Privacy Policy

Last updated: October 11, 2026

This Privacy Policy explains how ReplyChamp collects, uses, shares, and protects personal information. It applies to anyone who visits replychamp.com or uses the ReplyChamp service.

ReplyChamp is an AI-assisted tool that helps small business owners respond to their Google reviews. We built it to respect your data: we do not sell your information, we do not permit any third party to train AI models on your content, and we delete your data when you close your account.

1. Who we are (data controller)

ReplyChamp is a product of JFI Consulting Corp., a corporation incorporated under the British Columbia Business Corporations Act and doing business as "ReplyChamp."

JFI Consulting Corp. is based in Maple Ridge, British Columbia, Canada. Our full registered office address is on public record with BC Registry Services and is available on request for legal correspondence by emailing hello@replychamp.com.

For the purposes of GDPR, PIPEDA, BC PIPA, and similar laws, JFI Consulting Corp. is the data controller responsible for the personal information processed through ReplyChamp.

For the purposes of Quebec's Law 25, the privacy officer responsible for ReplyChamp's compliance with applicable privacy laws is the Director of JFI Consulting Corp., reachable at hello@replychamp.com. This email address also serves as the designated contact for data subject requests under GDPR, PIPEDA, BC PIPA, and similar laws.

ReplyChamp uses automated decision-making as a normal part of its service (for example, classifying reviews and generating reply drafts with AI). Where applicable law requires it, you have the right to request human review of decisions that significantly affect you. To do so, contact hello@replychamp.com.

2. Information we collect

Information you provide directly

• Account information — your name and email address, which we receive from Google Sign-In when you create your account. Google Sign-In is the only way to log in to ReplyChamp, so we never create, request, or store a password for you.
• Business information — the name, category, and basic details of the business you manage, as you provide them during onboarding.
• Voice profile data — your preferred reply tone, example replies you supply to train your voice, and any "never say" phrases you configure.
• Payment information — when you subscribe, you enter your card and billing details directly with Stripe, our payment processor. We never see or store your card number. We keep only Stripe’s references to your customer record and subscription, your plan (monthly or yearly), the number of locations billed, and whether your subscription is active.
• Support communications — messages you send us via email or support channels.

Information received from Google Business Profile

When you connect your Google Business Profile via OAuth, Google provides us with:

• An OAuth access token and refresh token that allow us to read the reviews of the business you have authorized and post replies you approve.
• The information on your Business Profile (business name, category, address and map location, hours, website and photos), your recent Google posts, and the performance statistics Google provides for your profile (such as views, searches, calls and direction requests).
• The content of reviews posted about your business, including reviewer display name, rating, review text, and timestamps.
• Replies previously posted on your Business Profile, for reference and, if you choose “Import my voice”, to learn how you write.

Information about nearby businesses

Competitor insights and the Google Profile page compare your business with similar businesses near it. To do this we search Google Maps Platform (the Places API) using your business’s category and location, and receive public information Google publishes about those businesses: name, rating, number of reviews, distance, opening hours, website, whether they have photos, and Google’s summary of their reviews. We don’t store other businesses’ individual reviews or use them in our analysis. If you open “What customers say” under a nearby business, we show up to five of its reviews live from Google, credited to their authors, and don’t save them. This information is about businesses, not about you or your customers, and we use it only to show you comparisons and suggestions.

Information collected automatically

• Usage data — which pages you view, which features you use, and how often. On our public website (not inside the app), the pages you view and the buttons you use, such as opening the demo, opening a question or starting a trial, are recorded against a random visit identifier kept in your browser’s local storage for up to 30 days. We use these records only to measure and improve the website, keep them for up to 90 days, and use no cookies and no third parties for them. They never include review text or anything from your Google account. If you sign up, the visit identifier is saved with your sign-up so we can count which visits led to one.
• Device and log data — IP address, browser type, operating system, referrer URL, and timestamps.
• How you found us — the campaign tags on the link you first arrived by (for example, which of our ads, ad group and search keyword it was), the referring site and the first page you visited. If you click one of our Google ads (on your first visit or a later one within 30 days), this also includes the ad click identifier Google adds to the link (called a GCLID, GBRAID or WBRAID); we keep only the most recent one. If you sign up, we save these with your account. See Sections 5, 6 and 8.
• Cookies and similar technologies — see Section 8 below.

Free reply generator

Anyone can use our free Google review reply generator without an account. When you use it, the review text, star rating, tone and any optional business details you enter are sent to our AI provider (Anthropic) to write the reply, and the reply is shown back to you. We do not save the review or the reply, and we do not log their contents. To prevent abuse, the page uses Cloudflare Turnstile to check that you are not an automated program, and we count requests per visitor to enforce usage limits. For these limits we keep only a one-way scrambled code derived from your IP address (a keyed hash), never the IP address itself; each count expires after at most a day and is then deleted. Please don’t paste personal details such as phone numbers or email addresses into the tool.

