Privacy Policy

Last updated: May 19, 2026

1. Information we collect

We collect information you provide when creating an account (name, email, business name), payment information processed securely by Stripe, and data from connected third-party services such as Google Business Profile. We also collect usage data such as reviews synced, campaigns sent, and feature interactions.

2. How we use your information

We use your data to provide and improve the RepFlow AI service, process payments, send transactional emails (review alerts, weekly digests, billing notifications), and generate AI-powered review responses using your brand voice configuration. We do not sell your data to third parties.

3. Customer phone numbers

Phone numbers uploaded for SMS campaigns are stored as one-way SHA-256 hashes in our referral system and in plaintext within campaign recipient records. They are used solely to send review request messages on your behalf. We honor all STOP opt-out requests immediately via Twilio.

4. Third-party services

RepFlow AI integrates with: Google (review data and OAuth), Stripe (payments), Twilio (SMS), OpenAI (AI reply generation), and Resend (email delivery). Each is governed by their own privacy policy. OpenAI does not use your data to train their models when accessed via API.

5. Data retention

We retain your data for as long as your account is active. On account deletion, we remove your personal data within 30 days. Anonymised aggregate analytics may be retained indefinitely. Notification records auto-expire after 90 days. Referral codes auto-expire after 30 days.

6. Security

Google OAuth tokens are encrypted at rest using AES-256-GCM. Passwords are hashed with bcrypt. All data is transmitted over HTTPS/TLS. We use rate limiting, CSRF protection, and input validation throughout our API.

7. Your rights

You may request access, correction, or deletion of your personal data at any time by emailing hello@repflowai.co. EU/UK residents have additional rights under GDPR/UK GDPR. We will respond within 30 days.

8. Cookies

We use strictly necessary cookies for authentication (httpOnly refresh token cookie) and optional analytics cookies (Google Analytics). You can opt out of analytics cookies via the cookie banner on your first visit.

9. Contact

RepFlow AI · hello@repflowai.co · repflowai.co