Privacy Policy

Reply Hearth is operated by BioRust Studios, LLC (“we”, “us”). It reads the reviews your business receives, drafts owner replies in your business’s voice and, only when you choose, posts them for you.

This policy covers two kinds of information:

• Your account information (your email, settings and billing details). We decide how it is used.
• Review and reply content from the listings and apps you connect. We handle it only on your business’s behalf and only to provide the service to you.

Reply Hearth is an independent service. It is not affiliated with, sponsored or endorsed by Google or Apple.

Account information

• Your email address and the date you created your account.
• Your password, which is handled by our authentication provider. We never see or store it in readable form.

Settings you enter

• The names of the locations and apps you connect, your voice instructions, and the facts and policies you give us for replies.
• Your reply settings, including which star ratings may post automatically.
• Consent records: who changed an automatic-reply setting, when, the exact settings, and the IP address and browser used.

Content from the platforms you connect

• Review text, star rating, the reviewer’s public display name and profile photo link, and review dates.
• Any existing owner reply and its status.

Content we create with you

• Draft replies, the replies you approve or edit, and the replies we post.
• An audit log of actions in your workspace, such as “draft approved” or “reply posted automatically”.

Technical information

Server logs with request times and error details, used to keep the service running and secure. Our logs never contain review text, access tokens or keys.

When you connect a Google Business Profile, you sign in with Google and grant Reply Hearth access with one permission (OAuth scope): business.manage. Google offers no read-only alternative for reviews, so this permission covers both reading and replying. We request no other Google permissions. We never ask for access to Gmail, Drive, Contacts or Calendar.

What we read

• The business accounts and locations you choose to connect.
• Reviews of those locations and any existing owner replies.

What we write

• Owner replies to reviews: posting, updating or deleting a reply that you approved, or that your recorded automatic-reply settings allow.

We don’t change your business information, photos, posts or any other part of your profile.

How we limit our use

Reply Hearth’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the features you see in Reply Hearth.
• We never sell it, and never use it for advertising.
• We never use it to train or fine-tune AI models, ours or anyone else’s.
• We never combine one customer’s reviews with another’s, for benchmarks or for any other purpose.
• People at BioRust Studios, LLC don’t read it, except with your permission (for example, when you ask for support), for security investigations, or where the law requires.

Your Google access token

The token Google gives us is encrypted with a managed key service (Cloud KMS) and stays on our servers. It is never sent to your browser or shown to anyone. You can revoke our access at any time by disconnecting in Reply Hearth, or from your Google Account’s third-party access page.

Google Play

You invite our service account in Play Console and give it only the “Reply to reviews” permission, ideally for selected apps only. We use it to read reviews and post replies for the apps you add to Reply Hearth, and for nothing else. We never ask for financial, release or publishing permissions. You can remove our access in Play Console under Users and permissions.

Google Play only shares the last 7 days of reviews through that permission. To bring in older reviews you can upload the review report files you download from Play Console, which needs no extra access. If you choose the automatic import instead, you also give our service account the read-only “View app information and download bulk reports” account permission. Google grants that for your whole developer account; we read only the review reports of the apps you add, never financial data, and never the other reports. Imported reviews follow the same 30-day rule as synced ones.

App Store

You give us an App Store Connect API key (the issuer ID, key ID and private key file). We check it, then encrypt the private key with Cloud KMS. It is never shown again, returned to any browser or written to logs. We use it only to read customer reviews and post responses for the apps you add. When you disconnect, we destroy our copy. Apple doesn’t let us revoke the key for you, so we’ll remind you to revoke it in App Store Connect.

• To show your reviews and draft replies in your business’s voice.
• To run safety checks on every draft and hold reviews that need a person to read them, with the reason shown.
• To post the replies you approve, or that your automatic-reply settings allow.
• To keep the consent records and audit log that show who approved what, and when.
• To send account and security emails, such as verification and password resets.
• To keep the service secure, prevent abuse and fix problems.

Drafts are written by Gemini models that we call through Google Cloud’s Vertex AI service, from our servers only, under our Google Cloud agreement. Your browser never talks to the model directly.

To write a draft we send the model the review, your voice instructions and your facts and policies. We don’t use your reviews or replies to train or fine-tune any model.

For healthcare and other confidential professions, Reply Hearth is built to avoid disclosing patient information: replies never confirm or deny that a reviewer is a patient or client, and every draft is checked for health details before it can be posted.

Review content from Google Business Profile, Google Play and the App Store is kept for at most 30 days after we fetch it. After that, a scheduled job deletes it automatically.

When an account is closed, we delete everything above within 30 days, except records the law requires us to keep.

We don’t sell personal information or share it for advertising. We share information only with the providers below, who process it for us under contract, and when the law requires it.

Replies you approve are published on the platform where the review was left, which is the point of the service.

• Information is encrypted in transit (TLS) and at rest.
• Google access tokens and App Store keys are encrypted with Cloud KMS and are only ever used on our servers.
• Only verified members of your workspace can see its reviews, drafts and history. Browsers can read that data but never change it directly; every change goes through our servers and is checked.
• Every posted reply is recorded in your audit log.

Disconnecting a Google Business Profile revokes our Google access token. Disconnecting an App Store account destroys our copy of its key.

Deleting your account (Settings, then Delete account) disconnects every linked account and revokes its tokens, then permanently deletes your reviews, drafts, reply history, consent records, audit log, settings and account.

Replies that were already posted stay on Google, Google Play or the App Store. You can remove them there.

Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to object to how we use it. Most of this you can do yourself in Settings. For anything else, contact us and we’ll respond within 30 days.

If you are a reviewer whose review a business connected to Reply Hearth, contact that business first. It decides how its replies are handled, and we’ll help it respond to you.

Reply Hearth is a business tool and isn’t meant for anyone under 18. We don’t knowingly collect information from children.

If we make a material change, we’ll email account owners and update the date at the top of this page before the change takes effect.

Questions about this policy or your information: [contact address to be published before launch]. See also our Terms of Service.