3. How we use your information

We use your information to:

• Provide the ReplyChamp service — checking for new reviews about every 30 minutes, drafting replies in your trained voice, posting replies you approve or that meet the rules you have configured, and producing insights such as common themes in your reviews and comparisons with nearby businesses.
• Improve the quality of replies we generate for your account (your voice profile adapts based on edits you make). We do not use your content to improve service quality for other customers.
• Process billing, subscription management, and receipts.
• Send service communications, such as payment receipts (sent by Stripe) and important notices about your account. Email alerts about new reviews are coming soon; when they launch, you will be able to turn each kind off in Settings or from any alert.
• Respond to your support requests.
• Measure which of our own marketing channels and ads lead to sign-ups and paid subscriptions.
• Maintain, secure, and improve the reliability and performance of the service.
• Comply with legal obligations and enforce our Terms of Service.

4. Legal bases for processing (EEA/UK users)

If you are in the European Economic Area or United Kingdom, we process your personal information under the following legal bases:

• Contract — to deliver the ReplyChamp service you have subscribed to.
• Legitimate interests — to secure our service, prevent abuse, and improve reliability (balanced against your rights).
• Consent — where required, e.g. for certain cookies or marketing communications.
• Legal obligation — to comply with tax, accounting, or other applicable laws.

5. How we share your information

We share your information only with the third-party service providers ("subprocessors") that make ReplyChamp work. These providers are bound by contract to use your data only to provide services to us, not for their own purposes.

Subprocessor	Purpose	Data shared
Cloudflare (USA)	Web application hosting, DNS, email routing, edge caching, and bot protection (Turnstile) on the free reply generator	Usage and log data, data in transit, incoming email to hello@replychamp.com, and browser signals Turnstile uses to tell people from bots
Supabase (USA)	Database and authentication hosting	Stored account, business, review, and reply data
Anthropic (USA)	AI reply drafts, review theme analysis, voice import, Competitor insights suggestions, and the free reply generator	Review text, your voice profile and past replies, your business details, and public information about nearby businesses. We do not authorize Anthropic to train models on your data.
Stripe (USA)	Payment processing, receipts and invoices	Email, name, billing address and payment card details (entered directly with Stripe), plan and number of locations
Google (USA)	Sign-in; reading your reviews, profile details and performance statistics, and posting replies you authorize, via the Google Business Profile APIs; finding nearby businesses via Google Maps Platform (Places API)	OAuth tokens and API requests and responses; your business’s category and location for nearby searches

From time to time we may change subprocessors. We will update this list and, where required by law, notify you in advance.

Google Ads (measuring our own ads). If you arrived by clicking one of our Google ads and then sign up, we upload to our Google Ads account a list of conversions: the ad click identifier, what happened (you started a trial, or started a paid subscription), when it happened, and the subscription value. The upload contains no names, email addresses, or anything we receive through Google Sign-In or your Google Business Profile. We use it only to see which of our ads lead to sign-ups and to manage our ad spending; Google handles it under its own terms as an advertising platform. We do not use the Google Ads tag, advertising pixels, remarketing lists, or "enhanced conversions", and we never send your email address to Google Ads.

We may also disclose your information if required by law, legal process, or lawful government request, or to protect the rights, property, or safety of ReplyChamp, our users, or the public.

We do not sell your personal information. We do not share your information for cross-context behavioural advertising: the Google Ads upload described above only tells Google which of its ad clicks led to a sign-up, and is not used to target ads to you. We do not disclose your information to third parties except as described in this policy.

6. Data retention

• Account data — retained while your account is active.
• Reviews, replies and insights — retained while your account is open so you can reference them, including while it is read-only after a trial. Deleted when you close your account; copies in our database backups expire within 30 days.
• Free-trial records — so that each business gets one free trial, we keep a record of the Google location IDs that have had a trial, even after an account is closed. It contains no names, email addresses or review content.
• OAuth tokens — revoked and deleted promptly (typically within 24 hours) upon account closure, disconnection of your Google Business Profile, or at your request.
• Billing records — retained for 7 years where required by Canadian tax law and corporate-records legislation, even after account closure.
• Ad click identifiers — deleted 90 days after you sign up (Google Ads does not accept them after that), or sooner if you close your account. The campaign tags, referring site and landing page saved with your account are kept while your account is open.
• Website visit records — the pages viewed and buttons used on our public website (see Section 2) are deleted after 90 days, and so is the visit identifier saved with a sign-up.
• Pseudonymized usage logs — retained up to 24 months for security and service-integrity purposes.
• Support communications — retained up to 24 months after resolution.

