Privacy policy

This Privacy Policy explains how VyrroTech (“we”, “us”) handles personal data when you use reviewsGBP (the “Service”). It covers the marketing site, accounts, Google connections, AI drafts, and billing. It does not cover Google’s own processing of your Business Profile — that is Google’s privacy policy.

Related documents: Terms of Service and Contact.

1. Who is responsible

VyrroTech operates reviewsGBP. For privacy questions, email hello@reviewsgbp.com or hello@reviewsgbp.com.

Stripe is the merchant of record for paid subscriptions. Stripe handles payment data under its own privacy policy. We receive subscription status, identifiers, and limited customer fields needed to entitle your account — not your full card number.

2. Data we collect

Account

Email, name you provide, password hash (if you sign up with email), Google sign-in identifiers if you use Google login, plan and entitlement flags, and security events (for example email verification and password reset tokens).

Google Business Profile

After you connect with OAuth we store refresh tokens and related expiry metadata so we can sync and post on your behalf. We store location identifiers and names, review identifiers, ratings, review text, reviewer display name and photo URL as provided by Google, reply drafts, posted-reply status, and auto-reply settings (tone, ratings, delay, custom instructions).

Product usage

Actions needed to run the product: generate, regenerate, post, ignore, sync, and similar audit events; approximate AI usage counts for plan limits; device/session cookies for authentication.

Support and marketing site

If you email us, we process the content of that email. The public contact form opens your mail app; we do not store that form on our servers unless you send the email. Server logs may include IP address and user agent for security.

We do not buy marketing lists. We do not invent customer logos or attach your business to public case studies without a separate written okay.

3. How we use data

• Provide the Service: sync, drafts, posting, analytics, billing entitlements
• Keep the account secure (verification, session, abuse prevention)
• Enforce plan limits and prevent fraud
• Send transactional email (verify, reset password, important account notices)
• Improve prompts and reliability using aggregated or operational signals — not to sell your reviews
• Comply with law and Google’s API requirements

Legal bases (where GDPR or similar laws apply) typically include contract (providing the Service you signed up for), legitimate interests (security, product operations), and consent where required (optional cookies or marketing, if we ever add them).

4. AI processing

To generate a draft we send the model the review text, rating, business name, tone, and your custom instructions, plus our system prompt. We use third-party AI providers as subprocessors for that generation. Do not put secrets in custom instructions that you would not send to a vendor.

We do not use your reviews to train a public model of our own. AI providers’ data-use terms apply to the API calls we make; we configure those APIs for product inference, not for you to become a training example where the provider lets us opt out.

5. Who we share with

We share data with:

• Google — OAuth, review read, reply post, as you authorize
• Stripe — checkout, subscriptions, customer portal
• AI providers — draft generation as described above
• Hosting, email, and database vendors we use to run reviewsGBP
• Professional advisers or authorities when required by law or to protect the Service

We do not sell personal data. Superadmin/support staff may access accounts to fix outages, billing, or abuse — access is logged.

6. Cookies and sessions

We use cookies and similar storage that are necessary to keep you signed in and to protect the session. The marketing site does not depend on advertising cookies. If we add analytics cookies later, we will update this policy and use a consent tool where required.

7. Retention

We keep account and location data while the account is active. After you delete the account we delete or irreversibly anonymize personal data within a reasonable period, except records we must keep for law, disputes, or security (for example limited billing identifiers or abuse logs). Google still holds the original reviews and any replies already posted.

OAuth tokens are stored until you disconnect the location or we rotate/revoke them. Expired verification and reset tokens are removed when used or when they expire.

8. Your choices

• Edit profile fields that the product exposes in Settings
• Disconnect a Google location (stops sync and posting for that listing)
• Delete your account in Settings, which removes reviewsGBP account data as described above
• Manage or cancel a subscription in the billing portal
• Request access, correction, or deletion by emailing hello@reviewsgbp.com if you cannot do it in-product

Depending on where you live you may have rights to object, restrict processing, or port data, and to complain to a supervisory authority. We will not discriminate against you for exercising rights that apply to you.

9. International transfers

Vendors and AI providers may process data in the United States or other countries. Where required, we use appropriate safeguards (such as standard contractual clauses) with those vendors.

10. Children

The Service is for businesses and is not directed at children under 16 (or the higher age in your country). We do not knowingly collect data from children.

11. Security

We use HTTPS, hashed passwords, session controls, and restricted staff access. No method of transmission or storage is perfectly secure. Tell us at hello@reviewsgbp.com if you find a vulnerability — do not publicly exploit it.

12. Changes

We will update this policy when our practices change. The effective date will move. Material changes will be emailed or shown in the product where reasonable.

13. Contact

Privacy: hello@reviewsgbp.com
Support: hello@reviewsgbp.com
Contact page