Privacy Policy

1. Introduction

ReplyDost ("we", "our", or "us") is an AI-powered Google review response tool built for Indian local businesses. This Privacy Policy explains how we collect, use, store, and protect your information when you use our service — whether at replydost.in or through the ReplyDost Android app. The Android app is a native shell around the same service and does not collect any information beyond what is described in this policy.

By using ReplyDost, you agree to the collection and use of information as described in this policy.

2. Information We Collect

We collect the following categories of information:

• Name and email address (from your Google account via OAuth)
• Profile picture (from your Google account)
• Phone number and business details (provided by you during onboarding)
• Business name, business type, and Google Business Profile location ID
• Google Business Profile data — specifically: review text, reviewer name, star rating, review date, and your existing reply (if any) — accessed only with your explicit authorization
• Google OAuth tokens (access token and refresh token) required to act on your behalf
• If you connect Facebook/Instagram (optional, for the Marketing Suite's Social Composer feature): your Facebook Page name and ID, linked Instagram Business account name and ID, and a Page access token — accessed only after you explicitly authorize the connection via Facebook Login
• If you upload your own image or video for a post: the media file itself, stored to publish it to your connected accounts
• Billing information — plan selected, subscription status, and payment/transaction records (card, UPI, or bank details themselves are handled directly by our payment processor, Razorpay, and are not stored on our servers)

3. How We Use Your Information

• To authenticate you and maintain your session
• To fetch your Google Business Profile reviews and display them in your dashboard
• To generate AI-powered reply suggestions for your reviews
• To publish your approved replies back to Google on your behalf
• If you connect Facebook/Instagram: to publish marketing posts (AI-generated or your own uploaded image/video, with a caption) to the specific Page/Instagram account you select, only when you click Publish
• To send product updates and notifications (only with your consent)
• To improve our service and fix bugs

We do not use your Google or Meta data for any purpose beyond the features described above.

4. Google API Data — Limited Use Disclosure

ReplyDost's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we commit to the following with respect to Google user data:

• We only use Google data (reviews, location info, OAuth tokens) to provide the ReplyDost service — fetching reviews and posting replies on your behalf
• We do not transfer your Google data to third parties except as necessary to provide the service (see Data Sharing below)
• We do not use or transfer your Google data for serving advertisements of any kind
• We do not allow humans to read your Google data unless you have given explicit consent, or it is necessary for security purposes, or required by law
• We do not use your Google data to build user profiles for purposes unrelated to the core service

You can revoke ReplyDost's access to your Google account at any time by visiting myaccount.google.com/permissions.

5. Meta (Facebook/Instagram) API Data

Connecting Facebook/Instagram is entirely optional and only used for the Marketing Suite's Social Composer feature (publishing marketing posts). If you choose to connect:

• We request only the permissions needed to show which Pages/Instagram accounts you manage and to publish content to the ones you explicitly select
• We do not post anything to your Facebook Page or Instagram account without you clicking Publish on a specific post
• We do not use your Meta data for advertising, profiling, or any purpose unrelated to publishing the posts you create
• We do not sell or share your Meta data with third parties except Meta itself (as required to publish your post via their API)

You can revoke ReplyDost's access to your Facebook/Instagram account at any time from Facebook Settings → Business Integrations, or by disconnecting the account directly inside ReplyDost.

6. Data Storage & Security

Your data is stored in encrypted PostgreSQL databases hosted on Supabase, a SOC 2-compliant infrastructure provider. We use HTTPS for all data in transit. We do not store your Google account password.

OAuth tokens (Google and, if connected, Facebook/Instagram) are stored in encrypted form and are used solely to perform actions on your behalf within the ReplyDost service.

Images and videos you upload for a post are stored on Supabase Storage so they can be previewed and published to your connected accounts; they remain accessible to publish or retry a post while it is a draft, and for a limited period afterward for support and retry purposes.

7. Data Retention

• Your account data and reviews are retained as long as your account is active
• Upon account deletion, all personal data, OAuth tokens (Google and Facebook/Instagram), and uploaded media are permanently deleted within 30 days
• Disconnecting Facebook/Instagram from within ReplyDost deletes the stored access token immediately
• Review text sent to AI services is not retained by those services beyond the duration of the API call (subject to each provider's own data retention policy)

8. Data Sharing

We do not sell your personal data. We share data only with the following service providers strictly to operate the service:

• Google LLC — via Google APIs to fetch reviews and post replies (required for core functionality)
• Meta Platforms, Inc. — via the Facebook/ Instagram Graph API, only if you connect an account, to publish the posts you create to the Page/Instagram account you select
• Google (Gemini AI) — review text (not personally identifiable) is sent to generate reply suggestions
• Anthropic (Claude AI) — review text may be sent as a fallback AI provider; no personal information is included
• Razorpay — processes subscription payments and top-ups; receives your name, email, and transaction details necessary to complete billing (subject to Razorpay's own privacy policy for payment data)
• Supabase — hosts our PostgreSQL database and stores uploaded post media
• Vercel — hosts our web application

All third-party providers are contractually bound to use your data only for the purpose of providing their respective services to us.

9. Your Rights

• Access: Request a copy of all personal data we hold about you
• Deletion: Request deletion of your account and all associated data at any time
• Revocation: Revoke ReplyDost's Google access at any time via myaccount.google.com/permissions, or Facebook/Instagram access via Facebook Settings → Business Integrations
• Correction: Request correction of inaccurate personal data

To exercise any of these rights, email us at info@replydost.in. We will respond within 30 days.

10. Cookies

We use session cookies to keep you logged in. We do not use tracking cookies or third-party advertising cookies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated via email or a notice on the dashboard. Continued use of the service after changes constitutes acceptance of the updated policy.

12. Contact

For any privacy-related questions or data requests, contact us at: info@replydost.in

ReplyDost is operated by an individual / small business registered in India.