Privacy Policy

Effective: 7 May 2025 · Last updated: 9 October 2026

In plain language

We collect only what we need to run LuxeReply: your account details, your business locations, and the reviews you connect. We use them to draft and manage your replies. We never sell your data or use it for advertising, Google data is handled strictly under Google's Limited Use Policy, analytics cookies run only if you allow them, and you can ask us to show, correct or delete your data at any time at [email protected].

This summary is for convenience only. The numbered sections below are the full policy.

About this policy

At LuxeReply, your privacy is important to us. LuxeReply ("we", "our", or "us") operates the website www.luxereply.com and provides the LuxeReply platform ("Service"). This Privacy Policy explains how we collect, use, share and protect your information, and outlines your rights and choices under applicable data protection laws, including the EU GDPR, UK GDPR, and other international laws.

What Data We Collect

We may collect and process the following personal data:

- Contact information: name, email address, company name
- Business information: property names, locations, and settings
- Platform activity: AI-generated replies, communication logs, review content
- Technical data: IP addresses, browser type, device information, usage logs, some of which may be collected automatically when you use our services
- Analytics data: collected via Google Analytics, and only if you have given your consent
- Consent record: an anonymous record of the cookie choice you made. It contains no IP address, no name and no email, and it is not linked to any account (see section 4)

We do not knowingly collect sensitive personal data, such as health information, financial details, or biometric data.

Use of Google APIs and Third-Party Services

If you choose to sign in with Google or connect third-party services such as Google Business Profile, LuxeReply may request access to certain account data through official APIs, including:

Your name and email address
Google Business Profile information (e.g., business name, location, reviews)
Gmail, send only, if you connect it for a location: to send the feedback requests you choose from your own address. We cannot read, search or delete your email, and we do not store the messages.
Google Calendar, read and add events, if you connect it for a location: we see the list of your calendars so you can choose one, read its appointments to fill your list of customers to ask for feedback, and add the bookings you confirm. We do not store your appointments.

We use this data exclusively to deliver LuxeReply's core functionality: helping you manage, analyze, and respond to customer reviews more efficiently using AI-generated suggestions, sending the feedback requests you choose, and reading and adding the calendar appointments you work with.

We do not use this data for advertising, profiling, or any unrelated purposes.
We do not transfer your Google data to third parties, other than the sub-processors listed in section 5, who act on our documented instructions and only to operate the Service, or where required by law.
We do not store review content or account information beyond what is necessary to operate the Service.

Access to Google services is handled through the OAuth 2.0 protocol. When connecting your Google account, you will see a Google-hosted consent screen detailing the specific permissions requested. You are free to grant or deny access. You can also revoke access at any time via your Google Account settings. Disconnecting Gmail or Google Calendar in LuxeReply revokes the access and deletes the stored connection at once.

In compliance with Google's Limited Use Policy, any data obtained through Google APIs:

Is used only to provide or improve features directly related to your use of LuxeReply
Is not used for serving ads
Is not used to develop, train or improve generalised AI or machine learning models, whether ours or a third party's. Where review text is sent to our AI sub-processor to draft a reply, it is processed to generate that reply only, and the account's own tone settings and past edits are used solely within that account.
Is not read by humans unless absolutely necessary (e.g., for debugging with your permission, compliance, or legal purposes)

We may expand integrations with additional services in the future, in which case similar standards of data privacy, access transparency, and revocability will apply.

Facebook and Instagram (Meta)

If you connect a Facebook Page in LuxeReply, you sign in with Facebook and choose which Pages LuxeReply may use. Through Meta's official APIs we then receive and store:

Your Facebook user ID and name
The names and IDs of the Pages you choose and of the Instagram professional accounts linked to them, and the access keys (tokens) Meta issues for them
The recommendations people leave on those Pages: the text, whether they recommend or not, and the date
The replies and posts you publish from LuxeReply, their Facebook and Instagram IDs, and the number of reactions and comments they receive

We use this data only to show your Pages' recommendations in LuxeReply, to draft replies for you to approve (the recommendation text is sent to our AI sub-processor to write that reply only), to publish the replies and posts you choose to your Page or Instagram account, and to show you how they perform. LuxeReply publishes only when you press Publish. We do not sell this data, use it for advertising, or share it beyond the sub-processors listed in section 5.

How to delete it: remove LuxeReply in your Facebook settings (Settings & privacy › Settings › Business integrations) and ask for its data to be deleted. Meta tells us at once, and we delete everything we received through that connection: the connection, its Pages, their recommendations, your replies and the records of your posts. You will get a confirmation code and a page that shows the status of your request. You can also ask for deletion by email at [email protected].

Manage Google permissions →Google API Services User Data Policy →Manage Facebook business integrations →Facebook data deletion →

How We Use Your Data

We use your data to:

Deliver and operate our service
Generate AI-powered review responses
Provide analytics, insights, and reports
Communicate with you (e.g., for support, billing, and updates)
Monitor platform usage and improve our services
Comply with legal obligations

We process personal data only when we have a valid legal basis, which may include:

Performance of a contract (to provide and maintain our services)
Compliance with legal obligations
Legitimate interests (such as improving and securing our services)
Consent (for marketing communications or cookie tracking, when applicable)

If you choose to link external services like Google Business Profile, we use the retrieved data solely to support your review response workflows, based on your direct actions.

