Privacy policy

This is an English translation for convenience. If it differs from the Ukrainian version, the Ukrainian version applies.

Version of 4 November 2026.

This policy explains what data MapsReply uses, why it is needed and how you can control it.

Who is responsible for your data

MapsReply is operated by Ukrainian sole proprietor Мирошниченко Сергій Олексійович. The operator’s details are on the Contacts page. For privacy questions, email info@mapsreply.com.

What data we use

• Account data: username, email address, a protected representation of your password, and your settings.
• Business data: the selected locations, their names, countries and time zones, and your reply rules.
• Reviews: text, rating, reviewer name, dates, existing replies and drafts.
• Subscription data: plan, access period, allowance used, payment statuses and payment identifiers.
• Technical data: IP address, browser, request time, security events and errors.

We need this data to run your account, prepare and publish replies, process payments, provide support and protect against abuse. The country of the selected Google location determines the plan country and its currency; the interface language does not change this.

Google sign-in and connecting your business

Signing in with Google confirms your identity and email address and also passes us the first name from your Google profile (without your surname). We use it only to greet you in your workspace; we do not store your profile photo. Signing in does not give access to your business locations and does not turn on automatic replies.

You connect Google Business Profile separately. Google’s permission to manage a Business Profile is broad, but MapsReply works only with the locations you select. We receive the accounts available to you, information about your locations, reviews and replies. Access tokens are used for background work; we do not need your Google password.

MapsReply does not request access to your Gmail, Google Drive files or contacts. You retain ownership of and control over your Business Profile.

How we use AI

To prepare drafts, MapsReply sends the necessary context to the AI providers listed below. They receive the review text and rating, the reply language, the business name and description, the tone, rules, examples and up to three recent replies as context. The reviewer’s name is included only if you have turned on addressing reviewers by name.

Automatic preparation of draft replies is part of the service. At registration, whether by email or through Google, you accept the Terms of use and this policy, including such preparation, by ticking a single box; we store the version, time and text of that box. You can turn preparation off in your account settings at any time: drafts are then no longer prepared, no requests are sent to the providers, and manual features remain available. A request already in progress may complete before the switch-off is confirmed; no new requests are sent after that. Saved drafts remain available.

Consent to the preparation of drafts does not permit their automatic publication and is not consent to payment or advertising. We store the automatic-publication permission for a location together with the text you confirmed, its version and the time it was given or withdrawn, so that we can show exactly what was permitted. Do not add unnecessary personal or confidential information to your business rules or examples.

AI providers

Only two AI providers may receive data. The primary provider is Anthropic (Claude API). The backup provider is OpenAI (API): the same request is sent to it only when the primary provider is unavailable. Data is not passed to any other AI provider. Requests to OpenAI use the store: false parameter; this does not mean that the provider stores nothing at all. Processing and technical retention periods are governed by each provider’s API terms and the applicable settings of the account with that provider.

This list may change. Before adding a new provider, we update this section and notify users. If a change requires new permission, the transfer begins only after that permission has been obtained; your current consent does not give unlimited permission to transfer data to any future services.

Google tokens, your password, the owner’s email address, payment details and Google resource identifiers are not included in generation requests. We do not use the Google data we receive to train general-purpose models.

Who receives data

Google provides authentication and Business Profile functions; the AI providers listed above prepare text. We send reviews and drafts for approval, and notifications about automatic replies to serious complaints, to Telegram if you have connected it, or otherwise to your account email address. These messages contain the full text of the review and the reply. You can turn off draft emails in your notification settings. Payments may be processed by monobank or WayForPay; the specific provider is shown at checkout. MapsReply does not store full card numbers or CVV codes.

The site and its mail server are hosted on a Contabo VPS in Germany. Cloudflare provides DNS, site protection, Turnstile and Email Routing; support emails are forwarded to a Google Gmail mailbox. We use our own mail server to deliver system emails. These providers receive only the data needed for the relevant service.

Data on our VPS is processed in Germany. Google, Anthropic, OpenAI, Cloudflare and other international services you connect may process the relevant data in other countries under their own terms. Hosting the site in Germany does not mean that all third-party services process data only in Germany. We limit transfers to the purposes described and in line with applicable data-protection requirements.

Payment and card-linking data

If you choose to pay or link a card, the payment provider receives the order identifier, the selected package, the amount and currency, together with the first name, surname, email address, phone number, payer country and IP address needed to process the payment. The text of Google reviews and replies is not sent for payment.

You enter your card number, expiry date and CVV directly on the payment provider’s secure page. For recurring payments you have agreed to, MapsReply may store an encrypted payment token instead of the full card number, and encrypted payer contact details. The token is used only for the subscription you have separately confirmed; registering or accepting this policy does not authorise any charges.

