The account, Workspace, and integration controls below apply when you use the app. For information about personal data and browser storage across the website and app, see our Privacy Policy and Cookie Policy.
Protecting your connection
RepBot uses encrypted connections to protect information in transit. In the app, secure session cookies help recognize your signed-in session. Browser scripts cannot read the session cookie.
Browsing the public website does not require an app session. If you follow a link to an independently operated website or hosted payment page, that service handles its own connection and security controls.
Account changes also require a separate security check that helps protect against another website making requests without your authorization. You can read more about these cookies in our Cookie Policy.
Signing in and securing your account
You sign in to the RepBot app using a one-time code sent to your email address. Codes expire, and limits on requests and verification attempts help reduce automated abuse. Cloudflare Turnstile provides an additional check during protected authentication steps.
Certain sensitive actions require you to verify your identity again. These include transferring Billing Account ownership and leaving a Workspace.
When you successfully sign out, RepBot revokes the session and clears its sign-in cookies. Keeping your email account secure is important because access to that inbox is used to verify your identity.
Workspace and Profile access
RepBot checks access according to Workspace membership, assigned permissions, and Profile coverage. Your role and assignments determine which information you can view and which actions you can take.
Selecting a Workspace or Profile in the interface does not grant access to it. RepBot checks permissions on the server when handling requests.
Workspace administrators can manage team access within their permitted scope. Billing Account ownership and operational permissions are separate, so access to a Workspace does not by itself grant ownership of its Billing Account.
Connected services and AI
When you connect an integration, RepBot uses the access needed to provide the features you enable. Integration tokens are limited to their intended scope. You can disconnect integrations you no longer need.
AI-assisted features may send review text, business context, and Brand Rules to the providers configured for the service. AI-generated drafts and removal assessments are suggestions. You remain responsible for reviewing and approving material before it is sent to a public platform or third party.
Third-party services have their own security practices and terms. Our Privacy Policy explains the information RepBot shares with service providers.
When a Profile loses Google Business Profile access, RepBot stops Google calls and disables the connection token. A disabled token is retained for 30 days for possible reactivation, then revoked and removed. Archiving a Profile does not itself delete its history or revoke a connection; current entitlement governs whether Google calls are allowed.
Diagnostics and data handling
RepBot uses operational diagnostics to investigate errors and reliability problems. Our app logging rules exclude credentials, sign-in codes, email addresses, review content, generated responses, and prompts from diagnostic logs and PostHog events.
The app configures masking for page text, element attributes, and form inputs used in PostHog session replay. Replay can reproduce a sequence of on-screen interactions for troubleshooting. These settings are designed to limit the content included in recordings. App usage analytics are processed as described in our Cookie Policy.
Customer data is retained while an account is active and as needed for legal, security, billing, and backup purposes. You can request an export or deletion through support. Some records may need to be retained for fraud prevention, tax, legal, or security obligations.
Our Privacy Policy distinguishes customer history, connection tokens, browser storage, and privacy-request records. A request to delete personal data is separate from a subscription cancellation or Workspace offboarding.
Website inquiries
The app protections described here should not be read as a description of every marketing-site form or plugin. When contacting us through the website or email, provide only the information needed to explain your inquiry. Use the compliance address below for security concerns affecting either the website or the app.
Keeping your account secure
You can help protect your account by:
- Keeping your email account secure and never sharing RepBot sign-in codes.
- Giving team members only the access they need and reviewing access when responsibilities change.
- Disconnecting integrations you no longer use.
- Signing out after using RepBot on a shared device.
- Contacting support promptly if you notice unexpected account activity.
Free-tool abuse protection
The free review-response tool uses additional verification and abuse-prevention checks, including Cloudflare Turnstile and device-recognition services, separate from the signed-in app and ordinary marketing pages.
These checks help detect invalid, automated, or abusive requests. See our Privacy Policy for information about data categories and retention.
The tool retains drafting content and generated responses for up to 10 days for quality review, after which the records are deleted. This dedicated content store is different from app diagnostics and PostHog events. See our Privacy Policy for the data categories and retention distinctions.
For a security concern involving the tool, contact compliance and name the affected feature. Do not include sign-in codes, full device identifiers, or sensitive review content in your initial report.