Privacy Policy

Last updated: 2 October 2026

1. Who we are and what this policy covers

Review Reply PLUS is operated by Review Reply Plus Pty Ltd (ABN 45 702 111 500, ACN 702 111 500), of 916 High Street, Reservoir VIC 3073, Australia (we, us or our).

This Privacy Policy explains how we collect, hold, use and disclose personal information when you use:

• the Review Reply PLUS website at https://reviewreply.com.au;
• the Review Reply PLUS business service;
• Smart Review Trigger, including QR, NFC and check-in links; and
• the Smart Visits mobile app.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply. Privacy questions or complaints may be sent to support@reviewreply.com.au.

This policy covers:

• business customers and people who administer their accounts;
• people whose Google reviews are displayed to a connected business;
• customers whose contact details a business enters into its customer-email book;
• consumers who choose to use Smart Visits; and
• visitors to our website.

Our services are intended for people aged 18 or over.

2. Information we collect about business customers

When a business creates or uses an account, we may collect:

• account email address, display name and authentication information;
• business name, category, address, phone number, website and location information;
• Google Business Profile account and location identifiers;
• business tone, brand voice, reply preferences and notification settings;
• reviews, replies, alerts, removal requests, Review Rescue records and service usage;
• customer contact-book entries supplied by the business;
• Map Rank Tracker keywords, results and competitor information;
• subscription and billing identifiers; and
• support and service communications.

We use this information to provide and secure the service, authenticate users, connect businesses to Google, generate and publish replies, deliver alerts and invitations, provide insights and other selected features, administer subscriptions, enforce plan and trial limits, prevent misuse, provide support and comply with law.

3. Google Business Profile connection

A business may choose to connect its Google Business Profile. With the business's permission, we use Google's authorised interfaces to access its Google accounts and locations, read reviews and existing owner replies, and publish replies approved by the business or permitted by its Autopilot settings.

Google information received may include business account and location details and, for each review, the reviewer's public display name, star rating, review text, review date, Google review identifier and any existing owner reply. A profile image link may be received from Google but is not stored by us.

Google access credentials are stored in an access-restricted server-side record and are used only to provide the connected Google features.

When a business disconnects Google, removes a connected business or deletes its Review Reply PLUS account, we:

1. attempt to revoke Review Reply PLUS's Google authorisation through Google's revocation service;
2. always delete the Google access credentials and connection identifiers we hold; and
3. stop future synchronisation.

Disconnecting Review Reply PLUS does not delete or alter the business's Google Business Profile, Google reviews or replies already published to Google. If Google does not confirm revocation, we tell the business that our local access has been removed and direct it to remove Review Reply PLUS from Google Account permissions at https://myaccount.google.com/permissions.

4. Reviews and reviewer information

We use Google review information to display reviews to the connected business, prepare or publish replies, provide alerts and insights, support Review Rescue, and provide review-removal guidance. We do not use this information to contact reviewers directly, sell it or use it for advertising.

Review Reply PLUS provides review-removal guidance only. Google decides whether a review is removed.

5. Customer-email book and review invitations

A business may enter a customer's name, email address, phone number and notes into its customer-email book and may use those details to send review invitations or Review Rescue messages.

The business is responsible for ensuring that it has a lawful basis, any required consent, and any required unsubscribe process before giving us customer information or asking us to send a message. We use the information only to provide the requested service. It is deleted when the business deletes the record, business or account, subject to third-party records and legal retention described below.

Review Reply PLUS does not support review gating. Eligible customers receive the same neutral opportunity to leave a review. Businesses must not offer a benefit conditional on leaving a review, leaving a positive review, or giving a particular rating.

6. Artificial intelligence

We use artificial intelligence through the Lovable AI Gateway for the following workflows:

• Google Gemini: reply drafts, Autopilot replies and review-removal analysis.
• OpenAI: Review Rescue and fallback messages.

Depending on the workflow, information sent may include the reviewer's public display name, star rating, review text, business name, business type, configured brand voice or tone, relevant instructions, an existing draft or reply, and a removal outcome.

Customer email addresses and phone numbers are not sent in these AI workflows. Smart Visits data and payment data are not sent to these AI workflows. For OpenAI requests, the service requests that conversations not be stored.

AI output may be inaccurate, incomplete or unsuitable. Businesses should review generated content before publishing it and remain responsible for content published under settings they enable, including Autopilot.

The AI gateway and AI providers handle information under their own terms and privacy practices. We do not make unverified promises about their training, retention or exact processing locations.

7. Payments and subscriptions

Payments are processed by Stripe. Payment card details and payment credentials are entered with and handled by Stripe; we do not receive or store full card details.

We store the billing information needed to administer the subscription, including Stripe customer and subscription identifiers, product and price identifiers, subscription status, billing-period dates, cancellation status and whether the record relates to live or test billing. Stripe hosts invoices, receipts and payment-method management and retains information under its own policies and legal obligations.

8. One-trial-per-person protection

Each eligible person may receive one free trial. To prevent repeat trials, including through common email aliases, we normalise the sign-up email and create a keyed, non-reversible fingerprint. For example, normalisation may disregard capitalisation and Gmail dots or “+” aliases.

The raw or normalised email is not retained in the trial-prevention record. The fingerprint cannot be converted back into the email using the stored record. We keep the fingerprint and first-trial date after account deletion and automatically delete the record 24 months after the first trial.

