Privacy policy

The controller is Axel Leparmentier, a sole trader (entrepreneur individuel, EI) trading as ReplyTop — 15 allée de l'île, 92140 Clamart, France, support@replytop.com.

ReplyTop has not appointed a data protection officer: for any question, write to support@replytop.com with the subject “Personal data”. ReplyTop acts in two capacities:

• controller for the data of its customers and their teams (account, billing, support), of website visitors and of the businesses it prospects;
• processor for the data contained in the reviews and replies of its customers' establishments: it processes them on behalf of each customer, who is responsible for them (article 8).

For each use: the data concerned, what allows it (the legal basis) and how long it is kept.

• Your account and the Service — surname, first name, email, language, encrypted password or Google identifier, settings, team. Basis: performance of the contract. Retention: the life of the account.
• Billing — billing name and address, payments and invoices; card data stays with Stripe. Basis: the contract and our accounting obligations. Retention: ten years for accounting records.
• Access to platforms — Google authorisations, addresses of your review pages. Basis: the contract. Retention: until the listing is disconnected or the account is closed.
• Support and service emails — your messages, our replies, account-related emails (confirmation, setup help, alerts, invoices). Basis: the contract and our legitimate interest in helping you. Retention: three years after the last exchange.
• Security — connection logs and IP addresses. Basis: our legitimate interest and our security obligations. Retention: one year at most.
• Audience and ad measurement — pages viewed, device, referrer, and whether a visit from a Google ad led to a sign-up or a subscription, through Google Analytics and Google Ads, only with your consent. Basis: your consent, which you can withdraw at any time. Retention: thirteen months at most for cookies.
• Prospecting — name, address, website and generic email address of establishments, with their public reviews and replies, taken from public sources (Google listings, websites). Basis: our legitimate interest in presenting the Service to businesses. Retention: three years after the last contact. You can object at any time by replying “STOP” or by writing to support@replytop.com.
• Free tools — the text of a review pasted into the reply generator is sent to the AI model and is not kept; your IP address is used for one hour to limit the number of replies. The QR code generator runs entirely in your browser.

To provide the Service, ReplyTop collects the reviews published on your listings — the author's name or pseudonym, rating, text, date —, writes your replies and publishes them. These reviews are public on the platforms; ReplyTop processes them on your behalf, on your instructions (article 8).

To write a reply, ReplyTop sends the AI model the review, its author's display name, your instructions and, if you turn it on, a few replies you wrote yourself. Neither ReplyTop nor its provider uses this data to train AI models; the provider may keep it for up to thirty days to detect abuse.

ReplyTop's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Your data is never sold or rented. Only the publisher and these providers have access to it, each for its own task:

• Supabase Pte. Ltd. (Singapore) — database and authentication; data hosted in Ireland;
• Netlify, Inc. (United States) — hosting of the website and the application;
• OpenAI Ireland Ltd (Ireland) — the AI model that writes the replies; processing may take place in the United States;
• Stripe Payments Europe, Ltd (Ireland) — payment and invoices;
• Google Ireland Limited (Ireland) — sign-in with Google, access to your listings and, with your consent, audience and ad measurement;
• Infomaniak Network SA (Switzerland) — sending of emails.

Reviews from platforms other than Google are collected through a server run by the publisher, in France. Data may also be disclosed to an authority that requests it within a legal framework.

Some providers process data outside the European Union, notably in the United States. These transfers rely on an adequacy decision of the European Commission (Switzerland; US companies certified under the EU–US Data Privacy Framework) or on the Commission's standard contractual clauses. A copy of these safeguards is available on request at support@replytop.com.

Encrypted connections (HTTPS), data encrypted at rest, accounts isolated by access rules in the database, platform authorisations kept on the server side, administrative access restricted to the publisher.

In the event of a data breach posing a risk, ReplyTop notifies the CNIL (the French data protection authority) within seventy-two hours and, for the data it processes on your behalf, informs you under the conditions of article 8.

Account deletion is requested from the settings. It takes place after a notice period of fourteen (14) days, during which the request can be cancelled. The account and its data are then deleted, platform authorisations revoked and the subscription cancelled. Only a technical establishment identifier remains, for thirty (30) days at most, to prevent the same business from using up the free plan through successive accounts.

The data of the account and its establishments is erased from production systems within thirty (30) days, then from backups as they are rotated.

Invoices and accounting records are kept for ten (10) years, as required by law.

For the data ReplyTop processes on behalf of its customers, this article constitutes the processing contract required by article 28 of the GDPR. It forms part of the terms of use.

• Subject and duration — collecting the reviews of the customer's establishments, writing and publishing its replies, producing its statistics, for the life of its account.
• Data and data subjects — review authors (name or pseudonym, rating, text, date) and any data that a review or reply contains; members of the customer's team.
• Instructions — ReplyTop processes this data only on the customer's instructions, given through its settings and its use of the Service, including to diagnose and fix an issue the customer reports. It alerts the customer if an instruction appears to infringe the GDPR.
• Confidentiality and security — only authorised persons bound by confidentiality have access to it; the measures in article 6 apply.
• Sub-processors — the customer authorises those listed in article 4, which are bound by equivalent obligations. ReplyTop announces any addition or replacement on this page and by email thirty (30) days in advance; the customer may object by cancelling free of charge.
• Assistance — ReplyTop helps the customer respond to requests to exercise rights, ensure the security of the data and, where relevant, carry out an impact assessment. It notifies the customer of any breach of this data without undue delay, and no later than forty-eight (48) hours after becoming aware of it.
• End of the contract — when the account is closed, ReplyTop deletes this data within the periods in article 7; the customer may request a copy beforehand.
• Audit — ReplyTop provides the customer with the information needed to demonstrate compliance with these obligations and answers its written questions; an on-site audit, at the customer's expense, is arranged with thirty (30) days' notice.

You have the following rights over your data:

• access and rectification — find out what data is processed, receive a copy, correct it;
• erasure and restriction — have your data deleted, or its use frozen, in the cases provided by the GDPR;
• objection — object to processing based on our legitimate interest, and to prospecting at any time, without giving a reason;
• portability — receive the data you provided to us in a common format;
• withdrawal of consent — for audience and ad measurement, at any time, from the “Manage cookies” link at the bottom of the page;
• post-mortem instructions — decide what happens to your data after your death.

To exercise them, write to support@replytop.com or use our contact form; ReplyTop replies within one month. A request about a review published on a customer's establishment is forwarded to that customer, who is responsible for that processing; you can also ask the platform that publishes a review to remove it.

You can lodge a complaint with the CNIL, the French data protection authority (cnil.fr), or with the supervisory authority of your country.

The website uses two kinds of cookies:

• Necessary cookies — sign-in, security, language and remembering your cookie choice. They are exempt from consent; blocking them prevents you from signing in.
• Audience and ad measurement cookies (Google Analytics, Google Ads) — set only if you accept them, for thirteen months at most.
• Your choice — you can change it at any time from the “Manage cookies” link at the bottom of the page; refusing has no effect on your use of the website.

No cookie is used to show you ads, on this site or elsewhere.

This policy may change: the date at the top of the page shows the version in force. Any significant change is announced to customers by email.