Privacy Policy

Effective date: October 16, 2026

1. Who we are

Replibox is a product of Johnson Marketing and Consulting Group ("JMCG," "we," "us," or "our"), offered at replibox.com. This Privacy Policy describes how we collect, use, store, and share information when you use Replibox.

Questions: cody@johnsonmarketingandconsulting.com. A dedicated support@replibox.com inbox will be added later.

2. Google user data we access

Replibox uses Google sign-in and the Google Business Profile API. With your authorization we access:

Google sign-in (identity)

Name
Email address
Profile picture

Google Business Profile (`https://www.googleapis.com/auth/business.manage`)

Business locations you select
Google reviews on those locations (including rating, text, reviewer display name, and timestamps)
Existing replies and the ability to create or update replies on your behalf

We request only the scopes needed to show your reviews and post replies you configure. We do not access Gmail, Drive, Calendar, Ads, or other Google products.

3. How we use Google user data

Google user data is used only to:

Create and authenticate your Replibox account
Display your selected locations and their Google reviews in the app
Generate AI replies from your preferences and post them to Google Business Profile when you have configured auto-post (4–5 star reviews) or after you approve a held reply (1–3 star reviews)

We do not use Google user data for advertising, credit decisions, or any purpose other than providing and improving these user-facing Replibox features.

4. Other information we collect

Account and billing: organization name, plan, trial dates, and payment details processed by Stripe (we do not store full card numbers)
App configuration: AI tone, length, and auto-post preferences you set
Usage and device: pages viewed, approximate IP, browser, and error logs needed to run and secure the Service

5. Storage and security

Data is stored in Supabase (hosted Postgres and Auth). Google OAuth refresh tokens are encrypted at rest before they are saved. Access is limited to systems that need it to operate Replibox. Transmission uses HTTPS. No method of storage is perfectly secure.

6. Sharing

We do not sell your personal information or Google user data.

We share data only as needed to run the Service:

AI provider: review text and your reply preferences are sent so we can generate a draft reply. The provider processes that text for reply generation; it is not sold.
Processors: Vercel (hosting), Supabase (database, auth, and storage), and Stripe (billing)
Google: replies you authorize are posted back to Google Business Profile
Legal: if required by law or to protect JMCG or our users

7. Google API Services User Data Policy / Limited Use

Replibox's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

Google user data is used only to provide or improve user-facing features that are prominent in the Replibox interface
We do not use Google user data to serve ads
We do not allow humans to read Google user data unless you ask us to (for example, support), it is necessary for security or legal compliance, or the data is aggregated and no longer identifiable
We do not transfer Google user data to third parties except as needed to provide or improve those features (such as our AI provider processing review text to generate a reply), as required for security or law, or as part of a merger or acquisition with notice

8. Retention and deletion

We keep account, location, review, reply, and encrypted token data while your account is active so the Service can function.

To stop Google access and delete data:

Disconnect Google in Replibox settings (when available) or email us to disconnect your Google Business Profile connection
Email cody@johnsonmarketingandconsulting.com to request deletion of your Replibox account and associated Google user data. We will delete or anonymize that data within 30 days unless we must keep a limited record for legal, tax, or security reasons

9. Revoking Google access

You can revoke Replibox's access to your Google Account at any time in Google Account permissions. After you revoke access, we can no longer read reviews or post replies until you connect Google again. Email us if you also want stored Google data deleted.

10. Cookies

We use cookies and similar storage to keep you signed in, protect the session, and remember basic preferences. You can block cookies in your browser; the app will not work correctly without the session cookie.

11. Children

Replibox is a business tool. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

12. Changes

We may update this Privacy Policy. The effective date at the top of this page will change when we do. Material changes will be posted here and, where appropriate, we will also notify you by email or in the product.

13. Contact

Johnson Marketing and Consulting Group (JMCG)
Product: Replibox (replibox.com)
Email: cody@johnsonmarketingandconsulting.com
Future support inbox: support@replibox.com