RewilyPrivacy Policy
This Privacy Policy explains how Rewily (“Rewily”, “we”, “us”) collects, uses, stores, shares and deletes personal data when you visit our website or use the Rewily service (the “Service”). It also explains how we handle data received from Google Business Profile APIs.
1. Who we are
The Service is operated by [ЗАПОЛНИТЬ: LEGAL_NAME_EN], registration number [ЗАПОЛНИТЬ: REG_NUMBER], [ЗАПОЛНИТЬ: LEGAL_ADDRESS_EN], Republic of Belarus. We are the operator (controller) of the personal data described in this policy. For any privacy question, write to privacy@rewily.com.
2. Data we collect
2.1 Account data
When a user account is created for you, we store your email address and a salted hash of your password (never the password itself), the organizations you have access to, and session records. Session tokens are stored only as hashes and expire automatically. To protect accounts from password guessing, we temporarily use your IP address together with the email address to count failed sign-in attempts.
2.2 Business data from connected platforms
For the businesses connected to Rewily, we receive and store data from Yandex Business and, once available, Google Business Profile:
- business information: name, address, phone numbers, website and social links, category, opening hours, rating, number of reviews, profile status and photos;
- customer reviews: the reviewer's public display name, rating, review text and date, and the business's reply;
- edit requests you make in Rewily and the platform's moderation result.
Reviewer names and review texts are personal data of the reviewers. We process them only to let the business read and answer the reviews it received.
2.3 Content you create
Reply drafts, reply templates, and the history of when a reply was queued and published.
2.4 Communications
If you email us, we keep the correspondence to answer you and to provide the Service.
2.5 Website visits
Our public website does not use cookies, analytics or advertising trackers. Our hosting and network provider processes technical data such as IP address, browser type and request time to deliver the site and protect it from abuse.
3. How we use data
| Purpose | Data | Legal basis |
|---|---|---|
| Provide the Service: show reviews and business information, prepare and publish replies, submit and track edits | Account, business and content data | Performance of our agreement with you or the business you act for |
| Keep accounts secure and prevent abuse | Account data, IP address, logs | Our legitimate interest in a secure Service |
| Answer your requests and provide support | Communications | Performance of our agreement; your consent |
| Comply with the law | As required | Legal obligation |
We do not sell personal data, do not use it for advertising, and do not use it to build profiles of reviewers.
4. Google user data
4.1 What we access
Rewily accesses Google Business Profile data only through Google's official Business Profile APIs, and only for business profiles on which the owner has added Rewily's Google account as a Manager (or which you connect by signing in with Google and granting permission). Through these APIs we may access:
- the list of business accounts and locations the connected account can manage;
- business information for those locations: name, address, phone, website, categories, opening hours and similar profile fields;
- customer reviews for those locations, including the reviewer's public display name, rating, text and date, and existing replies.
We do not access Gmail, Google Drive, contacts, calendars or any other Google data through the Business Profile integration.
4.2 How we use it
- to show the business its profile information and reviews in Rewily;
- to update profile information when a person at the business requests the change;
- to publish review replies written or approved by a person at the business. Rewily does not publish automated or AI-generated replies without that approval.
We use Google user data only to provide and improve these user-facing features. We do not use it for advertising, do not sell it, and do not use it to train generalized AI or machine-learning models.
4.3 Sharing
We do not transfer Google user data to third parties, except to our infrastructure providers that host the Service on our behalf and under confidentiality obligations (see section 6), when required by law, or as part of a merger or acquisition with prior notice to you. Our staff do not read Google user data unless you ask us to (for example, for support), it is necessary for security or to comply with the law, or the data is aggregated and anonymized for internal operations.
4.4 Storage and retention
Content received from Google Business Profile APIs is stored on our servers only as long as needed to provide the Service and no longer than 30 days, in line with Google's Business Profile API policies. After that it is deleted or refreshed from the API. OAuth access tokens are stored encrypted in transit and at rest on our servers and are deleted when access is revoked.
4.5 Revoking access
You can end Rewily's access at any time by removing Rewily's account from the users of your Business Profile, or by revoking Rewily's permission at myaccount.google.com/permissions. After access is revoked we stop requesting data, and we delete the Google user data we hold for your business within 30 days — sooner if you ask us to (see section 8).
5. Yandex Business data
For Yandex Business, the owner of an organization adds Rewily's Yandex account as a representative. Rewily then reads the organization's information and reviews from the Yandex Business account and publishes replies and edits requested by a person at the business. We do not ask for the owner's Yandex password. Access ends when the owner removes Rewily's account from the organization's representatives.
6. Sharing and processors
We share personal data only with service providers that help us run the Service and only as needed for that purpose:
- Hosting providers that operate the servers and databases of the Service;
- Cloudflare, Inc., which hosts our public website and delivers it through its global network;
- Email providers that deliver our correspondence.
We may also disclose data when required by law or to protect the rights and safety of our users and the public. Where data is processed outside Republic of Belarus, we rely on the safeguards required by applicable law.
7. How long we keep data
| Data | Retention |
|---|---|
| Account data | While your account is active, then deleted within 30 days after it is closed |
| Content from Google Business Profile APIs | No longer than 30 days |
| Yandex Business data, reply drafts and templates | While the business uses Rewily, then deleted within 30 days after the business leaves or asks for deletion |
| Security logs and sign-in attempt counters | Up to 90 days |
| Correspondence | As long as needed to handle your request and meet legal requirements |
8. Deleting your data and revoking access
To delete your data:
- Remove Rewily's access in each platform (Google Business Profile users, Yandex Business representatives) and, for Google, at myaccount.google.com/permissions.
- Email privacy@rewily.com from the address linked to your account, naming the business whose data should be deleted.
We confirm your request and delete the data within 30 days, except where we must keep some of it by law.
9. Your rights
Depending on the law that applies to you — including the Law of the Republic of Belarus “On Personal Data Protection” — you may have the right to get information about and a copy of your personal data, to correct it, to withdraw consent, to object to processing, and to have your data deleted. To use any of these rights, write to privacy@rewily.com. We answer within 15 days. You may also complain to the data protection authority, in Belarus the National Personal Data Protection Center.
If you left a review about a business that uses Rewily and want it removed, please also contact the platform where you published it — only the author and the platform can remove a review.
10. Security
We protect data with HTTPS encryption in transit, salted password hashes, hashed and expiring session tokens, limits on failed sign-in attempts, access controls that let each user see only the organizations they were granted, and restricted administrative access to our servers. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as required by law.
11. Cookies and analytics
Our public website sets no cookies and runs no analytics. The Rewily application uses a strictly necessary session token to keep you signed in; it is not used for tracking.
12. Children
Rewily is a business tool and is not intended for people under 16. We do not knowingly collect data from children.
13. Changes to this policy
We will post any changes on this page and update the date at the top. If a change materially affects how we use your data, we will notify account holders by email before it takes effect.
14. Contact us
[ЗАПОЛНИТЬ: LEGAL_NAME_EN], [ЗАПОЛНИТЬ: LEGAL_ADDRESS_EN], Republic of Belarus
Privacy questions: privacy@rewily.com
General: hello@rewily.com