Privacy policy

Who is responsible

Reputa is operated by Ugnius Motiejūnas, self-employed in Lithuania under individual activity certificate No. 1494344, issued by the State Tax Inspectorate. A company is being set up, and this page will name it once it is registered.

For anything about your data, write to info@reputa.lt. A person reads that inbox.

What this website collects

The website sets no cookies. It collects the following.

• The sign up form: your name, your email and, if you give it, your phone number. We use them to contact you about Reputa and for nothing else. The form is delivered to our inbox by Web3Forms.
• The business name you type into the free preview. It is passed to app.reputa.lt, which builds the preview from reviews that are already public on Google Maps.
• Usage events such as a page view or a click on a button, reported by name only. The visitor id behind them lives in your browser tab and disappears when you close it. It is never tied to a name or an email, and no profile of you is built. Events are stored with PostHog in the EU.
• Server logs kept by our hosting provider, which include IP addresses, for security and fault finding.

What Reputa accesses in your Google account

When you connect a Google Business Profile, access is granted through the official Google sign in. We never see or store your Google password.

We use this data to show you your reviews, to draft replies in your tone, to publish the replies your settings allow, and to report how the profile is doing. We use it for nothing else.

• From Google sign in: your email address, your name and your profile picture, to create and secure your account.
• From the Business Profile: the name, address and identifier of each location you connect.
• Reviews of those locations: the reviewer name and photo as Google shows them, the rating, the text, the date, and any replies.
• Profile performance figures such as views, calls and direction requests, where that feature is switched on.

Limits on Google user data

Reputa's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• We never sell Google user data.
• We never use it for advertising.
• We never use it to train general purpose AI models. Review text is sent to an AI provider only to draft the reply to that review.
• Our team opens a client account only to give support the client asked for, to fix a fault, or when the law requires it.

Who processes data for us

These providers handle data on our behalf, each for one purpose.

Some of them are based outside the European Union. Transfers to them rely on the Standard Contractual Clauses in their data processing terms.

• Vercel and Railway: hosting of the website, the product and its background jobs.
• A managed PostgreSQL database provider: storage of accounts, locations, reviews and replies.
• Zernio: the technical connection to the Google Business Profile, including fetching reviews and publishing replies.
• OpenAI and Google Gemini: drafting reply text. They receive the review text, the rating and the reviewer name.
• Resend: email notifications about new reviews.
• Sentry: error reports when something breaks.
• PostHog, EU region: usage analytics.
• Web3Forms: delivery of the sign up form.

How long we keep it

• Sign up form contacts: until you ask us to remove them.
• Client accounts, reviews and replies: for as long as the service runs. When it ends you can export your data as CSV, and 30 days later we delete it.
• Usage events hold no name and no contact details.

How to revoke access

You can cut Reputa off at any moment, without asking us. Open your Google Account, go to Security, find the third party connections and remove the access you granted for Reputa. If Reputa was added as a manager of the profile, remove it under the managers of that Business Profile.

You can also write to info@reputa.lt and we will disconnect the profile. Replies already published stay on your profile, because they belong to you.

Reviews belong to the business

For reviews and replies, the business that connected the profile is the data controller and Reputa is its processor. We sign a data processing agreement with every client that asks for one.

Your rights

Under the GDPR you can ask for a copy of your data, have it corrected or deleted, restrict or object to its use, and take it elsewhere. Write to info@reputa.lt and we answer within 30 days.

If you think we handled your data wrongly, you can complain to the State Data Protection Inspectorate of Lithuania, vdai.lrv.lt.

Changes to this page

When this policy changes, the date at the top changes with it. Clients are told by email before a change that affects their data takes effect.