Privacy Policy
Last updated: July 4, 2026
AutoReplyPilot ("we", "us", "our") provides an AI assistant that drafts and publishes replies to Google reviews on behalf of local businesses. This policy explains what we collect, why we collect it and the choices you have.
1. Information we collect
- Account data: name, email, password hash, billing details and the business locations you connect.
- Google Business Profile data: when you connect your Google account we receive your profile, locations, reviews and the ability to post replies. We only request the scopes needed to read reviews and publish replies.
- Generated content: the AI replies we draft, your edits and the final replies posted to Google.
- Usage data: log files, device info, IP address and product analytics so we can improve the service.
- Cookies: session cookies for authentication and a small number of analytics cookies. You can clear or block them in your browser.
2. How we use your data
- To generate, schedule and publish review replies on your behalf.
- To operate your account, process payments and provide customer support.
- To monitor service health, prevent abuse and improve our AI models in aggregate.
- To send service updates and, with your consent, product news.
3. Google user data
AutoReplyPilot's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Scopes we request and why
https://www.googleapis.com/auth/business.manage, the single Google scope we request. It is granted only after you click "Connect Google" and explicitly approve the consent screen. We use it to (a) list the Business Profile locations you manage so you can pick which one to connect, (b) read incoming reviews on those locations so we can draft replies, and (c) publish the replies you approve back to Google. We do not request any other Google scopes and we do not use this scope for any other purpose.
Limited Use compliance
Google user data received through the Business Profile API is used only to provide or improve the review reply features described above. We do not use Google user data to serve advertisements, we do not sell it, we do not transfer it except to the subprocessors strictly required to run the service, and we do not allow humans to read it except in the narrow cases listed under "Human access to Google user data".
Google user data we access
- Your basic Google account profile (name, email, profile picture) to identify the connected account.
- The list of Google Business Profile accounts and locations you manage.
- Reviews left on those locations, including the reviewer's display name, star rating, review text and timestamps.
- Replies posted to those reviews, including replies we publish on your behalf.
How we use Google user data
- To display your connected locations and their reviews inside the AutoReplyPilot dashboard.
- To generate AI-drafted replies that you can review, edit, approve or schedule.
- To publish approved replies back to Google on your behalf via the Business Profile API.
- To send you notifications about new reviews and reply activity.
How we store and protect Google user data
Google OAuth tokens are encrypted at rest. Review and reply content is stored in our database with row-level security so each business can only access its own data. All traffic is encrypted with TLS in transit. Access by our staff is restricted to the support and abuse-investigation cases described below.
Sharing of Google user data
We share Google user data only with the subprocessors strictly required to operate the service (cloud hosting, database, and the AI model provider that drafts replies). Reply text is sent to the AI provider solely to generate a draft and is not used to train their models. We do not sell Google user data, do not use it for advertising, do not use it to build user profiles for advertising purposes, and do not transfer it to third parties except as needed to provide or improve the service, comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you.
Human access to Google user data
We do not allow humans to read your Google user data except: (a) with your explicit consent when you request support, (b) where necessary for security purposes such as investigating abuse, or (c) to comply with applicable law. Where possible, data reviewed for these purposes is aggregated or anonymised.
Revoking access and deleting Google user data
You can disconnect your Google account at any time from Settings inside AutoReplyPilot. On disconnect we revoke the OAuth token with Google and delete the associated Google user data (locations, reviews and reply history) from our active systems within 30 days. You can also revoke our access directly at myaccount.google.com/permissions. To request deletion of any remaining data, email support@autoreplypilot.com.
4. Sharing
We share data only with the processors that run the service: cloud hosting, database, payment processing, email delivery and the AI model providers that generate replies. Each is bound by a data processing agreement. We do not sell your personal data.
5. Retention
We retain account and reply data for as long as your account is active. If you close your account we delete or anonymise your data within 30 days, except where we must keep records for legal or accounting reasons.
6. Your rights
Depending on your location you have the right to access, correct, export or delete the personal data we hold about you and to object to or restrict certain processing. Email support@autoreplypilot.com and we will respond within 30 days.
7. Security
We use TLS in transit, encryption at rest, least-privilege access controls and regular backups. No system is perfectly secure, so please use a strong unique password and enable two-factor authentication on your Google account.
8. International transfers
Our infrastructure may process data in the United States, the European Union and the United Kingdom. Where required we rely on Standard Contractual Clauses for cross-border transfers.
9. Children
AutoReplyPilot is not directed at children under 16 and we do not knowingly collect their data.
10. Changes to this policy
We may update this policy as the service evolves. Material changes will be announced by email or in the app at least 14 days before they take effect.
11. Contact
Questions or requests: support@autoreplypilot.com.