7. Security

We implement reasonable technical and organizational measures to protect your information, including:

• Encryption in transit (TLS 1.2+) for all data exchanged between your browser, our servers, and third-party services.
• Encryption at rest for sensitive data including OAuth tokens.
• Access controls so that only authorized systems and personnel can access your data.
• Regular security updates to software dependencies.

No system is perfectly secure, and we cannot guarantee the absolute security of your information. In the event of a data breach that affects your personal information, we will notify you and the relevant regulators as required by applicable law, including PIPEDA, BC PIPA, Quebec's Law 25 (which requires prompt notification to the Commission d'accès à l'information), and the GDPR.

8. Cookies and similar technologies

We use a small number of cookies and similar technologies:

• Essential cookies — required for authentication, security, and core functionality, including your sign-in session and short-lived cookies that protect the step where you connect Google.
• Analytics — we measure basic site usage (such as aggregate page views) with Cloudflare’s privacy-focused web analytics, which does not use cookies and does not track you across sites. To learn which channels bring new customers, our website keeps the campaign tags, referring site and landing page of your first visit, and the identifier of your most recent click on one of our Google ads, in your browser’s local storage for up to 30 days from that first visit, together with the random visit identifier described in Section 2. The campaign tags and referring site are also sent with the website visit records described in Section 2; the ad click identifier is not (those records only note whether there was one). Everything is sent to us if you click to sign in or start a trial, and is carried through Google Sign-In in a first-party cookie that lasts at most one hour. If you sign up, we save them with your account. We use this only to count sign-ups by channel and to report sign-ups from our own ads to Google Ads as described in Section 5. You can prevent it by clearing or blocking site data for replychamp.com, and you can ask us to delete the ad click identifier saved with your account.

We do not use advertising or tracking cookies, and we do not place Google Ads or any other advertising tags or pixels on our website.

9. Email communications (CASL compliance)

Canada's Anti-Spam Legislation (CASL) requires your express or implied consent before we send you commercial electronic messages. When you create a ReplyChamp account and subscribe, you are providing express consent to receive service-related and commercial emails from us in connection with your account.

Every commercial email we send will:

• Identify ReplyChamp as the sender;
• Provide a valid mailing or physical contact address;
• Include a working unsubscribe mechanism that remains functional for at least 60 days; and
• Honour unsubscribe requests within 10 business days at no cost to you.

Transactional emails (receipts, account alerts, security notices, and messages you have requested) will continue to be sent regardless of marketing preferences, as permitted under CASL.

10. Your rights and choices

Regardless of where you live, you can:

• Access and export the data we hold about you at any time with “Download my data” in Settings, or by emailing hello@replychamp.com.
• Correct inaccurate information through your account settings or by contacting us.
• Delete your account and associated data at any time from your account settings. We will delete your data within 30 days of account closure, except where we are legally required to retain certain records (e.g. tax records).
• Disconnect your Google Business Profile at any time from account settings; this revokes our access tokens and stops further access to your review data.
• Opt out of non-essential emails using the unsubscribe link in any email we send.

If you are in Canada, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, including the British Columbia Personal Information Protection Act (BC PIPA) and, for Quebec residents, the Act respecting the protection of personal information in the private sector (as amended by "Law 25" / Bill 64). If you are in the European Economic Area or United Kingdom, you have rights under the GDPR/UK GDPR, including rights to access, rectification, erasure, restriction of processing, data portability, and objection, as well as the right to lodge a complaint with your national supervisory authority. If you are a California resident, you have rights under the CCPA/CPRA, including the right to know, delete, and opt out of "sales" or "sharing" of personal information (though we do neither). To exercise any of these rights, contact hello@replychamp.com. We will respond within the timeframes required by applicable law.

11. Children

ReplyChamp is a business tool intended for adults aged 18 and older managing legitimate business profiles. We do not knowingly collect information from anyone under 18. If you believe a person under 18 has provided us with information, contact us and we will delete it.

12. International transfers

Your information may be processed in Canada, the United States, and other countries where our service providers operate. For transfers of personal data from the EEA or UK, we rely on standard contractual clauses (SCCs) and/or other lawful transfer mechanisms to ensure your data remains protected. You can request a copy of the safeguards in place by emailing us.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email and/or through the service before the changes take effect. Non-material changes take effect when posted. The "Last updated" date at the top of this page reflects the most recent version.

14. Contact us

Questions, concerns, or requests about this policy or your personal information?

Email: hello@replychamp.com

You also have the right to lodge a complaint with a data protection authority in your jurisdiction (for example, the Office of the Privacy Commissioner of Canada, or your national supervisory authority in the EEA/UK).