Privacy Statement

Last updated: 21 October 2026

This is a translation. In case of any difference, the Dutch version prevails.

ReplyHero is a service of NorthernLights Solutions BV. This statement explains which personal data we process when you visit our website or use ReplyHero, why we do so and what rights you have. We process personal data in accordance with the General Data Protection Regulation (GDPR). For the other activities of NorthernLights Solutions, the privacy statement on northernlights.solutions applies.

1. Contact details

2. Our role

For the data of our customers and of visitors to our website, we are the controller.

For the data in reviews on a customer's Google Business Profile, such as a reviewer's name and the text of the review, that customer is the controller. In that case we are a processor: we only use that data to draft and post replies on the customer's behalf. The data processing agreement in article 10 of our terms and conditions applies to this. Did you write a review and do you have a question about your data? Please contact the business you wrote the review about. We help that business respond to your request.

3. Which personal data do we process?

From customers

• Account data: name, email address, company name and your password (stored encrypted) or your sign-in via Google.
• Connection with Google: the access and refresh tokens of your Google Business Profile (stored encrypted with AES-256-GCM), the IDs of your account and locations, and the name and address of your locations.
• Settings: chosen tone, language, your own instructions, standard sign-off and the workflow per location.
• Subscription and payment: chosen plan, status and your customer number at Stripe. Your payment details themselves are processed by Stripe; we do not see full card details.
• Communication: emails and support requests.

From reviewers (on behalf of our customer)

• The name as shown on Google (unless the review is anonymous), the star rating, the review text and the date, plus the reply that ReplyHero drafts.

From website visitors

• Technical data in the server logs of our hosting provider, such as IP address, browser and time, for security and troubleshooting. We do not use analytics or tracking.

4. Purpose and legal basis

• Performance of the contract (Art. 6(1)(b) GDPR): managing your account, connecting your business profile, drafting and posting replies, and billing your subscription.
• Legal obligation (Art. 6(1)(c) GDPR): keeping invoices and accounting records.
• Legitimate interest (Art. 6(1)(f) GDPR): securing the service, preventing abuse, resolving outages and informing you about your account.
• Review data is processed on the instructions of our customer, who relies on its legitimate interest in responding to public reviews.

We do not take decisions based solely on automated processing that produce legal effects. The AI only drafts reply texts.

5. Use of data from Google

ReplyHero requests access to your Google Business Profile. We use that access solely to retrieve your locations, read your reviews and post replies to those reviews or show them in your portal.

We do not sell this data, do not use it for advertising and do not share it with others, except with the processors listed below to the extent necessary to provide the service, when required by law, or with your consent. We send review texts to our AI provider to draft a reply; that data is not used to train AI models.

ReplyHero's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke ReplyHero's access at any time via the security settings of your Google Account.

6. Retention periods

• Account data and settings: as long as your account is active; after that we delete them within 30 days, unless we must keep them longer to meet a legal obligation.
• Google access tokens: as long as the connection is active; we delete them within 30 days after your subscription ends, or earlier if you ask us to. If you revoke access via Google, the tokens stop working immediately.
• Reviews and replies in ReplyHero: as long as your account is active; after that deleted within 30 days. Reviews and posted replies on Google itself remain there.
• Customer records and invoices: 7 years (statutory tax retention obligation).
• Support requests: 12 months.
• Server logs: a limited period, as set by our hosting providers.

7. With whom do we share data?

We work with the following processors. We have made agreements with them about security and confidentiality. We never sell data to third parties.

• Supabase (database and accounts; storage in the EU, Ireland)
• Vercel (hosting of the website and the application; servers in the EU, Dublin, with a global delivery network)
• Anthropic (the AI model Claude, which drafts replies)
• Google (Google Business Profile API and sign-in with Google)
• Stripe (payments and invoicing)
• Resend (sending emails about your account, such as notifications about replies that are ready for you)
• Google Workspace (business email)

8. Transfers outside the EU

Some of our processors (such as Anthropic, Vercel, Stripe, Resend and Google) may process data in the United States. Where data is transferred outside the EU, this is done on the basis of the EU-U.S. Data Privacy Framework or the Standard Contractual Clauses of the European Commission.

9. Cookies

Website: our website does not place cookies and does not use tracking or analytics. We host fonts ourselves; they are not loaded from Google.

Portal: in the ReplyHero app we only use functional cookies that are needed for the service to work: your login session, a security cookie while connecting with Google (valid for 10 minutes) and your language preference (valid for 1 year). No consent is required for these strictly necessary cookies.

10. Security

We protect data with encrypted connections (TLS), encrypted storage of access tokens (AES-256-GCM) and access rules at database level, so that each customer can only see their own data. Only people who need it for their work have access to personal data.

11. Your rights

You have the following rights:

• Right of access to your data
• Right to rectification or completion
• Right to erasure (the "right to be forgotten")
• Right to restriction of processing
• Right to object to the processing
• Right to data portability
• Right to withdraw consent you have given at any time

Send your request to privacy@replyhero.ai. We respond within 30 days.

12. Filing a complaint

If you are not satisfied with how we handle your data, please let us know first. You can also file a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit, GBA). If you live in the Netherlands, you can also contact the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).

13. Changes

We may amend this privacy statement. The most recent version is always on this page, with the date at the top. In the event of significant changes, we will inform customers by email.