Privacy Policy

1. Introduction

Welcome to ReputeGrow ("we," "our," or "us"). We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, disclose, and safeguard your information when you use our review management platform.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, password, business name
• Business Information: Business locations, Google Business Profile data, Facebook Pages data
• Payment Information: Processed securely through Stripe (we don't store credit card details)
• Communications: Messages you send to our support team

2.2 Information Automatically Collected

• Usage Data: Pages visited, features used, time spent on platform
• Device Information: IP address, browser type, operating system
• Cookies: We use cookies to maintain your session and improve user experience

2.3 Information from Third Parties

• Google Business Profile: Reviews, ratings, business information
• Facebook Pages: Reviews, ratings, page information
• OAuth Providers: Basic profile information when you sign in with Google or Facebook

3. How We Use Your Information

• Provide, maintain, and improve our services
• Process your subscription and payments
• Send you service-related communications
• Respond to your customer support requests
• Analyze usage patterns to improve our platform
• Detect and prevent fraud or security issues
• Comply with legal obligations

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your data with:

• Service Providers: Stripe (payments), Supabase (hosting), Google/Facebook (authentication)
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In case of merger, acquisition, or sale of assets

5. Third-Party Platform Integrations (OAuth)

When you connect your Google Business Profile or Facebook Page to ReputeGrow, we request specific permissions to provide our services. Here's exactly what we access and how we use it:

5.1 Google Business Profile

We request the following Google OAuth scope:

• business.manage: Read your business reviews and post responses on your behalf

This allows us to sync your Google reviews to your dashboard and submit AI-generated or custom responses directly to Google.

5.2 Facebook Pages

We request the following Facebook permissions:

• pages_show_list: List the Facebook Pages you manage
• pages_read_engagement: Read reviews and ratings on your Pages
• pages_manage_engagement: Post responses to reviews on your behalf
• pages_read_user_content: Read user-generated content on your Pages

5.3 OAuth Token Security

• Encryption: All OAuth access tokens are encrypted using AES-256-GCM before storage
• Minimal Access: We only request permissions necessary to provide review management services
• No Sharing: Your OAuth tokens are never shared with third parties
• Revocation: You can disconnect platforms anytime from your account settings, or revoke access directly from Google/Facebook
• Refresh Tokens: We securely store refresh tokens to maintain your connection without requiring frequent re-authentication

6. Data Security

We implement industry-standard security measures:

• AES-256 encryption for sensitive data
• SSL/TLS encryption for data in transit
• Regular security audits and updates
• Secure authentication with password hashing
• Rate limiting to prevent brute force attacks

7. Your Rights

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and data
• Portability: Export your data in a standard format
• Objection: Object to processing of your data
• Withdraw Consent: Withdraw consent at any time

8. Data Retention

We retain your personal data for as long as necessary to provide our services and comply with legal obligations. When you delete your account, we will delete or anonymize your data within 30 days, except where we're required to retain it by law.

9. Cookies

We use cookies for:

• Authentication and session management
• Remembering your preferences
• Analytics and performance monitoring

You can control cookies through your browser settings. Note that disabling cookies may affect platform functionality.

10. Children's Privacy

Our service is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

11. International Data Transfers

Your data may be processed in countries outside your jurisdiction. We ensure appropriate safeguards are in place to protect your data in accordance with this privacy policy.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by email or through a notice on our platform. Your continued use of the service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this privacy policy or want to exercise your rights, please contact us: