This is a translation provided for convenience. In the event of any discrepancy, the Spanish version prevails. You can switch to it with the language menu above.
Privacy policy
This policy explains how Repoo processes personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).
1. Data controller
- Controller: kinki.dev, trading name of Evaristo Gundin (natural person, self-employed) · tax ID 45563737R
- Address: C/ Los Lirios 7, 03186 Torrevieja (Alicante), Spain
- Privacy contact: hola@repoo.app
2. Two kinds of data, two different roles
Our users' data (the people and businesses that sign up to Repoo): Repoo is the controller of that processing, which this policy describes.
Review data (the author's public name, rating and text of the Google reviews the business receives): the controller is the user business, and Repoo processes them solely on its behalf and following its instructions, as a data processor (article 28 GDPR). The conditions of that agreement are in section 10 of the Terms and conditions.
3. What data we process
- Account: email, your name (the one on your Google account or the one you choose in Settings), business name and, where applicable, billing details when you subscribe to a paid plan. Your card details are collected and stored directly by our payment provider (Stripe); we never see them.
- Google connection: email of the connected Google account, an access token (stored encrypted) and the data from your Business Profile listings: name, address, reviews and replies.
- Content you create: tone settings and business details, draft replies and published replies.
- Technical data: access and error logs needed for the security and operation of the service.
- Visit statistics: anonymous, aggregated data about how the website is used (pages viewed, country, device type, browser and referring page), collected with Vercel Web Analytics without cookies and without identifying you.
4. What we use it for and on what legal basis
| Purpose | Legal basis (art. 6 GDPR) |
|---|---|
| Creating and managing your account, providing the service and giving you support | Performance of the contract (6.1.b) |
| Reading your Google reviews and publishing the replies you approve | Performance of the contract (6.1.b) |
| Generating draft replies using artificial intelligence | Performance of the contract (6.1.b) |
| Analysing your reviews (topics and sentiment) and suggesting advice in the Reputation section | Performance of the contract (6.1.b) |
| Charging for your subscription or the packs you buy | Performance of the contract (6.1.b) |
| Sending you service emails: sign-in, notifications of new reviews (you can choose which ones or turn them off in General settings), a notice if the connection with Google is lost, and significant changes | Performance of the contract (6.1.b) |
| Measuring visits to the website anonymously and in aggregate in order to improve it (without cookies) | Legitimate interest (6.1.f) |
| Security, abuse prevention and technical improvement of the service | Legitimate interest (6.1.f) |
| Invoicing and tax and accounting obligations | Legal obligation (6.1.c) |
| Marketing communications, only if you expressly accept them | Consent (6.1.a), which can be withdrawn at any time |
No automated decisions: the AI only proposes drafts. No reply is published without you reviewing and approving it, so we do not make decisions based solely on automated processing that have legal effects on you (article 22 GDPR).
5. Use of Google data
Repoo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We only use that data to show you your reviews, prepare drafts and publish your replies.
- We do not sell it or use it for advertising.
- We do not use it to train artificial intelligence models.
- Nobody reads it except with your permission, for security reasons or to comply with the law.
- You can disconnect your Google account at any time from General settings or from your Google account settings.
6. Artificial intelligence
To generate drafts we send our AI provider the text and rating of the review, the tone settings and details of your business, and some previous replies as examples. By default the author's name is replaced with “Customer” before sending. On plans with Reputation, we also send the text and rating of each review (without the author's name) to classify its topics and sentiment, and aggregated figures about your reviews to suggest advice. For businesses with healthcare mode turned on we only store the topic of each comment, not its detail. Under its commercial terms, the provider does not use data received through its API to train its models.
7. Recipients and data processors
We do not share your data with third parties unless legally required. To provide the service we use these providers:
| Provider | Service | Location |
|---|---|---|
| Supabase Inc. | Database, authentication and sign-in emails | Servers in the EU (Ireland) |
| Vercel Inc. | Application hosting and anonymous visit statistics (Web Analytics) | Runs in the EU (Dublin); company in the US |
| Anthropic PBC | Draft replies and review analysis using AI | US |
| Google LLC | Business Profile APIs and sign-in with Google | EU and US |
| Cloudflare Inc. | DNS and forwarding of the contact email | Global network; company in the US |
| Stripe Payments Europe, Ltd. | Payments, subscriptions and invoices (including card details) | EU (Ireland); group based in the US |
| Lettermint | Sending notification emails | EU |
When a provider processes data outside the European Economic Area, the transfer is covered by appropriate safeguards: the provider's participation in the EU-US Data Privacy Framework and/or the standard contractual clauses approved by the European Commission.
8. How long we keep it
- Account data and content: for as long as your account is active.
- After you close your account, we delete it within 30 days at most, except for what we must keep by legal obligation (for example, invoices, for the periods set by tax and commercial law).
- Google token: until you disconnect the account or close your account.
- Technical logs: 12 months at most.
9. Security
We apply appropriate technical and organisational measures: encrypted connections (HTTPS), encryption of Google tokens, strict separation of each customer's data in the database and restricted access to systems.
10. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent where that is the basis for processing, by writing to hola@repoo.app. We will reply within one month at most.
If you believe we have not dealt with your request properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).
If you are the author of a review and want to exercise your rights over it, contact the business reviewed, which is the controller of that processing; if you write to us, we will pass your request on to it.
11. Minors
Repoo is a service for professionals and businesses and is not aimed at anyone under 18.
12. Changes to this policy
We may update this policy to reflect legal changes or changes to the service. If the changes are significant, we will let you know by email or within the application.
Last updated: 10 October 2026.