Privacy policy

Who we are

SimplyReplied is operated by Amir Harandi, who is responsible for the personal information described here. Contact info@simplyreplied.com with privacy questions or requests.

Information we collect

• Your account: your name, email address, a securely hashed password, whether you have confirmed your email, when you accepted our terms, and your account role.
• Sign-in security: for each signed-in device, the IP address, browser details and session times. If you turn on two-factor authentication, an encrypted authenticator secret and encrypted backup codes. We record recent sign-in attempts to limit abuse.
• Connected Google accounts: when you connect a Google account, Google shares its account identifier, email address, name and profile picture, plus access and refresh tokens that let us act for you. We store the tokens encrypted.
• Your businesses: using the Business Profile permission you grant, we read the Business Profile accounts and locations you can manage. We store each one’s name, address, store code, Google place identifier, Maps link, and your access level.
• Business details and reviews: the profile, hours, photos, posts, menus and other details Google holds for each business you manage, and its reviews and replies, including reviewers’ public names and profile pictures.
• AI drafts and settings: draft replies written for reviews, each business’s AI reply settings (such as its tone and instructions), and who last edited a draft or changed the settings.
• When you contact us: your email address, the content of your message, and anything else you choose to send.
• How you use SimplyReplied: recordings of your visits (what was on screen, what you clicked and typed, apart from passwords and sign-in codes, and the app's requests and console messages), the pages you visit, what you do (such as publishing a reply or changing AI settings), the text of replies and drafts you publish or edit, errors you run into, how long things take, your browser and device, the page that brought you here, and your approximate location from your IP address. Once you sign in, this is linked to your account (its ID, name and email address). We record it with PostHog.
• AI drafting records: each request to the AI model that writes drafts, including everything sent to it (the review, the business details and its AI instructions) and the draft it wrote, with how long it took and what it cost. OpenRouter sends these records to PostHog.
• Logs and error reports: what the app did to handle your requests, how long each step took, and details of errors, linked to your account. We keep these in PostHog.
• When you visit: our hosting provider processes technical request information such as your IP address, browser details, requested pages and request times to deliver the service and keep it secure.

Cookies

We use cookies that are strictly necessary: a session cookie that keeps you signed in, and short-lived cookies that protect sign-in, two-factor and Google connection steps.

We also use our own analytics cookie, set by PostHog, which holds a random identifier for your browser and your current visit, so we can tell how SimplyReplied is used and improve it. We do not use advertising trackers or embedded third-party content, and we do not track you on other websites.

How we use information

• To provide your account, sign you in securely, and send account emails such as email confirmation, password resets and security notices.
• To show and edit the businesses you manage, their details and reviews, and your access level for each, using data from your connected Google accounts.
• To write draft replies to reviews with an AI model, when AI drafts are used for a business. Drafts are only posted when someone publishes them.
• To keep the service secure, prevent abuse, and fix problems.
• To understand how SimplyReplied is used, find what gets in people’s way, and improve it, including the quality and cost of AI drafts.
• To respond to your enquiries.

Where data protection law requires a lawful basis, we rely on performing our contract with you to provide the service, and on our legitimate interests in keeping it secure, understanding and improving it, and responding to people who contact us.

Google user data

SimplyReplied’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, and the Business Profile API policies.

We use Google data only to provide the features you see in SimplyReplied. We do not sell it, use it for advertising, or use it to train general-purpose AI models, and people at SimplyReplied do not read it unless you ask us to for support, it is needed for security or to fix a problem with the service, or the law requires it.

To write a draft reply, we send the review (including the reviewer’s name), recent replies from the same business, the business’s name, category and contact details, and its AI instructions to an AI model through OpenRouter. We only use providers that, under their terms with OpenRouter, don’t keep or train on this data. The draft is stored in SimplyReplied and is not posted unless someone publishes it. A record of each request, including what was sent and the draft written, is kept in PostHog so we can check the quality and cost of drafts.

A business is shared by everyone who manages it in Google and uses SimplyReplied: they see the same business details, reviews, AI drafts and settings, and the name of whoever last edited a draft. What each of you can see and do here follows your access in Google, which we check again regularly.

You can disconnect a Google account at any time from the Connections page. We then ask Google to revoke our access and delete the tokens we stored for that account, and stop showing you its businesses. You can also remove access from your Google account permissions.

Service providers and sharing

We use Railway to host the app and its database, Resend to send account emails, OpenRouter to reach the AI models that write draft replies, and PostHog for analytics, error reports, logs and AI drafting records, stored in PostHog’s EU region. They, and the AI providers OpenRouter uses, process information only as needed to provide those services. Google receives requests made on your behalf when you connect an account, refresh your businesses, change them, or publish a reply, and when we fetch new reviews in the background. We do not sell your personal information or share it for advertising. We may disclose information where required by law or necessary to address fraud, abuse or security issues.

Providers may process information outside your country. Where required, we use appropriate safeguards for international transfers.

Retention

• Account information is kept while your account exists. When you delete your account, we delete your account, sessions and connected Google accounts, and ask Google to revoke our access.
• Sessions expire after 30 days of inactivity. Email confirmation links expire after 24 hours and password reset links after 1 hour.
• Business information, reviews, AI drafts and settings belong to the business, not to one person, so they stay while anyone who manages it uses SimplyReplied, and are refreshed from Google regularly. When nobody does any more, they are kept but not shown to anyone, and are used again if someone who manages the business connects it later. You can ask us to delete them by emailing info@simplyreplied.com.
• A draft reply is deleted once the review has a reply, and hidden when someone discards it.
• Enquiries are kept only as long as needed to respond, handle follow-up and meet legal obligations. Hosting logs are kept according to the hosting provider’s operational needs.
• Logs in PostHog are kept for 14 days. Analytics, error reports and AI drafting records are kept for as long as our PostHog plan keeps them. You can ask us to delete those linked to you by emailing info@simplyreplied.com.

Security

Passwords are hashed, Google tokens and two-factor secrets are encrypted, connections use HTTPS, and sign-in attempts are rate limited. No method of transmission or storage is completely secure, but we work to protect your information.

Your choices and rights

You can update your password, review and sign out other devices, turn on two-factor authentication, disconnect Google accounts and delete your account in the app. You can also ask us for access to, correction of, or deletion of your information by emailing info@simplyreplied.com. Depending on where you live, you may also have rights to object to or restrict processing, or to receive your data in a portable form. We may need to verify your identity before acting on a request.

You may complain to your local data protection authority. In the UK, this is the Information Commissioner’s Office.

Changes to this policy

We will update this page when our practices change and revise the date above. We will give additional notice where required before introducing new uses of personal information.