Once automatic renewal is cancelled, the token and the payer contact details used for those charges are deleted from the production system. Minimal records of payments already made, consents and refunds are kept for accounting and for handling requests. Backups are subject to the retention periods described below. The payment provider processes data under its own rules: monobank or WayForPay.

Analytics and advertising

We use Google Analytics for statistics on visits to public pages and Meta Pixel to measure advertising and work with advertising audiences. Analytics and marketing have separate settings: the relevant tools load only after you allow their category. Refusing does not prevent you from using MapsReply’s main features.

These tools receive information about public-page views, scroll events and clicks on public buttons, the referral source, browser, device and cookie identifiers. Page views by signed-in users, the sign-in and registration pages, the private workspace, the reply generator and the QR code tool are not tracked. Review and reply text, data about review authors, Google tokens and information entered in forms are not sent to analytics or advertising tools. Google Analytics advertising features and Google signals are turned off; consent to analytics is not permission for personalised advertising.

With your analytics permission, our server may also send Google Analytics events for completed registration and confirmed payment. For a purchase, it sends the package code, the plan country, the amount actually paid, the currency, the payment type and a technical transaction identifier. The Google Analytics cookie identifier is used to link these events to a permitted visit. Email address, name, internal account number, bank details and card data are not included in these events. Registration and payment are available without this permission.

The server-side link between the cookie identifier and the consent may be kept until the consent’s 180-day term expires. Events awaiting transfer are kept for no more than two days; after a transfer attempt, only a technical marker remains to prevent duplicates, without the cookie identifier or the purchase amount. After you withdraw consent, no new events are sent; a request already in progress may complete. In Google, detailed user and event data is kept for the configured period, currently 14 months, so that results can be compared year on year; most aggregated reports are not limited by this setting.

For more details, see the Cookie policy, Google’s explanation of how it uses data from partner sites and Meta’s cookie policy.

Limits on the use of Google data

We comply with the Google API Services User Data Policy, including the Limited Use requirements where they apply. Data is used for the user-facing features described, and transfers are limited to providing those features, necessary security measures and compliance with the law.

Data from connected Google profiles, reviews and replies is not sold or used for advertising, creditworthiness assessments or training general-purpose models. Staff may view this data for support only with your specific consent, except where necessary for security or to comply with the law. Consent to marketing cookies does not change these restrictions.

Legal bases for processing

Account data and data for the service you ordered are processed to conclude and perform the contract. Payment records are also needed to comply with legal requirements. Automatic preparation of replies, including the transfer of data to Anthropic and OpenAI, is necessary to perform the contract; you can turn it off in your account settings. Optional integrations, automatic publication and tracking each require their own separate permission. Processing for security purposes is limited to necessary and proportionate measures.

As the business owner, you are responsible for having proper authority to connect locations and for the lawfulness of the data you add to the service.

Retention and protection

Access to data is restricted, and Google tokens are stored encrypted. Different owners’ data is kept separate. Working copies of Google Business Profile content are kept for up to 22 calendar days; scheduled clean-up starts one day earlier. Daily Contabo backups are kept for up to 7 days. Working copies and backups of Google content together are kept for no more than 30 calendar days from receipt; no permanent archive of reviews is created. Editing a draft does not extend its retention period.

Account data and current settings are kept for as long as the account is in use. After a request to close the account is confirmed, we delete working data within 7 working days unless there is another lawful basis for keeping it. Backups of that data leave the retention cycle within the following 7 calendar days. A restored copy remains closed to users and background jobs until withdrawals and deletions have been applied again.

Web server access logs are kept for 2 days and do not contain URL query strings. Generation logs contain only service metadata, without prompt or review text. We keep records of your consents to prove your current choices; confirmation of your cookie choice and its version is kept for up to 180 days. Metadata about sending the Google service notice is kept for up to 365 days or until the account is deleted, without review text or email content. Necessary accounting documents and payment records are kept for the periods required by law, without unnecessary review text.

Free reply generator

The generator accepts a business name, review text and rating, language and tone and, with your separate consent for each request, sends them to the AI providers listed above to prepare a draft. Do not include personal or confidential information. To protect against bots, we use Cloudflare Turnstile, a session cookie and server-side limits. Attempt counters contain hashed identifiers and technical metadata without review text and are kept for up to 35 days.

Your rights and control of your data

You may request access to your data, its correction, restriction or deletion in the cases provided for by law, and you may withdraw your consent. To do so, email info@mapsreply.com. Send only the information needed to deal with your request.

Automatic publication, the Google connection, your MapsReply account and your subscription are managed separately. The steps are described on the Data deletion page. Replies already published on Google do not disappear when the service is disconnected. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

To protect your rights, you may also contact the Ukrainian Parliament Commissioner for Human Rights or another competent authority under applicable law.

Changes to this policy

The current version is available on this page. We notify you of material changes through the service or by email. If a new purpose of processing or transfer requires consent, we ask for it before such processing begins.