Privacy Policy
Last updated August 11, 2026
Review Reply Copilot (“we”, “the site”) is operated by Chudi Nnorukam. This policy explains what we collect, why, who else sees it, and what you can require us to do about it. It describes what the service actually does rather than what a template says a service might do.
What we collect
Information you give us
- Your email address, when you sign in or ask to be sent something. We sign in with an emailed link rather than a password, so we never hold a password for your account.
- Review text and business details you paste or import, including anything you upload by CSV, plus the tone and facts you add to shape a reply.
- Workspace and team information, such as the names of locations you manage and the email addresses of teammates you invite.
- Billing details, if you subscribe. Card numbers are entered on Stripe’s systems and are never sent to or stored on ours. We keep a record of which plan you are on and whether it is active.
Information collected automatically
Our hosting provider records standard server logs, including IP address, browser type, pages requested, and timestamps. We use a session cookie to keep you signed in. That cookie is strictly necessary and the site cannot work without it.
We use Ahrefs Web Analytics to count page views. It sets no cookies, does not fingerprint your device, and does not follow you to other sites, which is why it runs without asking your permission. It tells us that a page was viewed, not who viewed it.
Why we use it
To operate the service you asked for: generating reply drafts, keeping you signed in, running your workspace, taking payment, sending you transactional email such as sign-in links and receipts, and keeping the site secure and working. We also use aggregate, non-identifying usage information to decide what to build next.
We do not sell your personal information for money. See the advertising section below for what happens with retargeting, which some laws classify as “sharing” even though no money changes hands.
Who else your information reaches
We use the following service providers. Each receives only what it needs to do its job, and none of them is permitted to use your information for their own purposes.
| Provider | What it does | What it receives |
|---|---|---|
| OpenAI | Generates the reply drafts | The review text and the tone and facts you supply |
| Stripe | Takes payment | Your billing details, entered directly on Stripe |
| Resend | Sends transactional email | Your email address and the message contents |
| Vercel | Hosts the site | Server logs, including IP address |
| Ahrefs Web Analytics | Counts page views, without cookies | The page viewed and general location |
| Our database host | Stores your account and workspace | Everything you save to your account |
| Google Sheets | Records email sign-ups from the site | The email address you submitted |
Review text you submit is sent to OpenAI to produce a draft. It is not used to train their models under the terms that apply to business API use. Do not paste information into a review draft that you would not be willing to publish, because the point of the draft is to be posted publicly.
We will also disclose information where the law requires it, and to protect the rights or safety of users or the public.
Advertising, retargeting, and cookies
If you visit this site, we may later show you advertising for it on other platforms, including Google and Meta properties such as Facebook and Instagram. This works through a small piece of tracking code, commonly called a pixel, which those platforms place in your browser and read when you visit their sites.
What that means in practice: those platforms are told that a browser visited a page on this site, along with technical information such as IP address and the page visited. That lets us show ads to people who have already been here rather than to strangers. The content of any review you paste, the drafts you generate, and your workspace data are never sent to an advertising platform.
Under some privacy laws, notably the California Consumer Privacy Act as amended, this kind of cross-context behavioral advertising counts as “sharing” personal information even though we receive no money for it. You have the right to opt out, and you can do so in any of these ways:
- Email us at hello@chudi.dev with the subject “Do Not Sell or Share”.
- Turn off personalized ads in Google My Ad Center and in your Meta ad preferences.
- Use the industry opt-out tools at optout.aboutads.info or optout.networkadvertising.org.
- Send a Global Privacy Control signal from your browser, which we honor as a valid opt-out request.
Blocking these cookies does not stop you from using the site. The strictly necessary sign-in cookie is separate and cannot be turned off while you are signed in.
Your rights
Wherever you live, you can ask us to show you what we hold about you, correct it, delete it, or send you a copy in a portable format. If you are in the UK or the European Economic Area you also have the right to object to or restrict processing, to withdraw consent at any time, and to complain to your national data protection authority. If you are in California you additionally have the rights to know, to delete, to correct, to opt out of sharing as described above, and not to be treated differently for exercising any of them.
To exercise any of these, email hello@chudi.dev. We will respond within the time the applicable law allows, which is one month in the UK and EEA and 45 days in California. We may need to verify that the request comes from you before acting on it.
How long we keep it
Account and workspace data is kept while your account is open and for a short period afterwards so that an accidental deletion can be undone. Billing records are kept as long as tax and accounting rules require. Server logs are kept for a short operational period. When you ask us to delete your account we remove your personal information except where we are legally required to keep a record of a transaction.
Security
Data is transmitted over encrypted connections and held with reputable providers. Sign-in uses emailed one-time links rather than passwords, which removes an entire class of credential theft. No system is perfectly secure, and we do not claim otherwise.
International transfers
The providers listed above operate in the United States, so using this service involves transferring your information there. Where the law requires a transfer mechanism, we rely on our providers’ standard contractual clauses.
Children
This is a tool for businesses and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has given us information, email us and we will delete it.
Changes to this policy
If we change what we collect or who we share it with, we will update this page and the date at the top. Material changes to how we use your information will be notified by email where we hold an address for you.
Contact
Email hello@chudi.dev, or use the contact page. The data controller is Chudi Nnorukam, operating as Review Reply Copilot.
This policy explains our practices in plain language. It is not legal advice, and it is not a substitute for your own review of the laws that apply to you.