Privacy Policy — ReviewReply Chrome Extension

ReviewReply ("we", "us", "our") is an online service based in the United Kingdom that helps local businesses reply to their Google reviews. This policy explains what user data the ReviewReply Chrome extension (extension ID mnlaeooeklnembhfbejkcfeoedafnmji) and the ReviewReply service it connects to at reviewreply.uk collect, how we handle and use that data, where and for how long we store it, and every party we share it with.

We are the data controller for the personal data described here. If you have any questions, email us at supportreviewreply@gmail.com.

2. Summary

The extension works only on your Google Business Profile reviews page (business.google.com/reviews) and on our own demo page (reviewreply.uk/test-reviews). It reads a review only when you click "Generate Reply" on it.
We collect: your Google account details (email address, name, profile picture link and account ID), sign-in tokens, the reviews you ask us to reply to, the replies we generate, the business profile you set up, and usage data.
We use this data only to provide and improve ReviewReply. We never sell it, never use it for advertising and never use it to train AI models.
We share it only with the service providers named in section 7: Anthropic (AI replies), Supabase (database and sign-in), Vercel (hosting), PostHog (product analytics), Google (Sign in with Google) and Stripe (payments).
Replies are never posted automatically. You review, edit and post every reply yourself.

3. Data collection: what we collect and how

The table below lists all user data that the extension and the ReviewReply service collect.

Data	When and how it is collected	Why we collect it
Google account details (personally identifiable information): email address, name, profile picture link and Google account ID	When you choose "Sign in with Google". Google shares these details with us through our authentication provider, Supabase. We never see your Google password.	To create your account and sign you in. We use your email address to identify your account and to answer your support requests. We do not use your name or profile picture for anything else.
Sign-in session tokens (authentication information): an access token and a refresh token	Issued when you sign in, then stored in your browser with `chrome.storage.local`. They are sent only to our server (reviewreply.uk) and to Supabase.	To keep you signed in and to prove it is you when the extension asks our server for a reply.
Review content (website content): the review text, the reviewer's publicly displayed name and the star rating	Read from the page only when you click "Generate Reply" on that review. The extension does not read anything else on the page, and does not read any other website.	To write a reply suggestion for that review and to save it to your reply history.
Generated replies	Created by our AI provider and saved to your account. If you mark a reply as posted in the dashboard, we save that too.	To show your reply history and statistics, such as your response rate.
Business profile: business name and type, Google Business Profile link, example replies you paste, an AI-written summary of your brand voice, and optional "contact info for negative reviews" (for example, a business email address or phone number)	Entered by you in the ReviewReply dashboard at reviewreply.uk.	To make replies sound like your business and, when you provide contact details, to invite unhappy customers to contact you.
Usage data (user activity): the time of each reply you generate, the star rating of the review, your monthly usage count, product events (such as signing up, analysing your brand voice and changing plan) and technical error reports	Recorded by our server when you use ReviewReply.	To apply your plan's monthly limit, prevent abuse, fix errors and understand how ReviewReply is used so we can improve it. We do not record keystrokes, mouse movements, scrolling or the pages you visit with the extension.
Subscription data: your plan, subscription status, renewal date and Stripe customer ID	From Stripe, if you upgrade to a paid plan. You enter payment details directly on Stripe's checkout page.	To give you the features of your plan. We never see your card number.
Technical data: IP address, browser type and request details	Processed automatically by our hosting and authentication providers whenever your browser or the extension connects to our servers, and kept in short-lived security logs.	To deliver the service, keep it secure and investigate abuse. We do not use it to track your location.
Website cookies and analytics (reviewreply.uk only, not the extension)	You sign in on our website. It sets essential cookies to keep you signed in. Only if you choose "Accept all" in our cookie banner, PostHog analytics cookies also record the pages you view on reviewreply.uk, your browser and device type, and your approximate location (city or country), worked out from your IP address. Analytics never runs on our sign-in and sign-in-complete pages.	Essential cookies are needed for sign-in. Analytics cookies help us understand how the website is used and are optional.

4. Data we do not collect

5. Data handling: how we use your data

How a reply is generated: when you click "Generate Reply", the extension sends the review text, the reviewer's name and the star rating over HTTPS to our server. Our server adds your business profile and sends them to Anthropic's Claude AI, which writes a suggestion. We save the suggestion to your reply history and show it to you in the extension. Nothing is posted to Google unless you post it yourself.

6. Data storage: where we keep your data, how we protect it and for how long

Where it is stored

How it is protected

International transfers

Some of our providers, including Anthropic, Vercel, Supabase and Stripe, may process data in the United States or other countries outside the UK. When data leaves the UK, we rely on the safeguards in our providers' data processing terms, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK–US Data Bridge.

How long we keep it

7. Data sharing: who we share your data with

We share user data only with the following parties, and only as needed to run ReviewReply. Anthropic, Supabase, Vercel and PostHog process the data on our behalf under data processing terms. Google (for sign-in) and Stripe (for payments) also handle the data they receive under their own privacy policies.

Party	What it does for us	Data it receives
Anthropic, PBC (USA)	AI provider that writes reply suggestions and brand voice summaries (Claude).	The review text, reviewer's name and star rating; your business name, business type, brand voice summary and contact info for negative reviews; and the example replies you paste, but only when you run brand voice analysis.
Supabase, Inc.	Database and authentication (sign-in) provider.	Your Google account details, session tokens, business profile, reply history, subscription status and usage counts, and the IP address and browser details in sign-in logs.
Vercel, Inc.	Hosts the reviewreply.uk website and the server the extension talks to.	Every request to our server passes through Vercel, including the review content the extension sends. Vercel keeps short-lived request logs, including IP addresses.
PostHog, Inc. (EU cloud)	Product analytics and error tracking.	Your account ID; your email address (recorded once, when you sign up); usage events such as "reply generated" with the review's star rating, "signed up", "brand voice analysed" and plan changes; technical error reports; and, only if you accept analytics cookies, the website data described in section 3. PostHog never receives review text, reviewer names, generated replies, your business profile or your session tokens.
Google LLC	Provides "Sign in with Google".	Google handles your sign-in and tells us your email address, name, profile picture link and account ID. We do not access Gmail, Drive, Calendar, Contacts or any other Google service. The extension does not send your data to Google. You post replies to Google yourself.
Stripe, Inc.	Payment processing for paid plans.	Your email address, your account ID and the plan you choose. You give your payment details directly to Stripe.

We may also disclose data if the law requires it, to protect the rights, property or safety of our users or others, or as part of a merger, acquisition or sale of our business. In a sale, we would tell you in advance, and your data would stay protected by this policy.

We do not share user data with advertisers, advertising networks, data brokers or any other third parties.

8. Permissions used by the extension

The extension cannot see your browsing history and does not load remote code: all the code it runs is included in the extension package.

9. Compliance with Google and Chrome Web Store policies

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

ReviewReply's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10. Your rights and choices

Under UK and EU data protection law, you have the right to access your data, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent at any time. To use any of these rights, email supportreviewreply@gmail.com. We will reply within one month. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office at ico.org.uk.

11. Children

ReviewReply is a tool for businesses and is not intended for anyone under 18. We do not knowingly collect data from children.

12. Changes to this policy

If we change this policy, we will update the effective date at the top of this page. If a change is significant, we will tell you by email or on our website before it takes effect.