ReplyTally Privacy Policy

Eightfold Consulting Ltd. ("we" or "us") provides ReplyTally (the "Service"). This policy explains how we collect, use, disclose, and protect personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and its 10 fair information principles. It applies to our website and the Service. Our customers are businesses. Where a customer's reviews contain information about their own customers (reviewers), we process it on our customer's behalf and only to provide the Service.

1. Accountability

Eightfold Consulting Ltd. is responsible for personal information under its control, including information we transfer to service providers for processing. Our Privacy Officer is Nick McGahey, President, who can be reached at eightfoldconsult@gmail.com or 32 Simcoe St, Lindsay, ON K9V 2G4.

2. Information We Collect

• Account information: your name, business name, email, phone number, and login details.
• Billing information: this is handled by Stripe. We receive limited details such as the card brand, the last four digits, and your billing address, but never your full card number.
• Google user data (with your authorization through Google OAuth, scope business.manage): your Business Profile account and location details, the reviews on your locations (including reviewer display names, ratings, and review text), and existing replies.
• Content we generate: draft and posted replies, your approvals and edits, and your settings, such as auto-post preferences.
• Usage and technical data: IP address, browser, log data, and cookies needed to run and secure the Service.
• Communications: emails and support requests you send us.

3. How We Use Information

We collect only what we need for the purposes below, and we identify these purposes before or when we collect the information.

We use information to provide the Service: drafting replies, emailing drafts for approval, and posting replies as you direct or under your auto-post setting. We also use it to bill you, send service and account messages, provide support, keep the Service secure, prevent abuse, and meet our legal obligations. Emails: service emails, such as reply approvals, trial-ending reminders, receipts, security notices and changes to these terms, are part of the Service and are sent while your account is active. We send marketing emails (for example, product news or offers) only with your consent, as Canada's Anti-Spam Legislation (CASL) requires. Every marketing email identifies us and includes a working unsubscribe link, which we honour within 10 business days.

We do not sell personal information, and we do not use it for purposes other than those listed here without first getting your consent, unless the law requires or permits it.

4. Google User Data and Limited Use

ReplyTally's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We also follow the Google Business Profile API policies. Specifically:

• We use Google user data only to provide and improve the user-facing features of drafting and posting review replies that you can see in the app.
• We transfer Google user data to others only: (a) to provide or improve those user-facing features, with your consent (for example, sending review text to our AI subprocessor to create a draft); (b) for security purposes, such as investigating abuse; (c) to comply with applicable law; or (d) as part of a merger, acquisition or sale of assets, and only after getting your explicit prior consent.
• We store Google review content encrypted, for no more than 30 days (see Section 7).
• We do not sell or transfer Google user data to advertising platforms, data brokers or information resellers. We do not use it to serve ads (including retargeting or interest-based ads), to determine creditworthiness or for lending, or to build user profiles for unrelated purposes.
• We do not use Google user data to develop, improve, or train generalized AI or machine-learning models. Our AI providers are contractually prohibited from using it for model training.
• Humans do not read Google user data unless you first give affirmative agreement for specific data (for example, when you ask us for support), it is needed for security purposes (such as investigating a bug or abuse), it is needed to comply with law, or it has been aggregated and used for internal operations as permitted by law.
• Our employees, contractors and service providers must follow these same rules.

5. AI Processing and Service Providers (Subprocessors)

We use service providers that process data on our behalf under contracts that require confidentiality and security:

Some providers store or process information outside Canada, including in the United States. While it is there, it is subject to the laws of that country and may be accessible to its courts, law enforcement and national security authorities. We use contracts and other measures to make sure these providers protect your information to a standard comparable to ours. You can ask our Privacy Officer for more information about our service providers.

6. Consent

By connecting your Google Business Profile and using the Service, you consent to the processing described here. Turning on auto-post is your express consent for us to post 4-5 star replies on your behalf. You may withdraw consent at any time, subject to legal or contractual limits and reasonable notice, by disconnecting, changing your settings, or closing your account. We will tell you what happens if you do; for example, we can't draft replies without access to your reviews.

Reviews are already public on Google. We process reviewer information only to draft replies, and we ask you not to include reviewers' personal or health information in replies.

7. Retention and Deletion

• Review content from Google (review text, reviewer display names, ratings and reply drafts) is stored encrypted and only temporarily, to show you drafts and recent history. It is kept for no more than 30 days and then deleted automatically, as the Google Business Profile API policies require. We do not aggregate or manipulate this content, and we do not use it for any purpose outside the Service.
• OAuth tokens are stored encrypted. They are revoked and deleted immediately when you disconnect.
• When you disconnect Google (in the app or at https://myaccount.google.com/permissions), we revoke and delete your tokens immediately and delete all stored Google user data within 48 hours.
• When you close your account, we delete your account data within 30 days, except billing and tax records we must keep by law (7 years under CRA requirements). Those records contain no Google review content.
• Backups containing any of this data are overwritten within 30 days.
• You can ask us to delete your data at any time by emailing eightfoldconsult@gmail.com.

8. Safeguards

We protect information with measures that fit its sensitivity, including encryption in transit and at rest, encrypted storage of OAuth tokens, access controls, and least-privilege access.

9. Your Rights

You can ask to access or correct your personal information, withdraw consent, or ask for deletion by contacting eightfoldconsult@gmail.com. We may need to verify your identity first. We will respond within 30 days, at no cost, and explain our reasons if we can't fully meet your request. We try to keep your information accurate, complete and up to date for the purposes it's used for, and you can update your account details at any time. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).

10. Cookies

The Service uses only essential cookies, for login and security. We do not use advertising cookies, and we don't currently use third-party analytics in the Service. If we add analytics, we'll update this policy first. Our marketing website (hosted by Netlify in the United States) does not use cookies, analytics or trackers. You can control cookies in your browser.

11. Breaches

If a breach of security safeguards involving personal information under our control creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify the people affected (and, where it helps reduce harm, other organizations) as soon as feasible, as PIPEDA requires. We keep a record of every breach of security safeguards for at least 24 months. If a breach affects a customer's reviewer data, we will also tell the customer promptly.

12. Children

The Service is for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 18.

13. Changes

We will post updates here and update the "Last updated" date. We will email you about material changes before they take effect. If we want to use Google user data in a new way, we will ask for your consent first.

Contact

Eightfold Consulting Ltd., Attn: Privacy Officer, 32 Simcoe St, Lindsay, ON K9V 2G4, eightfoldconsult@gmail.com