Privacy Policy
Last updated: 10 July 2026 · GDPR compliant
This policy explains how [Your Company Ltd, Bulgaria, EIK ______] ("we"), the data controller, processes personal data when you use Reputly. We comply with the EU GDPR.
1. What we collect
- Account data — your name, email, password (hashed), business name.
- Business data — the public reviews, ratings and business info we sync from platforms you connect.
- Connection tokens — OAuth tokens for platforms you connect (encrypted), used only to act on your behalf.
- Usage & billing — plan, invoices (via Stripe), and basic product analytics.
2. How we use it
To provide the Service (monitor reviews, generate replies, send alerts and reports), to process payments, to send transactional email (verification, alerts, receipts), and to improve the product. We do not sell your data.
3. Legal bases
Performance of our contract with you (providing the Service), your consent (e.g. connecting a platform, marketing email), and our legitimate interests (security, product improvement).
4. Sharing & subprocessors
We share data only with processors that help us run the Service: hosting (Vercel/Neon, EU region), email (Resend), SMS (Twilio), payments (Stripe), and AI providers (Anthropic/OpenAI) for generating replies. Each is bound by a data-processing agreement. Reviews are already public on the source platforms.
5. AI processing
Review text is sent to our AI provider to generate reply suggestions and insights. It is not used to train third-party models where an opt-out is available, and we send only what is necessary.
6. Storage & security
Data is stored in the EU, encrypted in transit (TLS) and at rest. Passwords are hashed (bcrypt). Access is restricted and audit-logged. We retain your data while your account is active and delete or anonymise it within 90 days of account closure, unless law requires longer.
7. Your rights
Under GDPR you can access, correct, export or erase your data, restrict or object to processing, and withdraw consent. Email privacy@reputly.io and we respond within 30 days. You may also complain to your local data-protection authority (in Bulgaria, the CPDP).
8. Cookies
We use a single essential cookie to keep you signed in (no third-party advertising cookies). A theme preference is stored locally in your browser.
9. Changes
We'll notify you of material changes by email. See also our Terms of Service.
Contact: privacy@reputly.io