1. Who we are
Replykar ("we", "us", "our") is an AI-powered Google Business review management web application built for Indian small and medium businesses. We are operated by Replykar, India.
If you have any questions about this Privacy Policy, contact us at replykar27@gmail.com or WhatsApp +91 99749 76949.
2. What data we collect
2.1 Account information
- Your full name and email address (provided by Google sign-in)
- Your Google profile picture
- Business name and business type (entered during onboarding)
- Owner name or signature used in review replies
2.2 Google Business data
- Your Google Business Profile location name and address
- Customer reviews on your Google Business listing
- Replies posted to those reviews through Replykar on your behalf
- Your Google Business account name (account ID)
2.3 Usage and technical data
- Pages visited within the Replykar dashboard
- Features used (reply tone selection, QR downloads, settings changes)
- Log data: IP address, browser type, device type, timestamps
- Session data stored in encrypted cookies
2.4 Payment data
All payment processing is handled by Razorpay. We never receive or store your card number, UPI ID, bank account details, or any payment credentials. Replykar only stores your subscription status (trial / active / cancelled) and Razorpay transaction reference IDs for our records.
3. How we use your data
- To provide the Replykar service — fetching your Google reviews, generating AI replies, and posting approved replies on your behalf
- To send email alerts when 1–3 star negative reviews arrive on your listing
- To show your reputation analytics on the dashboard (rating trend, reply count, review breakdown)
- To generate your QR code linked to your Google review page
- To process your subscription payments through Razorpay
- To send important service communications (subscription renewal, trial expiry warnings)
- To improve our AI reply quality — only using anonymised, aggregated patterns, never individual review content tied to your account
We never sell your data. We never use your review content for advertising. We never share your personal information with any third party for marketing purposes.
4. Google data access — exactly what we can and cannot see
Replykar connects to your Google Business Profile using Google's official OAuth 2.0 protocol. You authorise us by clicking "Sign in with Google" and approving specific permissions on Google's own consent screen.
What we CAN access (only what you authorise)
- Your Google Business Profile account name and location details
- Customer reviews posted on your Google Business listing
- The ability to post reply comments on those reviews on your behalf
- Your basic Google profile (name, email, profile picture) for your account
What we CANNOT access and never request
- Your Gmail inbox, sent mail, or any email content
- Your Google Drive files or Google Docs
- Your Google Calendar events
- Your Google Contacts
- Your YouTube account or history
- Any other Google service beyond what is listed above
You can revoke Replykar's access at any time by visiting myaccount.google.com/permissions and removing Replykar from your authorised apps. Your account on Replykar will pause but your data will remain until you request deletion.
Google API compliance: Replykar's use of Google APIs strictly complies with the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for any purpose other than providing and improving Replykar's features.
5. Data sharing
We do not sell, rent, or trade your personal data. We share data only with the following service providers, strictly to operate Replykar:
- Razorpay — payment processing. Your payment data is governed by Razorpay's Privacy Policy. We share only your email and order amount for payment processing.
- Anthropic (Claude AI) — review text is sent to Anthropic's API to generate reply suggestions. Data is processed under Anthropic's API data policies. Anthropic does not use API data to train their models.
- Legal obligations — if required by Indian law, court order, or government authority. We will notify you of any such request unless prohibited by law from doing so.
6. Data retention
- Account data — retained for the duration of your subscription plus 30 days after cancellation, then permanently deleted
- Review and reply data — retained for up to 12 months for dashboard analytics
- Payment records — transaction reference IDs retained for 7 years as required under the Indian Companies Act and GST laws
- Log data — retained for 90 days then automatically deleted
You may request immediate deletion of all your data (excluding legally required payment records) at any time by emailing replykar27@gmail.com. We will process deletion within 14 working days.
7. Your rights
Under the Information Technology Act 2000 and the Digital Personal Data Protection Act 2023 (India), you have the following rights:
- Right to access — request a copy of all personal data we hold about you
- Right to correction — request correction of inaccurate or incomplete data
- Right to deletion — request deletion of your account and all associated personal data
- Right to data portability — request your data in a structured, machine-readable format
- Right to withdraw consent — disconnect Google access or cancel your subscription anytime without penalty
- Right to grievance redressal — file a complaint with us if you believe your data has been handled improperly
To exercise any of these rights, email replykar27@gmail.com with the subject line "Data Rights Request". We will acknowledge within 48 hours and respond fully within 30 days.
8. Security
- All data transmitted between your browser and Replykar is encrypted via HTTPS/TLS
- Google OAuth tokens are stored in encrypted, httpOnly server-side sessions — never exposed in URLs or local storage
- Passwords (if email sign-in is used) are hashed with bcrypt — we never store plaintext passwords
- Payment data never touches our servers — handled entirely by Razorpay's PCI DSS Level 1 certified infrastructure
- We do not store your Google Client Secret in the frontend — it lives only on our secured backend server
If you discover a security vulnerability in Replykar, please report it responsibly to replykar27@gmail.com.
9. Cookies
Replykar uses only the minimum cookies required for the service to function securely:
- Session cookie — keeps you logged in during your browsing session. Expires when you close your browser or sign out.
- CSRF token cookie — protects your account against cross-site request forgery attacks.
We do not use advertising cookies, retargeting pixels, Google Analytics, Facebook Pixel, or any third-party tracking cookies. We do not track you across other websites.
10. Changes to this policy
If we make material changes to this Privacy Policy, we will notify you by email (to your registered email address) at least 14 days before the changes take effect. Continued use of Replykar after that date constitutes acceptance of the updated policy.
Minor updates (corrections, clarifications) may be made without notice. The "Last updated" date at the top of this page always reflects the most recent version.
11. Contact us
For any privacy-related questions, data requests, or concerns:
We aim to respond to all privacy queries within 48 hours on working days.