Privacy Policy

What We Collect

When you request a free written review sample, start a paid pilot or plan, or use RepstackHQ, we collect only what is needed to prepare your requested readout, setup, drafts, approvals, and service communications:

• Business information: Your business name, city or service area, Google Business Profile URL, and business category.
• Contact information: Your name, email address, and optional phone number if you provide it.
• Setup and voice information: Your selected or intended plan, approval preference, communication style, preferred phrases, tone notes, main review concern, and sensitive-review boundaries.
• Public review content: Text from Google reviews posted on your business profile. This is customer-authored public content sourced from Google and processed only as needed to draft, approve, post, and report on review responses.
• Billing information: Your subscription plan and payment status. Card numbers and payment details are handled entirely by Stripe; we never see or store them.
• Form request context: The source page, referring page, submission time, and a short hash derived from the browser user-agent. We use this limited context for request handling, security, and troubleshooting.
• First-party website usage: Page paths, generic CTA labels and destinations, broad referrer category, device class, allowlisted campaign tags in the page URL, and a daily hashed session identifier. Campaign tags are limited to source, medium, campaign, and a non-sensitive content label. Analytics events do not include typed form values, reviewer names, or review details.

Do not submit Google passwords, card details, private patient records, confidential customer information, or other account secrets. Sensitive-review boundaries should be described generally enough to guide escalation without including private records.

Browser-Only Reply Builder

The free reply builder runs in your browser. Reviewer names and review details typed into that tool are not submitted to RepstackHQ, saved in our form store, or sent to an AI provider. The page may record generic events such as opening the tool, building a draft, copying a draft, or triggering a sensitive-content pause, but those events do not contain the text you entered.

Cookies and First-Party Analytics

RepstackHQ does not use advertising cookies or third-party advertising trackers. The site creates a random identifier in browser session storage so pageviews and important CTA events can be grouped during the browser session. Allowlisted campaign tags may also be kept for that browser session to attribute a visit without storing contact details. Before storage, the server combines the session identifier with the date and a site-controlled value and stores only a shortened hash. Referrers and devices are reduced to broad categories.

How We Use It

We use your data to evaluate the free written review sample request and provide the RepstackHQ review response service. That means:

• Reading your reviews and drafting responses in your voice
• Sending you approval batches by email, unless another written approval channel is agreed during onboarding
• Posting approved responses to your Google Business Profile
• Generating your monthly report card
• Communicating with you about your account
• Understanding which pages and generic buyer-path actions are useful, without recording typed form or builder content in analytics

We do not sell your data. We do not use your review content or voice profile for unrelated advertising. We use it only to provide the service you requested, prepare approvals and drafts, and communicate with you about RepstackHQ.

Who We Share It With

We share data with the following third parties, solely to operate the service:

• Netlify: Hosts the website and serverless functions. Submitted form records and first-party analytics events are stored using Netlify services, including Netlify Blobs. Netlify's privacy statement is available at netlify.com/privacy.
• Anthropic: When used for managed client drafting, public review text and relevant voice instructions may be processed through Anthropic's Claude API. Content typed into the browser-only reply builder is not sent to Anthropic. Anthropic's privacy policy is available at anthropic.com/privacy.
• Stripe: Handles all payment processing and subscription billing. Your card details go directly to Stripe and never touch our systems: stripe.com/privacy.
• Google Workspace / Gmail: Handles business email for RepstackHQ, including request notifications, acknowledgments, approval communication, and client support. Google's privacy policy is available at policies.google.com/privacy.
• Other written approval channels: If a non-email approval channel is agreed during onboarding, messages may include public review text, draft responses, and your approval instructions. The applicable third-party provider may process those messages under its own terms and privacy policy.

We limit third-party sharing to the tools needed to run the service and do not sell your data.

Data Retention

We retain free sample information and client data only as long as reasonably needed to provide the service, maintain records, resolve disputes, or comply with legal obligations. If you cancel, you may request deletion of your voice profile and review queue history by emailing us. Some billing, legal, or security records may be retained where required or appropriate.

Your Rights

You can contact us at any time to:

• Access the data we have on your business
• Correct anything that's inaccurate
• Request deletion of data that is not required for billing, legal, security, or dispute records

We respond as required by applicable law and as practical for the request. Identity or authority may need to be verified before account or request data is disclosed, corrected, or deleted.

Security

Your data is stored with access restricted to RepstackHQ service operations and the tools needed to provide the service. We do not ask for your Google password. If posting support is needed, access should be provided through appropriate Google Business Profile permissions.

Contact