Privacy Policy
This policy explains what personal data we process when you use the RepStar app and the getrepstar.com website, why we process it, how long we keep it and what rights you have. It is based on the EU General Data Protection Regulation (GDPR) and the Hungarian Act on Informational Self-Determination (Infotv.). The Hungarian version is available here.
1. Data controller
Controller: Márton Farkas (RepStar)
Address: Miskolc, Hungary
Email: info@getrepstar.com
Website: getrepstar.com
2. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, language, country, time zone | Creating your account, signing in, providing the service, service notifications | Performance of a contract – GDPR Art. 6(1)(b) |
| Google account email address and access permission (encrypted) | Reading and replying to the reviews of your business profiles | Performance of a contract; you grant the Google permission and can revoke it at any time |
| Google Business Profile data: profile name, address, review text, star rating, reviewer display name, replies | Showing reviews, drafting and publishing replies | Performance of a contract |
| Further Google Business Profile data: description, opening hours, phone number, website, categories, number and date of photos and posts; the profile score and AI analysis | Calculating the profile score, suggestions, editing the profile at the user's request | Performance of a contract |
| Photos uploaded and posts published from the app | Publishing them on the user's Google Business Profile. Photos are stored at a public address so that Google can download them | Performance of a contract |
| Business description, tone of voice and signature you provide | Personalising replies | Performance of a contract |
| Subscription and billing data (plan, period, billing name and address) | Payment and invoicing | Performance of a contract; legal obligation (accounting law) |
| Push notification token | Notifying you about new reviews | Performance of a contract; can be switched off on your phone at any time |
| Customer support correspondence | Answering questions and complaints | Performance of a contract; legal obligation |
We never see or store card details: payments are handled by Stripe, or by Apple or Google for subscriptions bought in an app store.
3. Recipients of review requests
When a user (a business) sends review request emails to its customers, the business provides the customers' names and email addresses. The business is the controller of this data; we process it as a processor, only on the business's instructions and only to send these emails. If you received such an email as a customer, you can unsubscribe immediately with the link at the bottom of the email and you will not receive further requests. You can address any other request to the business that sent the email or to us.
4. Artificial intelligence
To draft replies, profile analyses, business descriptions and posts, we send the review text, the reviewer's display name, the star rating, the business profile data and the description you gave about your business to Anthropic (Claude). Under its contractual terms Anthropic does not use data received through its API to train its models. No automated decision-making with legal effects on you takes place.
5. Processors and data transfers
| Provider | Task | Location |
|---|---|---|
| Supabase | Database, server, sign-in | EU (Ireland) |
| Google (Google Business Profile API) | Reading reviews, publishing replies | EU / USA |
| Google (Google Maps Platform, Places API) | Public data of competitor businesses you select (rating, review count, completeness) | EU / USA |
| Anthropic | Drafting replies with artificial intelligence | USA |
| Stripe | Online payment, subscription management | EU (Ireland) / USA |
| Resend | Sending emails (sign-in code, notifications, review requests) | EU / USA |
| Expo | Delivering push notifications | USA |
| Netlify | Website hosting | USA |
| Apple, Google Play | Subscriptions bought in an app store | EU / USA |
Transfers outside the European Economic Area (USA) are based on the EU–U.S. Data Privacy Framework or on standard contractual clauses adopted by the European Commission. We do not sell your data and do not use it for advertising.
6. How long we keep data
- Account and business profile data, uploaded photos, posts: for as long as the account exists. When you delete your account (in the app: Settings › Delete account, or as described on the account deletion page), we delete them permanently and revoke the Google access.
- Competitor data (public Google data of other businesses): up to 30 days, then refreshed or deleted. Deleted immediately when you remove the competitor.
- Review request recipients: as long as the business keeps them on its list, at most until the account is deleted. Unsubscribed addresses are kept so that we never email them again.
- Invoices and accounting records: 8 years, as required by accounting law.
- Support correspondence: up to 5 years after the case is closed (general limitation period).
- Backups and logs: according to the backup cycle, up to 30 days.
7. Security
Data is transmitted over encrypted connections (HTTPS) and protected with access control in the database; every user can access only their own data. The Google access is stored encrypted and used only to read and reply to reviews and to manage the business profile at the user's request.
8. Cookies and local storage
The website and the app only use local storage that is necessary for them to work (for example to keep you signed in and to remember your language). We do not use tracking, analytics or advertising cookies.
9. Your rights
You can request access to, correction or deletion of your data, restriction of processing and a machine-readable copy of your data (portability), and you can object to processing. You can revoke the Google permission at any time in the app or in your Google account's security settings. Send requests to info@getrepstar.com; we reply within one month.
If you believe we have violated your data protection rights, you can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH; 1055 Budapest, Falk Miksa utca 9–11.; ugyfelszolgalat@naih.hu; naih.hu) or go to court.
10. Use of Google API data
RepStar's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We use Google user data only to provide the features the user sees in the app: showing and replying to reviews, calculating the profile score and suggestions, and publishing the profile edits, posts and photos the user requests. We do not sell Google user data, do not use it for advertising, do not allow humans to read it except with the user's consent, for security purposes or to comply with the law, and do not use it to develop, improve or train generalised AI or machine learning models.
11. Changes
We may update this policy; we will notify you of material changes by email or in the app. The current version is always available on this page.