Privacy Policy

Last updated: October 30, 2026

This Privacy Policy explains how RepOcean (“RepOcean”, “we”, “us”) collects, uses, stores, shares and deletes information when you use the RepOcean web app at platform.repocean.com and our review widgets. It includes the data we receive from Google when you connect a Google Business Profile.

1. Information We Collect

• Account information you give us: your name, email address, password (stored only as a one-way hash), business and website details, and the people you invite to your team.
• Customer contact details you add to send review requests (name, email address or phone number), and private feedback that your customers choose to send through your review page.
• Usage information collected automatically: IP address, browser type, pages visited, widget view counts and in-app events, used to run, secure and improve the service.
• Google user data when you connect a Google account, as described in Section 2.

2. Google User Data

RepOcean lets you manage your Google Business Profile. When you choose Connect Google, Google asks you to grant RepOcean access, and you can approve or decline. We request only these permissions:

• Manage your Business Profile (https://www.googleapis.com/auth/business.manage) — to list the Business Profile accounts and locations you manage, read their reviews, post the review replies you write or approve, publish the Business Profile posts you create or schedule, and (when enabled) receive notifications of new reviews.
• Your email address and basic sign-in identity (openid, email) — to identify which Google account you connected and show it to you in Settings.

What Google data we access and store

• Your Google account ID and email address;
• OAuth access and refresh tokens, used only to call Google APIs on your behalf;
• The Business Profile accounts and locations you choose to import: business name, address, phone number, website, store code and place ID;
• Reviews of those locations: reviewer display name and profile photo, star rating, review text, review photos, your replies and their dates;
• Posts you publish through RepOcean and their status;
• Performance numbers for those locations: daily views on Google Search and Maps, calls, website clicks, direction requests, chats and bookings, and monthly search terms.

How we use Google data

We use Google user data only to provide the features you see in RepOcean:

• showing your locations and reviews in your dashboard and review inbox, with alerts and digests about new reviews;
• posting replies to reviews and publishing Business Profile posts — only when you, or a team member you invited, ask us to, or when you turn on automatic replies or schedule posts;
• showing your reviews on your own website through a review widget that you create and embed;
• showing Business Profile performance (views, calls, website clicks, direction requests and search terms) on the Insights page and in monthly reports you choose to receive or share;
• if you turn on AI features, drafting reply and post suggestions and tagging review topics and sentiment (see Section 3).

Limited Use

RepOcean’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we use Google user data only to provide and improve the user-facing features described above;
• we do not sell Google user data, and we do not use or transfer it for advertising, retargeting or interest-based ads;
• we do not use or transfer it to determine creditworthiness or for lending purposes;
• we do not use Google user data to develop, improve or train generalized artificial intelligence or machine learning models;
• our staff do not read your Google user data unless you give us permission (for example, in a support request), it is needed for security purposes such as investigating abuse, it is required to comply with law, or the data is aggregated and anonymized for internal operations.

3. How We Share Information

We do not sell your information. We share it only in these cases:

• With Google, when we post a reply or a Business Profile post that you asked us to publish.
• On your website, when you embed a RepOcean review widget: it shows the reviews you chose to display (reviews that are already public on Google).
• With OpenAI, only when you use an AI feature. To draft a reply we send the business name, the reviewer’s display name, the star rating and the review text; to draft a post we send the business name, your topic and, if you choose, short excerpts of recent reviews; to tag topics (only if you turn on “Tag review topics”) and to write a review summary (only when you ask for one) we send the star ratings and review texts, without reviewers’ names. By default the request is made with RepOcean’s own OpenAI account, within a monthly allowance; you may instead add your own OpenAI API key, in which case the request is made under your agreement with OpenAI. In both cases the data is sent solely to return the draft to you and is not used by RepOcean to train any model. You can turn AI features off, or remove your key, at any time in Settings.
• With service providers that host our servers and deliver our email and text messages (for example review alerts and the review requests you send), under contracts that limit them to providing that service.
• With members of your team that you invite, according to the role and locations you give them.
• When required by law, or to protect the rights, safety and security of our users and the service.

4. Data Security

All traffic to and from RepOcean is encrypted with HTTPS. Google tokens and your data are stored on our servers in an access-restricted database and are never exposed in your browser or in widget code. Passwords are stored as one-way hashes, and OpenAI API keys are encrypted at rest. Access to production systems is limited to the staff who operate the service.

5. Data Retention and Deletion

• Disconnect Google at any time in RepOcean under Settings → Google connections → Disconnect. We revoke our access at Google and immediately delete the stored tokens for that Google account. You can also remove RepOcean’s access from your Google Account at myaccount.google.com/permissions; we then can no longer access your data and stop syncing.
• Locations and reviews already imported stay in your RepOcean account so you keep your history, until you delete the location or your account.
• Download your data at any time under Settings → Your data → Download my data (spreadsheet files of your locations, reviews, customers, requests, feedback, widgets, posts and team).
• Delete your account and all its data yourself under Settings → Your data → Delete my account. We immediately disconnect your Google accounts (revoking our access) and delete your login, tokens, locations, reviews, customers, widgets, posts and feedback; backups are overwritten within 30 days. You can also ask us by emailing support@repocean.com from your account email.

6. Your Choices and Rights

You can view and update your account information at any time, disconnect Google, turn AI features and notifications on or off, and ask us for a copy of your data or for its deletion by contacting us. Your customers can stop review-request messages at any time using the unsubscribe link in every message.

7. Children

RepOcean is a business service and is not directed to children under 16. We do not knowingly collect their personal information.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the new version on this page with a new “Last updated” date, and tell account owners by email about material changes.

9. Contact Us

If you have any questions about this policy or your data, contact us at support@repocean.com.