This Privacy Policy describes how Replio LLC ("Replio," "we," "us," or "our") collects, uses, and protects information when you use our review management platform at app.repliohq.com and our website at repliohq.com (collectively, the "Service").

Replio is a B2B software platform that helps restaurants and other multi-location businesses work through what their guests tell them. That feedback comes from more than one place: public reviews on Google and other review sites, order feedback from delivery platforms such as DoorDash and Uber Eats, complaint emails a business forwards to us, performance reports a business uploads, and guest visit records a business sends us so it can ask for reviews. We provide tools to collect that feedback, find what keeps coming up, assign follow-up work to a team, generate suggested reply drafts, and post owner replies that an authorized person has approved.

Who this policy covers. It covers people who use Replio (account owners and their team members), people who visit repliohq.com or text us, and the guests of businesses that use Replio. When a business uses Replio, it gives us information about its own guests and team. We handle that information on the business's behalf and at its direction. If you are a guest of a business that uses Replio and you have a question about your information, you can contact that business, or email help@repliohq.com and we will work with the business to answer you.

1. Information We Collect

1.1 Information You Provide

• Account information: name, email address, business name, business location.
• Authentication: when you sign in with Google, we receive your name, email, and Google account identifier.
• Payment information: processed by Stripe. Replio does not store credit card numbers.
• Mobile phone number: an account owner who signs up with an email address or with Google is not required to give one. A mobile number is required in one case: if you join a team through a join link, you sign in with a one-time code sent by text, so that screen asks for your first and last name and your mobile number, and asks you to agree to receive that text. If you would rather not give a number, ask the account owner for an email invitation instead. See section 6 for how SMS communications work.
• Messages you text us: if you text a phone number Replio publishes, we receive your mobile number and the content of your messages, including any business name or link you send. We keep that conversation as a record of your inquiry whether or not you go on to create an account. See section 6.2.
• A mobile number you enter on our website: if you enter your mobile number on a repliohq.com form, such as a form that asks Rex to text you or the Rex text plan signup, we keep that number. If you check the box agreeing to texts, we also keep a record of your consent: the words you agreed to, when, the page or signup it came from, and your IP address or a one way hash of it. See section 6.2.
• Team and access controls: the names, email addresses, and mobile numbers of team members that an owner or manager enters in order to invite them or assign them work, and each person's role. If someone else added you to a Replio account, we received your details from them.
• Proof of work: photos and PDF files your team uploads to show that an assigned action was done. These can show people or the inside of your business, so upload only what you are allowed to share.
• Feedback you forward or upload: complaint emails you forward to Replio, delivery platform reports you upload, and screenshots of scorecards or performance reports you upload. These can contain a guest's name, contact details, order details, and whatever the guest wrote.
• Conversations with Rex: what you write to Rex, Replio's digital assistant, in the app or by text, Rex's replies, and the notes about your business that Rex has been asked to remember.
• Connected accounts: if you connect a delivery account or a GroupMe group, we receive the account identifiers and access needed to read from and post to it at your direction.
• Browser notifications: if you turn on notifications, we store the push subscription your browser creates so we can send alerts to that device. You can turn it off in your browser at any time.
• Partner program applications: if you apply to sell or refer Replio, we keep your first and last name, email address, phone number, IP address, and browser details.

1.2 Google User Data

When you authorize Replio to access your Google Business Profile (GBP), we request the https://www.googleapis.com/auth/business.manage scope, together with https://www.googleapis.com/auth/userinfo.email, which tells us the email address of the Google account you connected so we can record which account is linked. With your authorization, we access:

• The list of business locations you manage on Google
• Customer reviews left for those locations (including reviewer name, rating, review text, timestamp)
• Owner replies you or your team have posted to those reviews
• Basic business profile information (name, address, category)

We use this access to display reviews inside your Replio dashboard, generate AI-suggested reply drafts, and post owner replies you have explicitly approved back to Google on your behalf.

1.3 Information About Your Guests

A business that uses Replio gives us information about its guests, and we collect some from public sources on its behalf. We process this for the business and at its direction.

