Privacy policy

The data controller is the service publisher: Nathan Cousin, sole trader (EI) (Polochon Studio), 17 rue du Bras, 62500 Saint-Martin-lez-Tatinghem, France, SIRET 131 358 673 00013. Contact for any question about your data: contact@replizy.com.

When you sign in with Google:

• your name, email address and Google profile picture;
• an access token allowing the service to act on your Google Business Profile, with your permission.

From your Google Business Profile:

• information about your locations (name, address, category);
• reviews posted by your customers (author's public name, rating, comment, date) and existing replies.

When you use the service:

• your settings (posting rules per rating, information about your business);
• replies generated by the AI, their status and posting date.

When you subscribe:

• billing information and the status of your subscription. Payment is processed by Stripe: Replizy never has access to your card number.

When you use the other features:

• your messages to support (and, for the website contact form: your name, email and message);
• if you turn on notifications: a technical identifier of your device, provided by your browser, and the reminder frequency you choose.

Providing the service

Create your account, fetch your reviews, generate and post replies. Basis: performance of the contract.

Billing

Manage the subscription and invoices. Basis: performance of the contract and legal obligation.

Security

Protect accounts and prevent abuse. Basis: legitimate interest.

Support

Answer your requests. Basis: performance of the contract.

Contact (prospects)

Reply to a message sent from the website. Basis: pre-contractual steps taken at your request.

Notifications

Let you know about replies to approve. Basis: your consent, which you can withdraw at any time.

Prospecting

Introducing Replizy to businesses, using their public business contact details (business name, address, email shown on their website). Basis: legitimate interest. You can object at any time using the unsubscribe link in every message; data is erased 3 years after the last contact.

Your data is never sold or used for advertising purposes.

Replizy requests the business.manage permission only to list your locations, read their reviews and post the replies you have approved or allowed to be posted automatically.

Replizy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke this access at any time from your Google account permissions.

To write a reply, the review text, its rating and your business information are sent to Google's Gemini AI service. This data is used only to generate the reply. Messages sent to support may also be sent to Gemini to prepare a draft reply, which is always reviewed by a person before it is sent. Sensitive reviews (refund, health, dispute…) are detected by Replizy itself, without any external service. Replizy uses the paid Gemini API plan: Google does not use this data to train its models.

Supabase

Database and authentication. Data hosted in London (United Kingdom), a country recognised by the European Commission as providing an adequate level of protection

Vercel

Hosting of the website and application

Google

Sign-in, Business Profile API, Gemini AI

Stripe

Payment and subscription management

Resend

Sending service emails (support replies, welcome messages)

Browser notification services (Google, Apple, Mozilla)

Delivering notifications to your devices

Some providers are based in the United States. Transfers are governed by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.

• Account data, reviews, replies, settings and support messages: for as long as you use the service. They are erased immediately when you delete your account, then disappear from technical backups within 30 days.
• Account without a subscription left inactive (no sign-in) for 2 years: deleted automatically, after a warning email sent 30 days before. Simply signing in keeps it.
• Messages sent through the contact form by people without an account: 3 years after the last exchange.
• Notification identifiers: until notifications are turned off, the browser subscription expires or the account is deleted.
• Google access tokens: deleted and revoked when the account is deleted (or removed by you in your Google account).
• Invoices: 10 years, in accordance with accounting obligations. They are kept by Stripe.

Communications are encrypted (HTTPS). Access to data is isolated: each user can only see the data of their own locations. Access tokens are kept on the server and never exposed in the browser.

Replizy only uses cookies that are strictly necessary for the service: keeping you signed in, remembering the language you chose and, if you arrive through a link received by email, remembering that link for 30 days to know where your sign-up came from. They do not require consent. No advertising or analytics cookies are set.

You have the right to access, rectify, erase, restrict, port and object to the processing of your data. To exercise these rights, write to contact@replizy.com. You will receive a reply within one month.

You can also delete your account yourself at any time: Subscription tab › Delete my account. Your subscription is cancelled, Google access is removed and your data is erased immediately.

You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with your local authority.

This policy may change. If there is a significant change, you will be informed by email or in the app.