Privacy Policy

1. Data We Collect

We collect the following personal data:

• Name and email address (upon registration via Google sign-in)
• Google Business Profile data (location information, reviews, review texts, reviewer name)
• Social reply generator data for the selected business location: pasted review text, optional one-time context, selected platform and listing metadata, saved platform profile context and reply policy notes, generated replies, copied or selected variant metadata, and usage or credit metadata
• Payment information (processed by our payment processor, we do not store credit card data)
• Usage data (login times, features used)
• Customised replies (to improve the response style, “Style Memory”)

2. How We Use Your Data

We use your data exclusively for the following purposes:

• Creating personalised replies to your Google reviews
• Creating manual copy-back replies for pasted reviews from other platforms for the selected business location, and showing the related social reply history and credit usage
• Managing your account and subscriptions
• Weekly and monthly summaries via email
• Notifications for negative reviews (1-2 stars)
• Style Memory: when you adjust a reply, the system learns your style for future suggestions in your account
• Improving our services

We do not train external AI models with your data. Your reviews, replies, and Style Memory entries stay in your account and are not used to train or fine-tune third-party AI models.

3. Data Sharing

We do not sell your data or share it with third parties for marketing purposes. The following service providers process data on our behalf:

• The review, delivery and social platforms you connect (for example the Google Business Profile API), to retrieve reviews and publish replies; each acts as an independent controller under its own terms
• AI service providers OpenAI and Anthropic (USA), review texts are processed to generate reply suggestions; retention and use are described in section “Data Processing Location & International Transfer”
• Payment processor, for secure payment processing (PCI-DSS compliant)
• Email service provider, for sending notifications
• Hosting, operation of our platform in EU data centres

For your business data these providers act as sub-processors of StarPresence LLC under the Data Processing Agreement; for platform data they act on behalf of Marlin Group LLC.

StarPresence's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. For more details, see our Google API disclosure.

4. Data Retention

Your data is stored as long as your account is active. After account deletion, all personal data is irrevocably deleted within 30 days. Anonymised data may be retained for statistical purposes.

Per-item approval is the default: you approve the exact text before StarPresence sends it. That remains the case unless you have switched on automatic publishing in your settings; where you have switched it on, content that meets the conditions you set and passes StarPresence's safety checks is published without a separate approval from you. Some replies are still held for your approval, including where a safety check does not pass. Switching on automatic publishing is your own decision, and you stay responsible for the content of everything published on your behalf under it. Content published through StarPresence to your own platforms is your content and your responsibility. This does not change StarPresence's own obligations for how it operates and secures the service and how it processes your data. In data-protection terms, you are the controller of the content published on your instruction, and StarPresence processes it on that instruction. StarPresence's erasure obligation is limited to what StarPresence holds.

If StarPresence definitively confirms that a review was deleted or invalidated on Google before a reply was published, StarPresence marks the review as no longer visible and removes it from active approval and publishing queues. That status change does not delete StarPresence's stored copy of the review.

If you delete your StarPresence account, StarPresence deletes the personal data it holds, as described above. StarPresence does not, on its own initiative or as part of a data-erasure request, retract, delete or alter content already published to a provider with your approval. Erasing StarPresence's records does not unpublish that content; it remains your content in the provider's system. You may explicitly instruct StarPresence through the product to delete your own reply that was published through StarPresence to Google, and StarPresence carries out that instruction.

Social reply profiles and pasted social reply history are stored for the selected business location until you delete the history entry manually or the related business location or account is deleted. Pasted social review text is stored as history, not as reusable business knowledge.

5. Cookies and Analytics

StarPresence sets as few cookies as possible. For web analytics we use a privacy-friendly tool that sets no cookies and collects no personal data. A session cookie is used solely for sign-in (strictly necessary). If you arrive via a marketing link with campaign parameters (utm), we set one cookie (sr_ft, 90 days) to attribute where your visit came from, but only after you consent in the cookie banner. If you decline, this cookie is not set.

6. Data Processing Location & International Transfer

Your account and review data is stored in EU data centres.

Our AI service providers OpenAI and Anthropic for reply generation process review texts in the USA. This international data transfer takes place on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and equivalent safeguards under the revised Swiss Federal Act on Data Protection (nFADP). OpenAI and Anthropic do not use our API inputs or outputs to train their models. They keep those inputs and outputs for a limited time to provide the service and to monitor for abuse and misuse. OpenAI retains API inputs and outputs for up to 30 days, unless longer retention is required by law or is reasonably necessary to protect its services or any third party from harm; its enterprise privacy page also states that after 30 days those inputs and outputs are removed unless the law requires retention. Anthropic automatically deletes API inputs and outputs within 30 days of receipt or generation, except where a longer-retention service under the customer's control is used, the parties have agreed otherwise, retention is needed to enforce the Usage Policy (up to 2 years for flagged inputs and outputs, and up to 7 years for trust and safety classification scores), or the law requires it.

7. Your Rights

Under the EU GDPR, the Swiss Federal Act on Data Protection (FADP) and the data protection law applicable to you, you have the right to:

• Access your stored data
• Rectify inaccurate data
• Delete your data
• Data portability
• Withdraw your consent
• Restrict processing
• Lodge a complaint with the competent data protection authority, in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in EU member states, the relevant national supervisory authority

If you are a customer of a business that uses StarPresence (for example the author of a review), that business is the controller of your data on the platform and your request is addressed to it. StarPresence does not respond on the merits to such requests; it forwards them to the business concerned without undue delay and acts only on its instruction, unless the law requires otherwise.

The right to deletion applies to personal data StarPresence holds. It does not require StarPresence to retract content already published to a third-party platform.

8. Legal Basis

The processing of your data is based on the EU General Data Protection Regulation (GDPR), the Swiss Federal Act on Data Protection (FADP) and the data protection law applicable to you, as the case may be.

9. Automated Decision-Making

Reply suggestions are generated algorithmically. With automatic publishing enabled, replies are published without renewed manual review in each individual case, but always based on your explicit setting per star rating or per content category you have explicitly enabled (for example short, clearly positive reviews in a specific language). By default, every reply requires your manual approval. So that StarPresence only suggests such an automation when it matches your approval behaviour, StarPresence continuously performs automated checks on which reviews and reply drafts meet the criteria of a content category; only minimised check results (codes, no review texts) are stored. This is not a decision producing legal or similarly significant effects within the meaning of Art. 22 GDPR or Art. 21 nFADP, but the publication of content you have explicitly authorised in advance. You can deactivate auto-publishing at any time.

10. Contact

For questions regarding data protection, please contact us at:

legal@starpresence.ai