics and Meta (Facebook) Pixel — see Section 9, Cookies for details
We never sell your data. We never use your review content for advertising, and we never share your Google Business or review data with any third party for marketing purposes. Anonymous browsing and conversion data shared with Google/Meta for site analytics and ad measurement is described in Section 9 below.
4. Google data access — exactly what we can and cannot see
Replykar connects to your Google Business Profile using Google's official OAuth 2.0 protocol. You authorise us by clicking "Sign in with Google" and approving specific permissions on Google's own consent screen.
What we CAN access (only what you authorise)
- Your Google Business Profile account name and location details
- Customer reviews posted on your Google Business listing
- The ability to post reply comments on those reviews on your behalf
- Your basic Google profile (name, email, profile picture) for your account
What we CANNOT access and never request
- Your Gmail inbox, sent mail, or any email content
- Your Google Drive files or Google Docs
- Your Google Calendar events
- Your Google Contacts
- Your YouTube account or history
- Any other Google service beyond what is listed above
You can revoke Replykar's access at any time by visiting myaccount.google.com/permissions and removing Replykar from your authorised apps. Your account on Replykar will pause but your data will remain until you request deletion.
Google API compliance: Replykar's use of Google APIs strictly complies with the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for any purpose other than providing and improving Replykar's features.
5. Data sharing
We do not sell, rent, or trade your personal data. We share data only with the following service providers, strictly to operate Replykar:
- Paddle — payment processing and Merchant of Record. Your payment data is governed by Paddle's Privacy Policy. We share only your email and order amount for payment processing.
- Anthropic (Claude AI) — review text is sent to Anthropic's API to generate reply suggestions. Data is processed under Anthropic's API data policies. Anthropic does not use API data to train their models.
- Google Analytics — used on our marketing pages to understand site traffic and usage. Google may set cookies and process data under Google's Privacy Policy.
- Meta (Facebook) Pixel — used on our marketing pages to measure the effectiveness of our advertising. Meta may set cookies and process data under Meta's Privacy Policy.
- Legal obligations — if required by law, court order, or government authority. We will notify you of any such request unless prohibited by law from doing so.
6. Data retention
- Account data — retained for the duration of your subscription plus 30 days after cancellation, then permanently deleted
- Review and reply data — retained for up to 12 months for dashboard analytics
- Payment records — transaction reference IDs retained for 7 years for accounting and tax-compliance purposes
- Log data — retained for 90 days then automatically deleted
You may request immediate deletion of all your data (excluding legally required payment records) at any time by emailing replykar27@gmail.com. We will process deletion within 14 working days.
7. Your rights
Wherever you're located, you have the following rights over your data with Replykar — including rights recognised under frameworks such as the EU/UK GDPR, where applicable to you:
- Right to access — request a copy of all personal data we hold about you
- Right to correction — request correction of inaccurate or incomplete data
- Right to deletion — request deletion of your account and all associated personal data
- Right to data portability — request your data in a structured, machine-readable format
- Right to withdraw consent — disconnect Google access or cancel your subscription anytime without penalty
- Right to grievance redressal — file a complaint with us if you believe your data has been handled improperly
To exercise any of these rights, email replykar27@gmail.com with the subject line "Data Rights Request". We will acknowledge within 48 hours and respond fully within 30 days.
8. Security
- All data transmitted between your browser and Replykar is encrypted via HTTPS/TLS
- Google OAuth tokens are stored in encrypted, httpOnly server-side sessions — never exposed in URLs or local storage
- Passwords (if email sign-in is used) are hashed with bcrypt — we never store plaintext passwords
- Payment data never touches our servers — handled entirely by Paddle's PCI DSS Level 1 certified infrastructure
- We do not store your Google Client Secret in the frontend — it lives only on our secured backend server
If you discover a security vulnerability in Replykar, please report it responsibly to replykar27@gmail.com.
9. Cookies
On the application itself (your dashboard), Replykar uses only the minimum cookies required for the service to function securely:
- Session cookie — keeps you logged in during your browsing session. Expires when you close your browser or sign out.
- CSRF token cookie — protects your account against cross-site request forgery attacks.
On our international marketing pages (the pages you see before signing up), we additionally use:
- Google Analytics (
_ga, _gid and similar cookies) — to understand how visitors find and use our marketing pages. You can opt out using the Google Analytics Opt-out Browser Add-on.
- Meta (Facebook) Pixel (
_fbp and similar cookies) — to measure and improve the effectiveness of our advertising. You can manage how Meta uses your data for ads via your Facebook Ad Preferences.
We do not use these advertising/analytics cookies within the logged-in dashboard itself, and we do not sell any data collected this way.
10. Changes to this policy
If we make material changes to this Privacy Policy, we will notify you by email (to your registered email address) at least 14 days before the changes take effect. Continued use of Replykar after that date constitutes acceptance of the updated policy.
Minor updates (corrections, clarifications) may be made without notice. The "Last updated" date at the top of this page always reflects the most recent version.
11. Contact us
For any privacy-related questions, data requests, or concerns:
We aim to respond to all privacy queries within 48 hours on working days.