Privacy Policy

Last updated: 2 October 2026

This policy explains what data GladReply collects, why, who it is shared with and how you can control it. It covers the website at https://gladreply.com and the application at https://app.gladreply.com (together, the “Service”).

1. Who we are

The Service is operated by Aura Deco Candles, S.L. (tax ID B19394022), with registered office at Paseo de la Zona Franca 145, Esc A, 6-1, 08038 Barcelona, Spain. We are the data controller for the personal data described in this policy. For any privacy question or request, write to privacy@gladreply.com.

2. Data we collect

• Account data: your name, email address and the business you register, plus the settings you choose (for example your reply voice and auto-publish preferences).
• Google user data: the Google Business Profile data described in section 3, which we receive only after you connect your Google account.
• Content you create in the Service: drafted replies, your edits, approvals and rejections.
• Billing data: your plan, invoices and billing details. Card payments are handled by our payment provider; we do not store full card numbers.
• Technical data: log data such as IP address, browser type and the times of requests, which we use to keep the Service secure and working.
• Support messages: what you send us when you contact us.

3. Google user data: what we access

When you connect a Google account, Google asks you to grant GladReply the scope https://www.googleapis.com/auth/business.manage (“business.manage”). With that permission, and only for the Google account you connect, we access:

• Business Profile accounts and locations: the accounts you can manage and their locations, including identifiers, business name, address and similar profile information, so you can choose which locations GladReply works with.
• Reviews: the reviews left on those locations, including the review text, star rating, date and the reviewer’s public display name and profile photo as provided by Google.
• Replies: the owner replies that already exist on those reviews, and the ability to create, update or delete a reply on your behalf.

We never receive your Google password. We do not access Gmail, Drive, Calendar, contacts or any other Google product.

4. How we use Google user data

We use the Google user data listed above only to provide the features you see in the Service:

• to show your locations, reviews and existing replies in your GladReply account;
• to draft a reply to each review, in the voice you have configured;
• to publish replies to Google at your direction: either when you approve a draft, or automatically under the auto-publish rules you have enabled (replies to five-star reviews that pass our published guards);
• to adapt future drafts for your account based on your own edits, approvals and rejections.

We do not:

• sell Google user data or transfer it to data brokers or advertising platforms;
• use Google user data for advertising, including personalised or interest-based advertising;
• use Google user data to develop, improve or train generalised artificial-intelligence or machine-learning models;
• allow people to read Google user data, except with your consent (for example when you ask us for support), when necessary for security purposes or to comply with applicable law, or when the data has been aggregated and anonymised for internal operations.

5. Google API Services: Limited Use

GladReply’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. How we use other data, and legal bases

• To provide the Service (account, drafting, publishing, billing, support): performance of our contract with you.
• To keep the Service secure and reliable (logs, abuse prevention, troubleshooting): our legitimate interest in running a safe service.
• To send service messages (for example, reviews waiting for approval or billing notices): performance of our contract with you.
• To comply with the law (tax and accounting records): legal obligation.

Reviews contain personal data of the people who wrote them (their public display name and what they chose to publish on Google). You connect that data to GladReply as the business they reviewed, and we process it on your behalf, solely to help you read and answer those reviews.

7. Who we share data with

We share data only with service providers (sub-processors) that help us run the Service, under contracts that limit them to acting on our instructions:

• Hosting provider: runs the application and this website.
• Database provider: stores account data, connected locations, reviews, drafts and encrypted access tokens.
• AI model provider: generates the draft replies. To draft a reply we send the review text, its rating and language, the name of your business and your voice settings to the provider. The provider processes this data to return the draft and is not permitted to use it to train its models.
• Payment provider: processes subscription payments and invoices.
• Email provider: delivers service emails.

Replies you approve or auto-publish are sent to Google and become public on your Business Profile. We may also disclose data if the law requires it, or as part of a merger or sale of the business, in which case this policy continues to apply to your data. The current list of sub-processors is available on request at privacy@gladreply.com.

8. International transfers

Some of our providers may process data outside the European Economic Area. When they do, we rely on an adequacy decision of the European Commission or on Standard Contractual Clauses, together with additional safeguards where needed.

9. Storage and security

• The OAuth access and refresh tokens we receive from Google are stored encrypted.
• All traffic between your browser, the Service and Google is encrypted in transit (HTTPS/TLS).
• Access to production systems is restricted to the people who need it to operate the Service.
• We never ask for, receive or store your Google password.

No system is perfectly secure. If we become aware of a breach that affects your data, we will notify you and the competent authority as the law requires.

10. Retention and deletion

• While your account is active, we keep your account data, connected locations, reviews, drafts and reply history so the Service can work.
• When you disconnect a Google account, we delete its stored OAuth tokens and stop accessing Google on your behalf.
• When you delete your GladReply account, or ask us to delete your data, we delete your account data and the Google user data associated with it within 30 days, except for records we must keep by law (such as invoices).
• Technical logs are kept for a limited period and then deleted or anonymised.

To request deletion, use the account settings in the app or write to privacy@gladreply.com from the email address of your account. Replies already published on Google stay on your Business Profile until you delete them there.

11. How to revoke access

You can remove GladReply’s access to your Google data at any time, in any of these ways:

• disconnect the Google account from the settings of the GladReply app;
• remove GladReply from the third-party access page of your Google account at myaccount.google.com/permissions;
• write to privacy@gladreply.com and we will do it for you.

Once access is revoked, GladReply can no longer read your reviews or publish replies.

12. Your rights

Under the General Data Protection Regulation (GDPR) you have the right to access, rectify and erase your personal data, to restrict or object to its processing, and to data portability. To exercise any of these rights, write to privacy@gladreply.com. You also have the right to lodge a complaint with your data protection authority; in Spain, that is the Agencia Española de Protección de Datos (aepd.es).

If you are a reviewer and want to exercise your rights over a review you wrote, you can edit or delete it in Google, or contact us and we will pass your request on to the business concerned.

13. Cookies

This website does not use advertising cookies. The application uses the cookies that are strictly necessary to keep you signed in and to protect your session.

14. Children

The Service is intended for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children.

15. Changes to this policy

We may update this policy as the Service evolves. If a change is significant, in particular any change to how we use Google user data, we will tell you by email or in the app before it takes effect and, where required, ask for your consent. The date at the top shows when the policy was last revised.

16. Contact