Privacy Policy

Last updated: 15 October 2026

This Privacy Policy explains how ReputeMap (“ReputeMap”, “we”, “us”) collects, uses, stores, shares and protects information when you use our website and the ReputeMap application (the “Service”). ReputeMap is a Google-review management tool for agencies. If you do not agree with this policy, please do not use the Service.

Information we collect

  • Account & workspace data — your name, email address, a hashed password, your agency workspace, and the clients, business locations and team members you add.
  • Google Business Profile data — when you connect a Google account, we access business profiles, locations, reviews, ratings and review replies through the Google Business Profile API, solely to provide the features you request.
  • Billing data — your plan and subscription status. Card details are entered on and handled by Stripe; we never see or store full card numbers.
  • Usage & device data — pages viewed, basic analytics and our own attribution cookies (where your first and your most recent visit came from, and the button that took you to sign up), to understand how the Service is used and what brings customers.
  • Product analytics — in the app, a pseudonymous ID for your workspace together with your plan, billing state and onboarding answers; never your name or email (see “Product analytics & session recordings”).
  • Session recordings — on this website, and in the app only on the sign-up, onboarding, Google-connect and plan pages: clicks, taps, scrolling and how the page renders, with what you type and any data from Google masked, and without Clarity cookies (see “Product analytics & session recordings” and “Cookies & analytics”).
  • Advertising measurement — on this website only, the Meta Pixel and the Quora Pixel record page views, a click toward sign-up or checkout and a completed email sign-up, so we can measure our ads and show them to people who visited. When your browser’s time zone is in the EEA, the UK or Switzerland they are not loaded at all (see “Cookies & analytics”).
  • Last seen — the time you and your workspace were last active in the app.
  • Communications — messages you send us (e.g. support requests).

Google user data & Limited Use

We request the Google business.manage scope only to read the Google Business Profile information (business details, locations and reviews) of the accounts you connect, to publish the review replies you write or approve (and, only if you switch on Auto-reply to new reviews, on paid plans and 4–5★ by default, the AI replies it posts for you), and to generate the reports and alerts you configure.

ReputeMap’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not use Google user data for advertising, do not sell it, do not allow humans to read it except where you explicitly request support, where required for security or to comply with law, or where the data is aggregated and anonymized; and we do not transfer it except to provide or improve the Service, to comply with applicable law, or as part of a merger/acquisition with notice. You can disconnect Google at any time in the app, or revoke access at myaccount.google.com/permissions.

Google user data is never sent to our session-recording tool, Microsoft Clarity. On the few app pages where Clarity runs, all text — and every element that shows data received from Google’s APIs — is masked in your browser before anything is sent to Microsoft, and Clarity does not run on any other page of the app, including the review preview and the dashboard (see “Product analytics & session recordings”).

How we use your data

  • Provide, maintain and secure the Service.
  • Sync and display reviews, publish the replies you write or approve (and, only if you switch on Auto-reply to new reviews, on paid plans and 4–5★ by default, the AI replies it posts for you), and send the alerts, review requests and reports you configure.
  • Process subscriptions and billing.
  • Provide support and respond to your requests.
  • Find where this website and the app’s sign-up, onboarding and checkout lose people, and improve them (product analytics).
  • Send account emails such as onboarding and trial reminders, using when you were last active to decide which are relevant.
  • Improve the product and comply with legal obligations.

AI processing

To generate suggested reply drafts and sentiment, review text may be sent to our AI provider (OpenAI, through its API). This processing is transient and is not used to train third-party models. A reply is published only when you approve it, unless you switch on Auto-reply to new reviews (paid plans, 4–5★ by default), which publishes the AI draft to new reviews for you.

Product analytics & session recordings

To improve this website and the app’s sign-up, onboarding and checkout — the steps where people most often get stuck — we measure how they are used. We do it pseudonymously: these tools never receive your name, email address or payment details. Pseudonymous data can still be personal data, so “Your rights” below applies to it, within the limits noted under “Data retention”.

