Privacy Policy

REPLYfairy Privacy Policy

REPLYfairy is a trading name of iQspeaks Limited (Company Number: 09932765), registered at 51 St Barnabas Road, Woodford Green, IG8 7BY, United Kingdom.

1. What this policy covers

This policy explains what information REPLYfairy (“we”, “us”, “our”) collects when you use our Google review reply service, how we use it, and what rights you have over it.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, iQspeaks Limited is the Data Controller responsible for your personal data processed through REPLYfairy.

2. Information we access

• Your Google Business Profile data — reviews (text, star ratings, reviewer names as shown publicly on Google), and basic business/location information, via manager-level access you grant us. We do not access or store your Google account password.
• Business configuration you provide directly — brand voice preferences, reply signature, contact details, and similar settings.
• Contact information — name, email, and business details you provide when booking a demo or signing up.

3. What we don’t access

We do not request or need access to your Google account password, payment details stored in your Google account, or any Google services beyond your Business Profile’s review management functions.

4. Reviewer data

Reviews may contain personal data about the reviewer (e.g. their name as displayed publicly on Google). We process this data on the basis of our legitimate interest in generating and posting replies to reviews left on your Business Profile. Reviewers are not our clients and this data originates from, and remains subject to, Google’s own privacy terms. We do not use reviewer data for any purpose beyond generating and posting the specific reply to that review.

6. Our lawful basis for processing

In line with the wider iQspeaks Privacy Policy, we rely on the following lawful bases under the UK GDPR:

• Performance of a Contract — to deliver the REPLYfairy service you’ve signed up for.
• Legitimate Interests — for service improvement, security, and related B2B communications, where this doesn’t override your rights.
• Consent — for optional marketing communications or non-essential cookies.
• Legal Obligation — where required by law.

7. How we use this information

• To monitor your Google Business Profile for new reviews.
• To generate draft replies using AI, based on your review content and brand voice settings.
• To post approved replies back to your profile.
• To generate your monthly performance report.
• To provide customer support.

8. Third-party processing and international transfers

Review text and your configured brand voice guidance are sent to Anthropic (our AI provider) solely to generate draft replies. We do not sell, rent, or share your data with third parties for their own marketing purposes.

Anthropic processes data in the United States. Where personal data is transferred outside the UK/EEA, we rely on the UK International Data Transfer Addendum (IDTA) to the EU Standard Contractual Clauses, ensuring your data receives a level of protection equivalent to that under UK GDPR.

9. Automated decision-making

REPLYfairy uses AI to generate draft replies only. No reply is posted to your Google Business Profile without your review and approval. We do not carry out any solely automated decision-making that produces legal or similarly significant effects on you or your reviewers.

10. Data retention

We retain review data and reply history for as long as your account is active, plus 90 days after cancellation, to allow for account reactivation and to meet our own accounting and legal obligations. You can request earlier deletion of your data at any time by contacting us (see Section 14).

11. Your rights (UK GDPR)

You have the right to:

• Request access to your personal data.
• Request correction of inaccurate or incomplete data.
• Request erasure of your personal data.
• Object to processing based on legitimate interests.
• Request restriction of processing.
• Request data portability.
• Withdraw consent at any time, where processing relies on consent.

We will respond to any rights request within one month of receipt. If a request is complex, we may extend this by a further two months, and we’ll let you know if that’s the case.

You also have the right to complain to the UK Information Commissioner’s Office (ICO) at www.ico.org.uk. We’d appreciate the opportunity to address your concerns directly first.

12. Data security

We apply appropriate technical and organisational measures to protect your data, including:

• Encryption of data in transit (TLS) and, where applicable, at rest.
• Access to review and account data restricted to authorised personnel on a need-to-know basis.
• Secure storage of Google Business Profile access via OAuth tokens rather than stored passwords.
• Regular review of third-party processor security practices, including Anthropic’s.

No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

13. Changes to this policy

We’ll notify active clients of material changes to this policy by email.

14. Contact us

Questions about this policy, or to exercise your rights:

Email: [email protected] Registered address: iQspeaks Limited, 51 St Barnabas Road, Woodford Green, IG8 7BY, United Kingdom

You may also contact iQspeaks Limited directly at [email protected] or 0330 133 0113.