Privacy Policy

The Review Health Score sends the business name and city you enter to Google Maps Platform to look up public listing data. We do not store the results; they are shown to you and then discarded. Google’s handling of data is described in the Google Privacy Policy.

If you join the waitlist, we store your email address, and your business name and city if you give them, along with the date you signed up. This is kept in Cloudflare Workers KV, hosted by Cloudflare, and used only to contact you about ReplySteady. We don't sell or share it. To see or remove your data, email hello@replysteady.com. To limit abuse, we keep a short-lived request counter tied to your network address (stored in Cloudflare D1), which expires within a day and is then deleted.

Google user data (ReplySteady app)

What we access. When you sign in with Google we receive your Google account email address and a Google account ID, which we use to identify your ReplySteady account. If you connect your Google Business Profile, ReplySteady requests the business.manage permission. With it we read the Business Profile accounts and locations you authorize (location name, ID and category) and the reviews on those locations (reviewer display name, star rating, review text, date and any existing reply), and we post replies to reviews. We do not access any other Google data, such as Gmail, Drive or Contacts.

How we use it. We use Google user data only to provide the features you see in ReplySteady: showing your reviews, drafting replies, posting the replies you approve, and sending you a digest email about new reviews. We post a reply only when you approve it, or for 4 and 5 star reviews if you turn on automatic posting for that location; reviews of 3 stars or fewer always wait for your approval.

What we store and how. We store your Google OAuth refresh token encrypted with AES-256-GCM using a key held as a server secret, your location names, IDs and categories, your reply settings, and the reviews, drafts and replies needed to show your dashboard. Data is stored in Cloudflare D1, which is encrypted at rest, and all traffic uses HTTPS. We keep synced review content, drafts, replies and digest emails for no longer than 30 days and then delete them; anything still current is fetched again from Google.

Who we share it with. We do not sell Google user data, use it for advertising, use it to build user profiles, or allow people to read it, except with your consent, when needed for security or to comply with law. We share it only with service providers that process it on our behalf to run these features:

• Cloudflare (hosting and database).
• OpenAI (reply drafts): we send the review text, star rating, the reviewer's display name, your business name, your reply settings and a few of your recent replies, solely to generate your draft. Under OpenAI's API terms this data is not used to train its models, and we never use Google user data to develop, improve or train generalized AI or machine learning models.
• Resend (email delivery): digest emails sent to you contain your new reviews and draft replies.
• Stripe (billing): receives your account email address if you subscribe, never your reviews.

Limited Use disclosure: ReplySteady's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and deletion. You can disconnect Google at any time in ReplySteady (Settings, Disconnect Google) or at myaccount.google.com/permissions. When you disconnect in ReplySteady, we revoke our access with Google and immediately delete your tokens, locations, reviews, drafts, replies and stored digest emails. Deleting your account in ReplySteady also deletes your account record. Deleted data can remain in our database provider's encrypted point in time backups for up to 30 days and is then gone. You can also ask us to delete your data at hello@replysteady.com.

Review invites

If a business uses ReplySteady email invites, it gives us its customers' email addresses and, optionally, first names. We use them only to send that business's one time review invite on its behalf, to show the business a log of invites it sent, and to avoid sending the same person another invite within 30 days. We keep this log for up to 180 days, and delete it sooner if the business deletes its account or disconnects Google. If a recipient unsubscribes, we store a one way hash of their email address, not the address itself, so we never email them an invite again. Short review links count clicks without storing who clicked. Email is delivered by our email provider, Resend.

This policy is provided by ReplySteady. Contact: hello@replysteady.com.

Mailing address: ReplySteady, 1 E Erie St, Chicago, IL 60611, United States.

Last updated: October 22, 2026.

ReplySteady is not affiliated with Google and is not endorsed by Google.