  • Pseudonymous analytics ID (Google Analytics). When you are signed in to the app, we tag analytics events with an ID for your workspace. It is a keyed hash (HMAC) of our internal workspace ID: it contains no name or email, and only we, holding the secret key, can link it back to your workspace. With it we send a few non-identifying properties — your plan, your billing state (for example trial, active or cancelled) and your answers to the onboarding questions (how many locations you manage and what matters most to you) — so we can follow the journey across visits and devices and see which steps, plans and features work.
  • Where Clarity runs. We use Microsoft Clarity for session recordings and heatmaps: it records how a page is used (clicks, taps, scrolling, mouse movement and how the page renders) so we can replay a visit and see where people click. It runs on the pages of this website, reputemap.com (not on the “page not found” page), and on five pages of the app at app.reputemap.com: sign-up (/register), onboarding (/onboarding), connecting Google or a client’s profile (/connect and /connect/client) and choosing a plan (/subscribe). It does not run on any other page of the app, including the review preview (/preview) and the dashboard.
  • Without cookies, for every visitor. Clarity’s cookie setting is turned off for our Clarity projects, on this website the page also starts Clarity with cookies switched off, and we send Microsoft’s consent signal set to “denied” as well. So it runs in Microsoft’s no-consent mode: no Clarity or Microsoft cookies, and a new ID for every page view instead of one that follows you across visits (see “Cookies & analytics”).
  • What Clarity does not see on this website. What you type into form fields is always masked, and so are numbers and email addresses on every page. We also mask, in your browser before anything is sent to Microsoft, the business details we look up on Google for you (the results and business card of the free business check and of the QR code generator: names, addresses, ratings and review counts), audit reports, every email sign-up form and the confirmation that repeats your email address, and the replies the review response generator writes. Clarity also records a page’s web address and the address of the page you came from, which masking cannot reach, so a page is not recorded at all when either of them names a business (such as a link in an email from us that opens the business check for your business) or opens an audit report (audit links carry a private code). The business check also removes the business from the address bar once it has read it, and audit report pages pass on only “reputemap.com” as the page you came from. Website recordings are not tagged with any ID of ours.
  • What Clarity does not see in the app. The app’s Clarity project masks all text: every word on those five pages is masked in your browser before anything is sent to Microsoft, and every element that shows data received from Google’s APIs (business search results, review previews, the Google account you connected) is masked explicitly as well. So Clarity never receives review texts, reviewer names, business details from Google, email addresses or anything you type. Payment details are never recorded: you pay on Stripe’s hosted checkout page, where Clarity does not run. App recordings are tagged with the same pseudonymous workspace ID and the same few properties as Google Analytics (plan, billing state and your onboarding answers); Clarity hashes the ID again in your browser before sending it.
  • Last seen. Our own servers record when you and your workspace were last active in the app. We use it for product analytics (for example, how many workspaces are active) and to decide which account emails are relevant to you.

Microsoft provides Clarity under its own terms as an independent controller, not as our processor. Microsoft collects this data to provide Clarity and Microsoft Advertising, and may also use it for its own purposes — including improving its products and creating user profiles for purposes that include advertising — as described in the Microsoft Privacy Statement. The masking above limits what Microsoft receives in the first place. How long each tool keeps this data is under “Data retention”; how to opt out is under “Your rights”.

Browser extension & Mac app

The free extension “ReputeMap: Google Review Link & QR Code” for Chrome, Edge, Firefox and Safari, and the Mac app “ReputeMap: Review Link & QR” that installs it in Safari, collect no personal data. They read the address and title of the tab you click the extension on, only at that moment, to build the Google review link on your device. They make no network requests and have no analytics, tracking or advertising. Your card settings stay in your browser. Links in the extension open web pages only when you click them; “Check for free” opens reputemap.com with that business’s public Place ID and name in the address. Visits to reputemap.com are covered by the rest of this policy.

Service providers (subprocessors)

We share data only with providers that help us run the Service:

  • Google — source of review/business data (Business Profile API).
  • Stripe — payment processing.
  • Amazon Web Services (SES) — sending email (alerts, review requests, reports).
  • OpenAI — AI reply drafts and sentiment.
  • Telegram — delivering alerts to the Telegram chat you connect (only if you turn this channel on).
  • Meta (WhatsApp Business Platform) — delivering alerts to the WhatsApp numbers you connect (only if you turn this channel on).
  • DigitalOcean — hosting and infrastructure.
  • Google Analytics — usage analytics: aggregate on this website; in the app, linked to a pseudonymous workspace ID. In the EEA, the UK and Switzerland never with Google’s advertising signals (see “Cookies & analytics”).
  • Microsoft (Clarity) — session recordings and heatmaps on this website and on five sign-up, onboarding and checkout pages of the app, masked as described above, without cookies. Microsoft acts as an independent controller for this data (see “Product analytics & session recordings”).
  • Meta (Meta Pixel) and Quora (Quora Pixel) — advertising measurement on this website only (not in the app), as described under “Information we collect”; not loaded for visitors in the EEA, the UK and Switzerland. Meta and Quora process this data under their own terms and privacy policies.

