Privacy policy
Last updated 13 September 2026
RespondWay helps business owners respond to customer reviews. This policy explains what we collect, why, who we share it with, and how to get it back or delete it. It is written to be read, not to be survived.
What we collect
Account information
- Your email address and, if you give them, your name and business name.
- A password hash, handled by our authentication provider. We never see your password.
Business and review data
- The businesses you add: name, address, phone, website, industry and brand voice settings.
- Reviews you bring in, whether forwarded by email or synced from a connected platform: reviewer display name, star rating, review text and its date.
- The replies drafted for you, your edits, and whether you approved or rejected them.
- Emails you forward to the RespondWay address. If we cannot parse one, we keep the raw message so the review is not lost, and you can delete it.
Connection credentials
- If you connect Google or Facebook, we store the access and refresh tokens those services issue. They are encrypted with AES-256-GCM before they reach our database.
Usage and technical data
- An activity log of actions taken in your account, with IP address and browser agent.
- Counts of reviews synced and replies generated, used for billing limits.
We do not use tracking cookies or advertising pixels. The only cookie we set is the one that keeps you signed in.
Google user data
If you connect a Google Business Profile, RespondWay requests the business.manage scope. We use it for exactly two things: reading the reviews on the locations you select, and publishing the replies you approve. We do not read anything else in your Google account, and we do not use Google user data to train any model.
RespondWay's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect Google in Settings at any time, which deletes the stored tokens immediately.
How review text is processed
To draft a reply we send the review text, your business name and industry, and your brand voice settings to a language model provider. We use OpenAI, with Anthropic as a fallback when OpenAI is unavailable. Both are bound by their API terms not to train on data submitted through their APIs.
We do not send your email address, tokens, payment details or any other account information to a model provider.
Who we share data with
- Supabase, for database and authentication hosting.
- Vercel, for application hosting.
- OpenAI and Anthropic, for reply drafting and sentiment analysis, as described above.
- Dodo Payments, our merchant of record. Card details go to Dodo directly and never touch our servers.
- Resend, to send alerts and reports to you.
- Google, Yelp and Meta, only for the platforms you choose to connect.
We do not sell your data and we do not share it for advertising.
How long we keep it
- Account, business and review data: for as long as your account is open.
- Raw forwarded emails: 90 days, then deleted automatically.
- Activity logs: 12 months.
- After you delete your account: 30 days, then permanent deletion, apart from records we are required to keep for tax and accounting.
Your rights
You can export everything in your account as JSON, and delete your account and its data, from Settings. Both are self-service and immediate. If you are in the UK, EU or California you also have the right to correct your data, object to processing and complain to your regulator.
For anything you cannot do from Settings, email privacy@respondway.com. We reply within 30 days.
Security
- All traffic is encrypted in transit.
- Third-party tokens are encrypted at rest with a key held outside the database.
- Row level security means a query can only ever return rows belonging to the signed-in account.
Children
RespondWay is for businesses. It is not intended for anyone under 16.
Changes
If we change this policy in a way that affects you, we will email you before it takes effect. The date at the top always reflects the current version.