• Public reviews: the reviewer's public display name, the rating, the review text, and the date, from Google and other review sites.
• Delivery platform feedback: ratings and comments from DoorDash and Uber Eats, which can include the customer's name as the platform shows it, the order number, and the order amount.
• Guest contact and visit records: if a business connects its point of sale or another visit source, that system sends us guests' names, email addresses, and phone numbers, the date of the visit, the ticket total, and whether the guest agreed to receive texts from the business. We keep one contact record per guest per location, with a visit count and the date of the last visit.
• Review requests: at the business's direction, we send a guest an email asking for feedback after a visit. Each of those emails carries an unsubscribe link, and we record whether it was opened and whether a link in it was clicked.
• Private feedback: complaint emails and reports the business forwards or uploads, as described in section 1.1.

1.4 Usage Information

• Pages viewed, features used, and clicks within the Replio dashboard
• Device information (browser type, operating system)
• IP address and approximate location
• Login times and session activity
• Whether an email we sent you was opened. The daily brief carries a small tracking image for this. Its links are not tracked.
• Technical error reports from the app, with browser and device details, so we can find and fix faults

1.5 Website Visitors

• Forms: what you enter on a repliohq.com form, such as your name, email address, business name, phone number, and message.
• Spam screening: forms on repliohq.com are screened for automated spam. When a submission is blocked, or let through without a completed check, we keep a log entry with the IP address, browser details, and the name, email address, and message that were entered, so a real person who was blocked by mistake can still be answered.
• Analytics and advertising: page views and clicks on repliohq.com, as described in section 7.

2. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Display your reviews and other guest feedback inside the Replio dashboard
• Generate AI-suggested reply drafts using your business context and review content
• Sort feedback into recurring themes, read numbers out of reports you upload, and answer questions you ask Rex
• Post owner replies back to Google when you approve them
• Send review requests to your guests when you set that up, and measure whether they were opened and clicked
• Publish the reviews you choose on a public showcase page or website embed, when you turn that on
• Send emails (daily briefs, account notifications, billing)
• Provide customer support and respond to your inquiries
• Improve the Service and develop new features
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

3. Google API Services User Data Policy

Replio's use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We use Google user data only to provide and improve features that are user-facing and prominent in the Replio dashboard.
• We do not transfer Google user data to third parties except as necessary to provide the Service, comply with applicable law, or as part of a merger, acquisition, or sale of assets with prior notice to the user.
• We do not use Google user data for serving advertisements, and we do not allow humans to read Google user data unless we have your affirmative agreement, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or our use is limited to internal operations and the data has been aggregated and anonymized.

4. AI Processing

Replio uses Anthropic's Claude API to generate suggested reply drafts and coaching briefs based on review content and your business context, to sort feedback into themes, to read forwarded emails and uploaded reports, and to answer what you ask Rex. When we send content to Anthropic, that content is subject to Anthropic's data handling terms. Anthropic does not train models on Replio API data per Anthropic's stated policy.

What we send to Anthropic is not limited to public reviews. It includes:

• Public review text, with the reviewer's public display name and rating
• Complaint emails you forward to Replio, including the subject line and the body of the email
• Feedback from delivery platforms, which can include the customer's name and order details
• Screenshots of scorecards and performance reports you upload
• Your conversations with Rex in the app and by text, and the notes about your business Rex has been asked to remember

Replio also sends the text of reviews and other feedback to OpenAI's embeddings API. An embedding is a numeric representation of the text, which lets us group recurring themes across reviews and locations without a human reading every one. Text is sent for embedding only, never for content generation.

Some of this content is private, and it can contain personal information about your guests or your team that is not publicly visible anywhere. We send it only to provide the features described in this policy. Do not forward or upload content you are not permitted to share with us.

Replio never posts a reply automatically. Every suggested draft requires a person to review and approve it before it is published.

5. Data Sharing

We do not sell your personal information or your customers' review data. We share information only as follows:

5.1 Sub-processors

Replio uses the third parties below to operate the Service, each under its own published data processing terms. This list is current as of the date at the top of this page, and we update it when a sub-processor is added or removed.

