Privacy policy

What data we process and why

We process email addresses, account and permission data, location information, contact requests, billing details and records of significant actions. We use them to handle enquiries, provide and manage the service, secure accounts, provide support and meet accounting obligations. The legal bases are steps towards a contract and its performance, legal obligations, and legitimate interests in security and protecting rights. You enter payment card details directly with Stripe; our app does not receive the full details. With your consent, we also use Google Analytics to measure visits to public pages so we understand what works on the site; that consent is the legal basis.

Reviews and AI

Connected Google profiles provide public reviews, ratings, author names, timestamps and replies. We act as the customer's processor for this data. For AI drafts, we send the review text and rating, location name, style instructions and up to eight recent examples from approved, edited and rejected replies. Examples can include original drafts and edited replacements so later replies can follow your preferences and avoid unwanted wording. They are context for a request, not model training. We do not separately add the author's name to the AI request, although personal data may appear in the review text. We send requests directly to Anthropic, which does not use API inputs to train its models. Check the output before publishing; automatic mode requires the owner's explicit choice.

Editing or rejecting a reply does not delete its original text from recent edit history or prevent that text from being included in later AI requests. We do not automatically remove sensitive information from this feedback. If sensitive text should no longer be processed, disconnect the affected location and contact help@wewriteback.com before reconnecting. Disconnecting removes our saved reviews and edit history, but does not remove the public content at Google.

Recipients and transfers

Vercel hosts the website, Supabase provides the database and authentication, Resend sends service emails, and Anthropic prepares reply drafts. These providers act as subprocessors for customer review data where they process it for us. Stripe handles payments, subscriptions, invoices and credit notes. Our accountant receives the billing records needed for bookkeeping; legacy Czech accounting records may be held in Seyfor's iDoklad. Google provides business profiles and reviews. With visitor consent, Google Ireland Limited processes public website usage statistics through Google Analytics. Some providers may process data outside the European Economic Area. We use applicable adequacy decisions or standard contractual clauses with relevant safeguards for those transfers. Contact us for the applicable processing agreements and transfer details.

Retention

We retain account data while the account is in use and afterwards only as needed for legal obligations and protecting rights. Accounting and tax documents are subject to statutory retention, generally ten years from the end of the relevant tax period for tax documents. Google profile details and reviews expire from our primary cache after 21 days without refresh; related edit history expires after 21 days. Pending jobs cannot extend retention. Backups expire within seven days. Disconnecting a location removes cached Google profile details, reviews and history, but does not remove public reviews from Google. Separately supplied customer identity is account data and can remain. Content-free AI usage and email delivery records are retained for up to 90 days for reliability, cost reconciliation and support. These records contain account and provider references, timing, token counts and outcomes, not review text, reply text, email bodies or recipients. Google Analytics event and user data use a two-month retention setting, without resetting retention on new activity; aggregate reports may remain longer.

Cookies

We use essential cookies for sign-in, customer account selection and security. Google Analytics cookies are stored only with your consent and only on public website pages. Change or withdraw consent using Cookie settings in the footer. We do not use advertising cookies. See the Cookie policy for the complete overview. Stripe and Google apply their own policies when you use their services.

Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction or portability, or object to processing. You can withdraw analytics consent at any time; this does not affect processing before withdrawal. Deletion does not affect data we must retain by law. Send requests to help@wewriteback.com; we may verify your identity. If a request concerns a customer's review, we forward it to the relevant controller and help handle it. You may complain to the Czech Office for Personal Data Protection at uoou.gov.cz.