Privacy policy

Last updated: 6 November 2026. This is a draft prepared for review by a qualified lawyer before launch.

GMB Review Reply (“we”, “us”) is a browser extension and website that helps businesses draft replies to customer reviews. It is operated by Pradipta Kumar Ray, an individual (sole proprietor) based in Bhubaneswar, India, TODO-LEGAL: your business address, which is shown publicly (a PO box or office address is fine), who decides how your data is used (the “data controller” or “data fiduciary”). Contact: support@gmbreviewreply.com.

What the extension can see, and when

On supported review sites, the extension runs only on the pages where a business replies to reviews: Google (www.google.com/local/business, Google Maps and business.google.com), Facebook, Yelp for Business, Trustpilot Business, Tripadvisor, the hotel extranets of Booking.com, Agoda, Expedia and MakeMyTrip / Goibibo, Airbnb hosting pages, and the restaurant partner dashboards of OpenTable, TheFork, Zomato, Uber Eats, DoorDash, Deliveroo and Just Eat. On Airbnb, Zomato and DoorDash it loads only on the host or partner pages. On Facebook, Tripadvisor, Google Maps and MakeMyTrip / Goibibo, Chrome loads it on the whole site because their reply pages have no fixed address, but it stays inactive there unless it finds a reply box next to a review. It checks the page inside your browser to find that box, and it never activates on a form where you write a review yourself. When it finds one, it picks out that review’s text, rating or score, and the reviewer’s display name, and shows you what it found so you can correct it. Nothing leaves your browser until you click Generate or an Adjust button, and only that review is sent.

On any other website, the extension does nothing at all until you select text and choose “Draft a reply with GMB Review Reply” from the right-click menu, or press its keyboard shortcut. Chrome then gives it temporary access to that one tab only (the “activeTab” permission). It reads the text you selected, shows a small drafting panel, and puts a draft into the reply box you click, or copies it.

The extension does not read other tabs, your browsing history, passwords or cookies of the sites you visit, and it never sends anything else from the page. It never clicks Post, Reply, Send or Submit for you. It stores only your login session and whether you accepted our data notice in Chrome’s local extension storage.

Before the extension sends anything, it shows a short data notice and asks you to agree. If we change how we use data, it shows the notice again and waits for your agreement before sending anything more.

What we collect

• Account: your email address and a login managed by our authentication provider (Supabase). When you sign in, your password passes over an encrypted connection through our server to Supabase, which stores it only as a secure hash. We never store or log your password.
• Business settings: the business name, greeting, tone, closing, sign-off, contact text, language and other preferences you save.
• The review you choose to reply to: when you click Generate, the extension sends that review’s text, its star rating or score, the review site, and the reply language you chose. The reviewer’s display name is sent only if your settings use it (the “Dear Sir / Dear Mam” greeting or “address by name” options). In the any-site mode we also receive the website’s name (for example, “localdirectory.com”) so the draft can mention the right site. When you click an Adjust button (Shorter, Warmer, More formal, Add apology), the extension also sends the text that is in the reply box at that moment, including any edits you typed, so it can be rewritten. Our server forwards this, with the relevant business settings, to our AI provider to write the draft. We store only a one-way fingerprint (hash) and the length of the review text, never the text itself.
• Drafts: each AI draft is kept for up to 24 hours so it can be recovered if your browser disconnects, then deleted automatically.
• Region: our host (Cloudflare) tells us which country a request comes from, based on your IP address. We use it only to decide which currency your prices are in, and store only “India” or “international” with your account. We do not store your IP address.
• Usage and billing: how many drafts you used, token counts and estimated AI cost, your plan, subscription status and payment references from Dodo Payments. We never receive card, UPI or bank details.
• Emails: we email you about payments, cancellations, account changes and when your drafts run low (you can switch off the low-drafts emails on your account page). Emails are sent through our email provider TODO-LEGAL: name it: Resend or Brevo.
• Abuse prevention: sign-up uses Cloudflare Turnstile (a privacy-friendly “I am human” check, which receives your IP address), and we check with Cloudflare’s DNS service that your email domain can receive mail, to reject temporary email addresses. To keep the free trial to one per person, we keep a normalised copy of the email address that used it.
• Technical logs: error codes, timestamps and diagnostic IDs. Our logs are designed not to contain passwords, tokens, review text or drafts.

Our website does not use advertising or analytics cookies or trackers. The account page keeps your login only for the browser tab you are using (session storage), which ends when you close the tab.