We do not sell your personal information.

If you manage reviews for your own clients, ReputeMap acts as your data processor — see our Data Processing Addendum.

Data retention

We keep your data while your account is active and as needed to provide the Service and meet legal obligations. You may request deletion of your account and associated personal data at any time (see “Your rights”).

Analytics data has its own retention periods:

  • Microsoft Clarity — Microsoft documents that Clarity keeps the data used to replay a recording for 30 days, and keeps aggregated click and heatmap data, recordings we mark as favorites or label, and a randomly selected sample of recordings for up to 9 months; after that it is deleted from Clarity’s servers, including backups (Clarity data retention, Clarity FAQ). Clarity cannot delete one person’s recordings early — only a whole project — so recordings expire on that schedule; website recordings carry no ID of ours, so we could not pick out yours in any case. Data Microsoft uses for its own purposes is kept as described in the Microsoft Privacy Statement.
  • Google Analytics — under our current settings, event-level data for 2 months and user-level data (including the pseudonymous workspace ID) for 14 months after your last activity. Google’s aggregated reports are not subject to these limits.
  • Last seen — we store only the most recent time, as part of your account data.

Your rights

Depending on your location (including under GDPR and CCPA), you may have the right to access, correct, export or delete your personal data, and to withdraw consent. To exercise these rights — or to request deletion of Google user data we hold — email yaro@reputemap.com. You can disconnect your Google account in the app at any time.

We run analytics and session recordings on the basis of our legitimate interest in understanding how our website and app are used and improving them. You can opt out tool by tool: for Clarity, turn on Global Privacy Control in your browser (Clarity supports it) or opt out of Microsoft at optout.aboutads.info; for Google Analytics, use Google’s opt-out browser add-on. You can also block these cookies or scripts in your browser, or email yaro@reputemap.com to object to this processing.

Cookies & analytics

We use essential cookies to run the app (e.g. authentication) and Google Analytics with our own attribution cookies to understand traffic. You can control cookies through your browser settings.

Analytics runs for every visitor; advertising never in Europe. Google Analytics may use its cookies (such as _ga), Microsoft Clarity runs without cookies, and this website sets rm_attr, rm_last, rm_cta and rm_hcv (below) for every visitor. When your browser’s time zone is in the European Economic Area, the United Kingdom or Switzerland (or is UTC, or not reported), or your connection is in these countries, Google Analytics runs with Google’s advertising signals off and the Meta and Quora pixels are not loaded at all. If you chose “Decline” on the cookie bar we used to show (its answer is kept in a cookie named rm_consent for up to 12 months), the Meta and Quora pixels stay off for you wherever you are.

This website also sets four cookies of its own: the first-touch attribution cookie (rm_attr: where your first visit came from, kept 90 days); the last-touch cookie (rm_last: where your most recent visit from another site, a link or an ad came from — its campaign tags and ad click ID included — kept 30 days); a cookie for the last button you clicked toward signing up (rm_cta: which page of this website and which button, kept one day); and a cookie that keeps the version of the business check you see the same across visits (rm_hcv, 30 days). The app reads the first three when you sign up and keeps what they say with your account, to see which pages and channels bring customers. When you open this website from outside it (another site, a link, a bookmark), the first page tells our server where you came from (the referring site, the page you landed on and any campaign tags in its address), without storing anything on your device.

Microsoft Clarity sets no cookies, on this website or in the app. Clarity’s cookie setting is turned off for our Clarity projects; on this website the page also starts Clarity with cookies switched off; and we send Microsoft’s consent signal set to “denied” as well. In that mode Microsoft documents that Clarity sets neither its own first-party cookies (such as _clck and _clsk) nor Microsoft’s third-party cookies (such as MUID), and gives each page view its own ID instead of connecting your page views into one visit — see Clarity’s consent API and cookie list.

Security

Data is transmitted over encrypted connections (HTTPS), and OAuth tokens are encrypted at rest. No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard measures.

International transfers & children

Your data may be processed in countries other than your own. The Service is not directed to children under 16, and we do not knowingly collect their data.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected here with a new “Last updated” date.

Contact

Questions or data requests: yaro@reputemap.com. See also our Terms of Service and Refund Policy.