These receive guest review content or personal data:

• Supabase (United States): database, authentication, and application hosting. Review data, guest contact records, uploaded proof files, conversations with Rex, coaching briefs, and account records are stored here.
• Anthropic (United States): generates suggested reply drafts and coaching briefs from review content, processes the private feedback, uploads, and Rex conversations listed in section 4, and composes the replies in the text message conversations described in section 6.2, which means the text of those messages is processed here. Anthropic does not train models on Replio API data per Anthropic's stated policy.
• OpenAI (United States): converts the text of reviews and other feedback into numeric embeddings so recurring themes can be grouped across locations. Text is sent for embedding only.
• Outscraper (United States): retrieves publicly posted reviews from review platforms on our behalf where a direct platform API is not available to us. Returns review text, rating, and the reviewer's public display name.
• Google (United States): Business Profile and Places APIs, and Google sign-in. See section 3 for how Google user data is handled.
• Mailgun (United States): delivers the daily coaching brief, invitations, transactional email, and the review request emails sent to guests, so it receives the recipient's email address. Brief content can include review excerpts. Mailgun records opens on emails to users, and opens and clicks on review request emails.
• Twilio (United States): transmits SMS messages to users who have opted in to text messages. Receives the mobile number and the message content only to deliver the message. See section 6.
• DoorDash and Uber Eats (United States): where you connect a delivery account, we read order and delivery review data and, at your direction, submit replies.
• GroupMe (United States): only if you connect a GroupMe group. GroupMe sends Replio the messages posted in that group so that Rex can answer the ones addressed to it, and Rex posts its replies there, which can include review excerpts and the names of team members.
• Telegram: delivers internal alerts to Replio staff. These include pipeline run status and error counts, and a notice when someone signs up, applies to the partner program, texts us, or submits a form on repliohq.com. Those notices include the person's name, email address, and phone number where given, and can include the message they wrote. Location names can appear in these alerts.

These receive account or operational data only, not guest review content:

• Stripe (United States): subscription billing. Replio never receives or stores full card numbers.
• Vercel (United States): web hosting and edge delivery for repliohq.com and app.repliohq.com.
• PostHog (United States): usage analytics for repliohq.com and the app, so we can see which pages and features people actually use. In the app, events are tied to your account, including your account email address.
• Sentry (United States): error monitoring for the app. Receives technical error reports with browser and device details. We remove sign-in tokens from what is sent.
• QR Server (api.qrserver.com): draws the QR code image for a location's review link in the app. It receives that link, and the IP address and browser details of the person viewing the screen.
• Google Ads and Meta (United States): when ad measurement is turned on, the Google tag and the Meta pixel on repliohq.com record page views and clicks on our sign-up, checkout, and Text Rex buttons, so we can tell which ads bring people to Replio. They set cookies and receive your IP address and browser details. They do not receive names, phone numbers, or guest review content from us.
• Cloudflare (United States): Turnstile runs an invisible check on the contact form, and on the form that asks Rex to text you, at repliohq.com to tell people from automated spam, with no puzzle to solve. It also checks the sign-in, sign-up and password reset forms at app.repliohq.com, where it may ask you to tick a box. Its use is subject to the Cloudflare Turnstile Privacy Addendum.
• Perplexity (United States): runs brand and category discovery prompts, for example "best chicken sandwich in Houston", so we can report whether your business appears in answer engines. Business and location names only.

To request our current sub-processor list or a copy of our data processing terms, contact help@repliohq.com.

5.2 Other Sharing

• Within your organization: team members you have invited to your Replio account can view reviews, drafts, and reply history for the locations you have given them access to.
• Public pages you publish: if you turn on a showcase page or a website embed, the reviews you choose are shown publicly there, with the reviewer's display name and review text, on a page anyone can open. You decide which reviews appear and can unpublish the page at any time. See our Copyright and Takedown Policy for how a reviewer can ask for a review to be removed.
• Your franchisor or brand: if you turn on data sharing in Settings, people your franchisor or brand has authorized get a read-only view of your business and location names and your review activity, such as ratings, themes, urgency, and response status. This is off unless you turn it on, and you can turn it off at any time.
• Legal compliance: when required by law, court order, or to protect the rights, property, or safety of Replio, our users, or others.
• Business transfers: in the event of a merger, acquisition, or asset sale, with prior notice to affected users.

