Privacy Policy

ReplyPilot ("we", "us") is operated by Sujeet Singh / Karmatix (karmatix.in), India. This policy explains what we collect, why, and the choices you have. It applies to the ReplyPilot website and app.

What we collect

• Account data: your email address and business name.
• Google Business Profile data: with your permission, your business locations, the reviews customers leave on them (reviewer display name, star rating, review text, date) and the replies you post.
• Brand-voice answers you give during onboarding (tone, sign-off, offers, do's and don'ts).
• WhatsApp number you provide for approval messages, and the approval messages exchanged.
• Billing data: plan, subscription status and Razorpay subscription ID. Card/UPI details are handled by Razorpay; we never see or store them.
• Usage data: number of replies, AI token counts and cost, and basic technical logs (no review text).

How we use Google user data

ReplyPilot requests a single Google OAuth scope, https://www.googleapis.com/auth/business.manage, and uses it only to (a) list the locations you choose to manage, (b) read their reviews, and (c) post replies that you approved or that you enabled for automatic posting (4–5★ only). Replies to 1–3★ reviews are never posted without your approval.

ReplyPilot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, do not use it to train general-purpose AI models, and do not allow humans to read it except with your consent, for security purposes, to comply with law, or in aggregated, anonymised form.

AI processing

To draft a reply, the review text, star rating, reviewer's first name and your brand-voice answers are sent to our AI model provider. Phone numbers, emails and ID numbers are removed from review text before it is sent. We use providers that do not train on API data. Short generic reviews may be answered from a cache of earlier replies to reduce cost.

Sharing

We share data only with service providers that run ReplyPilot: Neon (database), Vercel (hosting), our AI model provider, Razorpay (payments), Meta (WhatsApp Business messages) and Google (your Business Profile). We do not sell personal data.

Security

Google access and refresh tokens are encrypted at rest with AES-256-GCM. Every database query is scoped to your account in the application and enforced again by Postgres row-level security, so each business can see only its own data. Data is transmitted over HTTPS.

Retention and deletion

We keep your data while your account is active. You can delete your account at any time from Settings → Delete account. This revokes our Google access and permanently deletes your business data immediately. We keep only a deletion receipt (reference code, email, dates). See Data deletion. You can also revoke access any time at myaccount.google.com/permissions.

Your rights

Under India's Digital Personal Data Protection Act, 2023 and other applicable laws, you may request access to, correction of, or erasure of your personal data, and withdraw consent. Contact us at privacy@example.com.

Reviewers

If you left a review for a business that uses ReplyPilot, the business controls that data. We process it on the business's behalf only to help them reply. You can contact the business or us to make a request.

Changes

We will post changes on this page and update the date above. Material changes will be emailed to account holders.

Contact / Grievance Officer

Sujeet Singh, Karmatix: privacy@example.com