9. QR codes, NFC and check-in links

A participating business may provide a QR code, NFC tag or check-in link that opens a review or check-in page. We may record the participating business, an anonymous browser or visit identifier, and the time the link was used so the business can understand the performance of its review requests. We do not collect precise location through those links.

Google Analytics does not load on sensitive Smart Visits, check-in or activation routes.

10. Smart Review Trigger and Smart Visits

Smart Visits is optional. It requires the consumer to install the app, turn Smart Visits on and grant the relevant device permissions.

The app uses the phone's geofencing service, including in the background, to detect arriving at, staying at and leaving a participating business (ENTER, DWELL and EXIT). It does not continuously track the phone. We do not retain GPS coordinates.

To find nearby participating businesses, the app sends approximate coordinates to our service. The coordinates are rounded to approximately one kilometre in memory, used once for the lookup, and not stored, logged or cached.

A Smart Visits device is registered anonymously. No name, email address or phone number is required. We hold an anonymous device profile, consent and preference state, saved participating-business areas, visit events and a Firebase notification token where notifications are enabled. A neutral reminder may be sent after a qualifying visit, subject to eligibility, user preferences and frequency protections.

The complete consumer notice appears in Part 3 of this document.

11. Smart Visits partner integrations

A partner, such as a participating membership club, may link its member to an anonymous Smart Visits device using a partner-issued member reference.

We provide the partner only with high-level link status. We do not provide the partner with location, coordinates, ENTER/DWELL/EXIT events, anonymous device identifiers, device secrets or Firebase notification tokens.

Partners can revoke or delete a member link through an authenticated request. Deletion removes the link, related activation records and webhook history. A security audit record containing only a hashed member reference may be kept for up to 24 months.

12. Analytics and cookies

Google Analytics 4 (GA4) may operate on ordinary Review Reply PLUS website and business pages. It may set Google's _ga cookies and collect standard website-usage information such as pages viewed, approximate location derived from an IP address, device and browser type, and referring site.

We do not send customer contact-book data, review content or custom customer events to GA4. Google Signals and advertising personalisation are disabled in the site's GA4 configuration. We do not use Google Ads or remarketing tags.

GA4 does not load on sensitive Smart Visits, check-in or activation routes, including /smart-visits and every page under it (such as /smart-visits/activate/*), and /v/*. Activation tokens, partner member references, anonymous device identifiers, coordinates and ENTER/DWELL/EXIT events are not sent to GA4 or another analytics service.

We also use essential browser storage required for authentication, security and operation of the service. See the Cookie & Analytics Notice in Part 4.

13. Notifications and service messages

We may send business customers email, in-app or browser messages about reviews, alerts, trials, billing, security and operation of the service.

Smart Visits reminders are sent through Firebase Cloud Messaging using a device notification token. Smart Visits users can disable Review Reminders in the app or change notification permission in device settings. Notification delivery may also depend on Google/Firebase and the device's operating system.

14. How long we keep information

Third-party providers, including Stripe and Google, keep their own records under their policies and legal obligations. Deleting information from Review Reply PLUS does not automatically delete information held independently by those providers.

15. Deleting information

Business customers can delete their Review Reply PLUS account at https://reviewreply.com.au/account-deletion or contact support@reviewreply.com.au. The Account Deletion wording in Part 5 explains the process and limited records that may remain.

Smart Visits users can use Privacy & Data → Delete my data → Delete in the app. Smart Visits turns off immediately and local Smart Visits data is cleared. If the service can be reached, server deletion occurs immediately. If the phone is offline or the service is unavailable, the app securely keeps only the minimal anonymous deletion credential needed to prove and complete the request. It retries automatically after reconnection, app restart and device restart. The app shows Pending or Completed status. After server deletion is confirmed, the remaining deletion credential is permanently removed from the phone.

Uninstalling Smart Visits stops the app from collecting new events, but does not itself request deletion of information already held by us. A user who wants server-side deletion should use Delete My Data before uninstalling or contact support.

16. Storage and overseas processing

Our main database is hosted on Amazon Web Services infrastructure in the Asia Pacific (Tokyo), Japan region. Requests may be processed transiently through Cloudflare's global edge network.

Service providers including Google Business Profile, Google Maps services, GA4, Firebase, Google Gemini, OpenAI, Stripe, email delivery services, and the Lovable platform and gateways may process information using global infrastructure outside Australia, potentially including the United States and other countries. Exact provider processing and backup locations have not all been independently verified.

We take reasonable steps to use reputable service providers and protect information, but overseas recipients may not be subject to the same privacy obligations as Australian organisations.

17. Security

We use measures including encryption in transit, encrypted database storage, server-side access controls, separation of business data, restricted credentials, non-reversible fingerprints where full identifiers are unnecessary, and authenticated partner requests. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

18. Access, correction and complaints

You may ask to access or correct personal information we hold about you, or make a privacy complaint, by emailing support@reviewreply.com.au. We aim to respond within 30 days.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at https://www.oaic.gov.au.

A reviewer who wants to change or remove a Google review should use Google's own tools because the review originates from Google.

19. Changes to this policy

We may update this policy when our services, practices or legal obligations change. We will change the fixed “Last updated” date when the document changes and notify business customers of material changes where appropriate.