6. SMS Communications

For account owners, SMS is optional. You are never required to provide a mobile number or to agree to receive text messages in order to create a Replio account with an email address or Google sign-in, to buy a subscription, or to get pricing. One path does need a number: a team member who joins through a join link signs in with a one-time code sent by text, so that screen asks for a mobile number and for agreement to receive that text. A team member who prefers not to give a number can ask the account owner for an email invitation instead. Apart from the Rex text plan, which is delivered by text, everything Replio does over SMS is also available without it.

Replio runs two separate text message programs. They send from different phone numbers, and they are described separately here because you can be in one without being in the other.

6.1 Account notifications and alerts

If you opt in to receive SMS messages from Replio, we may send operational alerts, guest feedback notifications, assigned action reminders, account notifications, sign-in codes you request, and customer support messages. Message frequency varies based on account activity. Message and data rates may apply.

6.2 Text Rex (texting Replio)

Replio publishes a phone number you can text to ask about the product. This is a program you start. We text you only if you asked us to: by texting the number yourself, or by entering your mobile number on a repliohq.com form and checking the box that asks Rex to text you. If you ask on a form, Rex may send the first text: a confirmation that names Replio, then replies to what you send. We never add a number because you visited the site or appeared on a list, and we never buy or rent numbers. Texting us is not a condition of getting pricing, a demo, or support, all of which are available on the website without a phone number.

When you text that number we receive your mobile number and the content of your messages, and we reply. If you tell us the name of your restaurant or send a link to it, we look up that business's publicly posted reviews and ratings through Google and answer with what we found. We read what any member of the public can read. We do not need, ask for, or receive access to your Google account, your point of sale, or any private business system to do this.

Message frequency varies and depends on the conversation. If you sign up for Replio's Rex text plan and check the box agreeing to texts, Rex may also send a welcome text, a notice before your free trial's first charge, alerts when new guest reviews arrive, and, if you turn it on, one daily review summary. If you buy the Rex text plan without checking that box, we send nothing until you text Rex yourself. Message and data rates may apply. Starting a conversation is not consent to marketing messages. If we later want to send you something you did not ask for, we ask first.

6.3 Opting out

Reply STOP to any Replio message to end text messages from the number that sent it. Reply HELP for assistance. We record the opt-out.

Because the two programs send from different numbers, STOP applies to the number you sent it to and not to the other one. If you reply STOP to the number in section 6.2, that conversation ends, and a sign-in code you later request still reaches you from the number in section 6.1, because a sign-in code is sent only at the moment you ask for one. To end every text message from Replio, reply STOP to each number, or email help@repliohq.com and we will remove your number from both.

You can also withdraw consent at any time by emailing help@repliohq.com. Opting out of SMS does not affect your account, your subscription, or your access to the Service.

6.4 How we handle this data

Replio does not sell, rent, or share mobile phone numbers, SMS consent information, or SMS opt-in data with third parties or affiliates for marketing or promotional purposes. We use your mobile number, your messages, and your consent record only to send the messages described above, to answer you, and to keep proof that you agreed to receive them.

Your mobile number is handled only by the service providers in section 5.1 that we need in order to run these programs: the telecommunications provider that transmits the message on our behalf, the database and sign-in host where your number and consent record are stored, and the internal alert tool that tells Replio staff when someone new has texted or signed up. We do not give any of them permission to use your number for their own marketing. The text of a conversation under section 6.2 is also processed by the model provider listed in section 5.1 in order to compose a reply, and the business name or link you send is used to look up that business's public reviews through Google, also listed in section 5.1. We do not share any of it with anyone else.

You can ask us to delete an inquiry conversation and the mobile number attached to it at any time by emailing help@repliohq.com.

7. Cookies and Tracking Choices

Here is what repliohq.com and the app store in your browser or use to measure activity, and what you can do about each.

