- Core Haven Labs
- Auto-Reputatie
- Privacy policy
Privacy Policy Auto-Reputatie
In case of any discrepancy, the Dutch version prevails.
Auto-Reputatie replies to Google reviews on behalf of your business. To do that we process data about you and about the people who write reviews. Below is exactly what we process, why, for how long and with whom we share it. Version of 28 August 2026.
Who is responsible
Core Haven Labs is the data controller for the data Auto-Reputatie processes.
Which data we process
Your account
- Email address, display name and language preference.
- Your password, only as an encrypted hash (bcrypt). We cannot read your password ourselves.
- Your role within your organisation (for example owner) and the date your account was created or deleted.
Your business profile
- Business name, locations, address, category, country, time zone and default language, as they appear on Google.
- The contact details you enter yourself for use in replies: email address, phone number and website. Only those may appear in a reply.
- Your settings: tone, signature, rules per star rating, preview mode, notification preferences.
Reviews and replies
- The reviews on your Google Business Profile: stars, text, the reviewer's display name and date. We also keep earlier versions when a review is edited.
- The replies the AI proposes, the edits you make, who approved a reply and whether it was published.
- Per reply: which AI provider, which model and which prompt version were used, plus the number of processed tokens. We use this for auditing and cost control.
- An automatic assessment per review: language, sentiment, risk level and whether a person needs to look at it.
The connection with Google
- The Google account ID and email address you connected with, and the access and refresh tokens Google gives us. These tokens are stored encrypted in our database (Fernet).
- We never store Google's authorisation code.
Payments
- If you pay on the web, payment runs through Stripe. Stripe processes your card details; we never see or store card numbers. We keep only the Stripe customer ID, the subscription ID, its status and the end date of the paid period.
- If you purchase through the App Store or Google Play, Apple or Google processes the payment and we receive only the subscription status (through RevenueCat).
Logs and technical data
- An audit log of important actions (connecting, changing settings, publishing a reply, changing a subscription), with timestamp and who did it.
- Server logs with timestamp and IP address of requests, with secret keys masked automatically. On login and registration we count attempts per IP address to slow down abuse.
What we use it for
- Providing the service (performance of the contract): fetching reviews, proposing replies, publishing them after your approval or according to your settings, sending notifications.
- Safety (legitimate interest): holding back sensitive reviews, filtering made-up contact details out of replies, slowing down abuse of login pages, diagnosing outages.
- Payments and administration (contract and legal obligation): subscriptions, invoices, bookkeeping.
- Contact: answering your questions and informing you about changes to the service.
We do not use your data for advertising and we do not sell it. The AI system does not learn from your reviews or replies: it does not adjust itself based on earlier outcomes.
Who we share data with (processors)
| Party | What | Why |
|---|---|---|
| Google (Business Profile API) | Fetching reviews, publishing replies, notifications about new reviews | The connection with your Google Business Profile |
| OpenAI and Anthropic | Business name, category, tone, your contact details and the review text with stars and display name | Writing a proposed reply. Two providers run one after the other: if the first fails, the second takes over. We never send tokens, account data or payment data |
| Stripe | Payment details, email address, billing address | Payment on the web, tax calculation |
| Apple, Google Play, RevenueCat | Subscription status | In-app purchases |
| Cloudflare | Network traffic to our servers, including IP address | Security and availability of the app and this website |
| Expo (push service) | The push token of your device and the notification itself (title and short text, without review text) | Delivering push notifications |
| Google Firebase (FCM) | Push token | Delivery of push notifications on Android |
| Resend | Your e-mail address and the content of our e-mails (notifications, monthly summary, password reset) | Sending e-mail |
Data processing agreements or equivalent terms apply with these parties. OpenAI, Anthropic, Stripe and Cloudflare may process data outside the EU; for that the European Commission's standard contractual clauses or the EU-US Data Privacy Framework apply. Expo and Resend are US companies; the same safeguards apply to them.
How long we keep it
- Account, business profile, reviews and replies: as long as your account exists. If you delete your account, your organisation with all locations, reviews, replies and Google tokens is deleted.
- Google tokens: until you disconnect or delete your account. If Google revokes access, we stop trying and warn you.
- Payment and invoice data: seven years, because of the Dutch tax retention obligation.
- Server logs: at most thirty days.
Your rights
You have the right to access, rectification, erasure, restriction, portability and objection. Much of this you can do yourself:
- View and edit: your account, business profile and settings are in the app.
- Disconnect Google: in the app, immediately.
- Delete your account: in the app under your account. This deletes your whole organisation including Google tokens.
For other requests, email privacy@corehavenlabs.com. We respond within a month. If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
No longer have the app? The delete account page explains how to have your account deleted by e-mail and exactly what is erased.
People who write reviews
We process the display name and text of reviews that are publicly visible on Google, in order to reply to them on behalf of the business. Our system always treats review text as untrusted text: it never changes how the system behaves. If you are a reviewer and do not want a business to reply to your review through Auto-Reputatie, contact that business or us.
Security
- Google tokens stored encrypted; passwords only as a bcrypt hash.
- Every request is limited to your own organisation; other businesses' data is not reachable.
- Encrypted connections (https), security headers on every response, verified signatures on all messages from Google, Stripe and RevenueCat.
- When in doubt the system publishes nothing: a reply that fails a check stays a draft.
No cookies, no trackers
This website sets no cookies and uses no analytics or tracking. All fonts, scripts and images come from our own domain; nothing is loaded from third parties. That is why there is no cookie banner either. The app itself stores on your device only your sign-in session, your language preference and — if you switch on notifications — the push token needed to deliver them.
Changes
If this policy changes, we publish the new version here with its date. For a significant change we inform you in the app or by email.
Version 28 August 2026. See also the terms of service.