How we use it

We use this data only to provide and improve the single purpose of GMB Review Reply: drafting replies to reviews of your business. That includes running your account and plan, writing drafts, preventing abuse and fraud, keeping the service secure and reliable, measuring cost and performance, answering support requests, and meeting legal and tax duties. We do not use your data for anything else.

Chrome Web Store User Data Policy and Limited Use

The use of information received from the GMB Review Reply Chrome extension, and from any Google APIs, will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. In particular:

• We collect and use only the data needed to draft review replies, the single purpose described in our Chrome Web Store listing.
• We transfer data to third parties only to provide that purpose (the service providers listed below), to comply with the law, to protect against fraud, spam or abuse, or as part of a merger, acquisition or sale of assets after asking for your explicit consent first.
• We never sell your data, never use or transfer it for personalised advertising, never transfer it to advertising platforms, data brokers or other information resellers, and never use it to decide creditworthiness or for lending.
• No person working on GMB Review Reply reads your review content or drafts, except when you ask us to (for example in a support request and only for the data you point us to), when the data is aggregated and anonymised for internal operations, when it is needed to investigate security issues or abuse, or when the law requires it.

Who we share data with

We share data only with the service providers we need to run GMB Review Reply, each for the purpose below and under contracts or terms that limit their use of it:

• Cloudflare: hosting, database, the Turnstile human check (your IP address at sign-up) and the email-domain check.
• Supabase: login and email verification.
• Anthropic (and, if we switch providers, OpenAI): writing drafts. They receive the review text, rating, language, site name, the reviewer’s name when your settings use it, the current reply text when you use an Adjust button, and your relevant business settings for each request. Under their API terms they do not use this data to train their models by default and keep it only for a limited time. TODO-LEGAL: confirm current provider data-use and retention terms
• Dodo Payments: payments, invoices and tax, as merchant of record.
• Razorpay: only if we move payments to it as our backup provider, in which case it would receive your subscription and payment details instead of Dodo Payments. We will update this policy first.
• Our email provider: sending account and payment emails.

We may also disclose data if the law requires it, or to protect the rights and safety of our users and the public.

Security

All data between the extension, our website, our server and our providers travels over encrypted HTTPS (TLS) connections. Access to our systems is limited to the people who run the service and protected with strong passwords and two-step verification. TODO-LEGAL: turn on 2-step verification for Cloudflare, Supabase, Dodo Payments, Anthropic and the Chrome Web Store account If a data breach affects you, we will tell you and the relevant authorities as the law requires.

International transfers

We are based in India. Our providers run servers in several countries, including the United States and the European Union, so your data may be processed outside your country. Where the law requires it (for example for users in the EU or UK), we rely on safeguards such as the European Commission’s standard contractual clauses offered by our providers. TODO-LEGAL: confirm transfer safeguards with your lawyer

How long we keep data

• Drafts: 24 hours.
• Review text: never stored. Only a fingerprint and length, kept with the request record.
• Request records (no review text): up to about 13 months, for billing, support and abuse prevention.
• Account, business settings and usage: until you delete your account.
• Payment and subscription records: as long as tax and accounting law requires, even after you delete your account.
• The record that an email address used the free trial: created at sign-up and kept indefinitely, even after deletion, only to stop repeated free trials.

Your choices and rights

• Edit your business settings in the extension or on your account page at any time.
• Delete your account yourself from your account page. This cancels any subscription and deletes your account, business settings, request history and email history straight away. Your login is removed at the same time, or by us within 7 days if the automatic removal fails.
• Stop all data collection by removing the extension from chrome://extensions. Uninstalling also deletes your login session from the browser.
• Ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to move it to another service, by emailing support@gmbreviewreply.com. We reply within 30 days. You will not be treated differently for using these rights.

EU, EEA and UK users: we use your data to provide the service you signed up for (performance of a contract), to keep it secure and prevent abuse (our legitimate interests), and to meet legal duties such as tax records. You can also complain to your local data protection authority.

California users: we do not sell or “share” personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you.

India: under the Digital Personal Data Protection Act, 2023 you may also contact our Grievance Officer: Pradipta Kumar Ray, support@gmbreviewreply.com.

Children

GMB Review Reply is a business tool and is not meant for anyone under 18. We do not knowingly collect data from children.

Changes to this policy

If we change this policy, we will update the date above. If the change affects what data the extension collects or how we use it, we will tell you by email and in the extension before it applies, and the extension will ask for your agreement again before it sends anything more.

Contact

Pradipta Kumar Ray, TODO-LEGAL: your business address, which is shown publicly (a PO box or office address is fine). Email: support@gmbreviewreply.com. See also our support page.