Privacy Policy

Last updated: September 2026

1. Information we collect

Account information (email, password hash); business information you give us (business name, location names, Google Business Profile / Yelp identifiers); review content pulled from Google and Yelp on your behalf; customer lists you upload for win-back outreach (name, email, phone, last-visit date); your own phone number, if you opt in to text message alerts about your account; and basic usage data about how you use the dashboard.

2. How we use it

To operate the service you signed up for: fetching and tagging your reviews, drafting reply suggestions, generating your periodic report, sending win-back emails on your behalf, processing billing, and improving the product. We don't use your customer lists or review content to train models we sell to anyone else.

Win-back emails are sent to your past customers on your behalf, and each one includes your business's postal address and an unsubscribe link. Anyone who unsubscribes is never emailed again by that business, and we record only their email address and the business's account so that the choice is remembered.

3. Third-party services we use

Google Business Profile API and Yelp Fusion API (to read your reviews); Anthropic's Claude API (to tag sentiment/topic and draft replies and reports — review text is sent to Anthropic for this processing); Stripe (to process payments — we don't store your card number ourselves); Resend (to send transactional and win-back emails); and Plausible Analytics (privacy-focused, cookieless site analytics on our marketing pages). Each handles data under its own privacy policy.

4. Cookies and browser storage

HearBack sets one cookie of its own: a session cookie that keeps you signed in. It is created when you create an account or sign in, is only readable by our servers (it is "HttpOnly"), is only sent to HearBack (SameSite), is marked Secure so it travels only over HTTPS, and expires after 30 days or when you sign out, whichever comes first. It holds a random identifier, not your email or password. We do not use it for advertising or to track you across other sites.

Because this cookie is strictly necessary to keep you signed in, we do not show a cookie banner for it. If you block it in your browser you will not be able to stay signed in.

Your browser's own storage (which stays on your device and is not sent to us) is used for conveniences: your light or dark theme choice, saved review filters, saved reply phrases, drafts of reply edits, the referral code from a link you followed, and a promo code while you check out. You can clear these any time in your browser settings. Plausible Analytics does not use cookies. When you enter payment details, Stripe's own scripts may set cookies to prevent fraud; those are governed by Stripe's policy.

5. Data retention

We keep your account and review data for as long as your account is active. If you close your account, we delete your business data within 90 days except where we're required to keep records (e.g. billing history) longer.

6. Data sharing

We don't sell your data. We share it only with the service providers listed above, as needed to run the product, and when required by law.

Your phone number and your SMS opt-in status are never shared with third parties or affiliates for marketing purposes.

7. Your rights

You can request a copy of your data, ask us to delete it, or ask us to stop processing it, by emailing us at the address below. If you've uploaded customer contact information, you're responsible for having the right to use it for outreach and for handling requests from your own customers about their data.

8. Security

Passwords are hashed (never stored in plain text). Access to production data is limited to what's needed to operate the service. No system is perfectly secure, and we can't guarantee absolute security of information you send us.

9. Children's privacy

HearBack is a business tool and isn't directed at children. We don't knowingly collect data from anyone under 16.

10. Changes to this policy

We'll update the date above if this policy changes and, for material changes, let you know via email.

11. Contact

Questions about this policy or your data: privacy@hearback.ai