Privacy Policy

Last updated October 18, 2026

This policy explains what information ReplyIsland (“ReplyIsland”, “we”, “us”) collects when you use replyisland.com and our review-reply service, what we do with it, and the choices you have. ReplyIsland is a sole proprietorship based in New York, not a corporation or LLC.

The short version: we collect only what we need to run the service, we don't sell or share your personal information for advertising, we don't use advertising or tracking cookies, and you can ask us to see or delete your data at any time.

1. What we collect

• Free review check: business name, Google Maps link, your email, and your town if you give it.
• Signup and account: plan choice, business name, Google Maps link, your name, email, optional phone number, and your reply preferences (tone, language).
• Payments: Stripe collects your card and billing details on its own secure checkout page. We never see or store your full card number. We receive your Stripe customer and subscription IDs, subscription status, billing email, and basic payment details Stripe shares with merchants (for example card brand and last 4 digits).
• Reviews and replies: the Google reviews of your business (which are public and include reviewers' display names and review text), the reply drafts we write, and your edits, approvals and skips. If you forward Google's “new review” emails to us, we receive the contents of those emails.
• Customer lists (Done-for-you plan only): if you choose to give us customer names and email addresses so we can send review requests on your behalf.
• Reply demo: the text you paste into the demo is sent to our AI provider to write a sample reply. We don't store the review text or names you paste. We keep only a small log entry (star rating, tone, language, and whether the AI or a fallback template was used).
• Emails you send us: the contents of messages you send to hello@replyisland.com.
• Technical data: your IP address, browser type and request logs, which our hosting provider records automatically. We also use your IP address briefly in memory to limit abuse (for example, too many demo requests).

We don't ask for, and you shouldn't send us, sensitive information like Social Security numbers or health information.

2. How we use it

• To provide the service: draft replies, send approval emails, post replies you've approved, send review requests and monthly reports, and make your QR card.
• To answer your free check request and your questions.
• To bill you, send receipts and subscription notices, and prevent fraud and abuse.
• To improve reply quality, for example by learning from the edits you make to drafts for your own business.
• To keep the service secure and to comply with the law.

We send marketing email only if you ask for it, and every marketing email includes an unsubscribe link and our mailing address. Requesting a free check doesn't add you to a mailing list. Customers get service emails (approvals, reports, billing notices) for as long as they have an account.

3. Who we share it with (subprocessors)

We use these service providers to run ReplyIsland. They process data on our behalf to provide their service to us:

• Vercel: website hosting and request logs.
• Supabase: our database (leads, signups, account and reply data).
• Stripe: payments, subscriptions and invoices.
• Resend: sending our emails.
• An AI model provider: review text and your business details are sent through the provider's business API to write reply drafts. We don't opt in to any program that lets the provider train its models on your data. Providers may keep API data for a limited time for security and abuse monitoring under their own terms. Email us if you want to know which provider we currently use.
• Google: to read your reviews and post approved replies on your Google Business Profile, and as the provider of the email inbox we use to run the business.

We don't sell personal information, and we don't share it for cross-context behavioral advertising. We may disclose information if the law requires it, to protect our rights or someone's safety, or to a buyer if the business is ever sold (in which case this policy would continue to apply to your data).

4. Google account access

If you add us as a Manager on your Google Business Profile, or later connect your Google account, we use that access only to read your reviews and post replies you've approved. We don't use Google data for advertising, sell it, or transfer it to anyone except as needed to provide the service. You can remove our access in your Google Business Profile settings at any time.

5. Customer lists

If you give us a customer list, you confirm you have permission to email those people. We use the list only to send your review requests, include an unsubscribe link in every message, honor unsubscribes, and never use it for anything else or share it with anyone except our email provider. We act on your behalf for this data; if one of your customers asks us about their data, we'll refer them to you or delete it.

6. Cookies and tracking

replyisland.com doesn't use advertising, analytics or tracking cookies. Stripe's checkout page, which runs on Stripe's own website, uses cookies needed for payments and fraud prevention under Stripe's privacy policy. If we ever add analytics, we'll update this policy first.

7. How long we keep it

• Free check requests: up to 12 months, then deleted.
• Account, review and reply data: while you're a customer, and up to 12 months after you cancel (so you can come back without starting over), then deleted.
• Customer lists: deleted within 30 days after you cancel or ask us to.
• Billing and tax records: as long as tax law requires, typically up to 7 years.
• Demo log entries: these contain no personal information and may be kept to improve the service.
• Server logs: kept by our hosting provider for its standard log period.

Ask us and we'll delete your data sooner, except records we must keep by law.

8. Your rights and deletion requests

You can ask us to tell you what personal information we have about you, give you a copy, correct it, or delete it. Email hello@replyisland.com from the address on your account (or tell us which business it's about). We may need to confirm it's you before acting. We'll respond within 30 days, and we won't treat you differently for making a request. Deleting your data while you're a customer may mean we can't provide the service.

California and other states: privacy laws like the California Consumer Privacy Act (CCPA) may not apply to a business our size, but we offer the rights above to everyone. We don't sell or “share” personal information as those laws define it, and we don't use sensitive personal information.

Reviewers: if you wrote a review of one of our customers, your review is public on Google and is controlled by you and Google, not us. We can delete our stored copy and drafts that mention you on request.

9. How we protect it

Consistent with New York's SHIELD Act, we use reasonable safeguards for the size of our business: encrypted (HTTPS) connections, a database that can only be read with a secret key kept on our server, limited access to the business owner, and payment card handling left entirely to Stripe. No system is perfectly secure. If a security breach affects your private information, we'll notify you and any required authorities as New York law requires.

10. Where data is processed

ReplyIsland is based in New York, and our providers process data mainly in the United States.

11. Children

ReplyIsland is a service for businesses and isn't meant for anyone under 18. We don't knowingly collect personal information from children under 13. If you think a child has given us information, email us and we'll delete it.

12. Changes to this policy

If we change this policy, we'll update the date at the top. If a change is significant, we'll also email active customers before it takes effect.

13. Contact

ReplyIsland
36-10 21st Avenue, Astoria, NY 11105
hello@replyisland.com

See also our Terms of Service and review policy.