7.1 What is always on

• Sign-in: the app keeps your session in your browser's storage so you stay signed in.
• Spam checks: forms on repliohq.com use Cloudflare Turnstile and a short-lived form token, and the sign-in forms at app.repliohq.com use Cloudflare Turnstile, to tell people from automated spam.
• Visit source: repliohq.com keeps the page you arrived from and any campaign tag in the link, in your browser's session storage, so a form you send can show which page it came from. It is not a cookie, it holds no personal details, and it clears when you close the tab.
• Your privacy choice: we store the choice you make below so we do not ask again on every page.

7.2 What runs only if you allow it

• Analytics: PostHog records page views and clicks on our main buttons, and sets a cookie or browser storage entry to tell one visit from another. We do not record your screen or your keystrokes.
• Advertising: when ad measurement is turned on, the Google tag and the Meta pixel record page views and clicks on our sign-up, checkout, and Text Rex buttons, and set their own cookies. See section 5.1.

Analytics and advertising tags that are not needed to run the site load only after you allow them. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out and leave them off. You can change your choice at any time with the "Privacy choices" link in the footer of repliohq.com.

7.3 Email tracking

Some emails we send to users, such as the daily brief, carry a small image that tells us the email was opened. Review request emails sent to a business's guests record opens and link clicks. You can stop this by turning off image loading in your email program or by unsubscribing.

8. Data Retention

We keep your account information, your reviews and other feedback, and your guests' contact records for as long as your account is active. We do not delete data automatically on a schedule. When you ask us to delete your account or any part of your data, we delete it and confirm to you within 30 days of your request, unless the law requires us to keep something, in which case we will tell you what and why.

To ask for deletion, email help@repliohq.com. Cancelling a subscription does not by itself delete your data, so tell us if you want it removed.

9. Your Rights and Choices

• Access and export: you can request a copy of the personal data we hold about you.
• Correction: you can update your account information from within the Replio dashboard or by emailing us.
• Deletion: you can request account and data deletion at any time.
• Revoke Google access: you can revoke Replio's access to your Google account at any time by visiting https://myaccount.google.com/permissions.
• Email choices: marketing emails and recurring emails, such as the daily brief, include an unsubscribe link. Review request emails sent to guests include one too. Transactional messages, such as sign-in codes, invitations, security notices, and billing receipts, cannot be turned off while you have an account.
• Cookies and tracking: see section 7.

To exercise any of these rights, contact help@repliohq.com.

10. State Privacy Rights

Some U.S. states give their residents specific rights over personal information. Depending on where you live, you may have the right to:

• Know and access: ask what personal information we hold about you and get a copy of it.
• Delete: ask us to delete personal information we hold about you.
• Correct: ask us to fix personal information that is wrong.
• Opt out of sale or sharing: we do not sell personal information for money. When ad measurement is turned on, the Google and Meta tags described in section 7 may count as "sharing" or "targeted advertising" under some state laws. You can opt out with the "Privacy choices" link in the footer of repliohq.com, or by turning on Global Privacy Control in your browser.
• No discrimination: we will not deny you service, charge you a different price, or give you a lower quality of service because you used any of these rights.

To make a request, email help@repliohq.com from the email address on your account, or tell us enough to find your records. We may ask for information to confirm it is you before we act. We respond within 30 days. If we decline a request, we will tell you why, and you can reply to ask us to look again.

If your information is in Replio because you are a guest or a team member of a business that uses Replio, we hold it on that business's behalf. We will pass your request to the business and help it respond.

11. Security

We implement industry-standard security measures, including encryption in transit (TLS) and at rest, Row-Level Security on our database, OAuth-based authentication, scoped API tokens per customer, and regular security reviews. No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you in accordance with applicable law.

12. Children

Replio is a B2B service intended for use by business owners and their adult team members. You must be at least 18 years old to use the Service. The Service is not directed to children, and we do not knowingly collect personal information from children under 13. If you believe a child under 13, or anyone under 18, has given us personal information or has an account, contact help@repliohq.com and we will delete the account and the information.

13. International Users

Replio is operated from the United States. If you access the Service from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will notify you by email or through the Replio dashboard before the change takes effect.

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, contact us at:

Replio LLC
Email: help@repliohq.com