Privacy policy

What we collect and why

• E-mail address and name from your Google account — to create your account and tell your data apart from everyone else's.
• Google Business Profile access tokens — so we can read your reviews and publish the replies you approve. Tokens are encrypted (AES-256-GCM) before they are stored. We never see your Google password.
• Your business locations (name, address, Google id) — to know which profile to show.
• Reviews and your replies — fetched from Google when you open the dashboard. Reviews are cached for at most 24 hours, as Google's terms require, and are not stored longer.
• Telegram chat id — only if you connect Telegram, to send you notifications about new reviews.
• Settings: reply language, tone, length and your custom rules.
• Appeal records — which reviews you reported to Google and their status, so the Appeals tab works.
• Technical data: your IP address for rate limiting and abuse protection (kept up to 24 hours in counters), server logs for up to 30 days.
• On the public demo (home page) we only process the business you look up and the e-mail you may leave on the waitlist; the waitlist e-mail is forwarded to our Telegram and kept in our waitlist until we launch or you ask us to remove it.

How we use AI

Review texts are sent to Anthropic's Claude API to find themes and draft replies. Anthropic processes them under its commercial terms and does not use API data to train models. No e-mail addresses, tokens or chat ids are sent to the model.

Where the data lives

On our own application servers and database (Postgres and Redis). We are moving to a dedicated server at Hetzner in the European Union; until then the service runs on Vercel and Upstash. Google and Anthropic process data on their own infrastructure under their terms.

How long we keep it

• Account, settings, locations, appeal records, Telegram chat id: while your account exists.
• Google tokens: until you disconnect the profile or delete the account; the grant is revoked at Google at the same time.
• Reviews: cached up to 24 hours. AI-generated replies and themes: cached up to 24 hours.
• Demo sessions (no Google account): 30 days.
• Waitlist e-mails: until launch or until you ask us to remove them.
• Rate-limit counters: 24 hours. Server logs: 30 days.

Deleting your data

Open the dashboard → Settings → “Delete my account and data”. Everything above is erased immediately and the Google grant is revoked. You can also remove the app's access in your Google account at myaccount.google.com/permissions, or write to vova.symonchuk@gmail.com and we will delete your data within 30 days.

Your rights (GDPR)

• Access: ask for a copy of the data we hold about you.
• Rectification: correct inaccurate data (your Google account data is managed by Google).
• Erasure: delete your account yourself or ask us.
• Restriction and objection: ask us to stop processing.
• Portability: receive your settings and appeal records in a machine-readable format.
• Complaint: you may lodge a complaint with your local data protection authority (in Portugal the CNPD).
• Legal basis: performance of the service you asked for (Art. 6(1)(b) GDPR) and our legitimate interest in keeping the service secure (Art. 6(1)(f)).

Google API Services

Vozmesa's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only use Business Profile data to show your reviews and publish the replies you approve; we do not sell it or use it for advertising.

Contact

Questions and data requests: vova.symonchuk@gmail.com.