Cookies and Consent Management

When you first visit luxereply.com we ask you to choose which cookies we may use. You can accept all, reject all, or choose per category, and you can change your choice at any time from the privacy button at the bottom left of every page.

Rejecting costs you nothing. The site works the same either way.

Essential (always on)
These keep the site working and secure. They do not need your consent, because without them the service you asked for cannot be delivered.
- Cloudflare Turnstile (Cloudflare, Inc.): protects our forms from automated abuse. Duration: the visit only.
- Cloudflare Web Analytics (Cloudflare, Inc.): counts visits and page performance without cookies and without profiling you. Nothing is stored on your device.
- Consent cookie (lr_consent, LuxeReply): remembers the choice you made, so we stop asking. Duration: 6 months.

Analytics (only with your consent)
- Google Analytics 4 (_ga, _ga_*), Google Ireland Limited: shows us how visitors find and use the site, as totals rather than individuals. Duration: up to 2 years.
If you reject, Google Analytics does not run and these cookies are deleted. Google may process this data outside the European Economic Area, under the European Commission's standard contractual clauses.

We do not use cookies for advertising or behavioural profiling.

Record of your consent
To show that we asked properly, we keep a record of each choice. It contains a random identifier created in your browser, the date and time, which categories you accepted or rejected, the version of the banner you were shown, the language you read it in, and the two letter country code of your connection.
It does not contain your IP address, your name or your email, and it is not linked to any account. The record is stored by Cloudflare, Inc. in the European Union and is deleted after 3 years. Legal basis: our legal obligation to demonstrate consent under Article 7(1) GDPR.

We ask again every 6 months, and straight away if we add a service or change what the banner says.

Note: we do not keep a separate cookie policy page. This section lists every cookie we use, and the same information is available at any time from the privacy button at the bottom left of every page.

Who We Share Data With

We may share your data with:

Authorized sub-processors (such as hosting providers, analytics services, and email delivery partners) under strict GDPR-compliant agreements
Regulatory bodies or authorities when required by law
Other third parties only with your explicit consent

We only share your data with trusted third parties who are contractually obligated to protect your data and use it solely to provide their services to us.

Our current sub-processors include: Xano (backend infrastructure and database hosting), WeWeb (web application hosting), OpenAI (AI-assisted reply drafting), Google LLC (Google Business Profile API, and Gemini for AI-assisted reply drafting), Google Ireland Limited (Google Analytics, only with your consent), Stripe (payment processing), Resend (transactional email delivery), and Cloudflare, Inc. (bot protection on our forms, cookieless web analytics, and storage of the cookie consent record in the European Union).

For integrations with Google APIs or similar services, we do not share accessed data with any third party unless required by law or explicitly requested by you.

You may request a current list of our sub-processors by contacting us at [email protected].

International Transfers

If personal data is transferred outside the European Economic Area (EEA), United Kingdom, or Switzerland, we ensure adequate protection by using:

EU Standard Contractual Clauses (SCCs)
UK Addendum or other equivalent safeguards

These measures guarantee that your data is protected in compliance with applicable data protection laws.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy or to comply with legal obligations. Once data is no longer required, it is securely deleted or anonymized.

When you close your account, or when a subscription ends and you request deletion, your data is deleted in accordance with our Data Processing Agreement.

The record of your cookie choice is kept for 3 years and is then deleted automatically, because that is how long we may need to demonstrate that consent. See section 4.

Your Rights

You have the right to:

Access your personal data
Correct inaccurate or incomplete data
Request deletion of your data ("right to be forgotten")
Object to or request restriction of processing
Withdraw consent where processing is based on consent
Request data portability in applicable cases

You can change or withdraw your cookie choice at any time, and just as easily as you gave it, from the privacy button at the bottom left of every page.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days as required by applicable laws. You also have the right to lodge a complaint with your local supervisory authority (in Greece, the Hellenic Data Protection Authority).

Children's Privacy

LuxeReply is not intended for children under the age of 18. We do not knowingly collect personal data from children under this age.

Security

We implement appropriate technical and organizational measures to protect your data, including:

Data encryption in transit and at rest
Role-based access controls
Activity monitoring and logging
Regular audits and updates

Legal Basis for Processing (GDPR)

We process your data under the following legal grounds:

Contractual necessity (providing our service)
Compliance with legal obligations
Legitimate interests (service improvement, security)
Consent (for example analytics cookies or newsletters), together with our legal obligation under Article 7(1) GDPR to keep a record of the consent you gave

Where integrations such as Google Business Profile are used, processing is based on your explicit consent given during the OAuth connection flow.

GDPR Compliance

LuxeReply complies with the General Data Protection Regulation (GDPR) as a Data Processor acting on behalf of our clients (the Data Controllers). We process personal data solely based on documented instructions, apply appropriate safeguards, and ensure the rights of data subjects are protected.

For more details, please review our Data Processing Agreement (DPA) or contact us at [email protected] to exercise your rights under GDPR.

Read the full Data Processing Agreement →

Links to Other Websites

Our site may contain links to third-party platforms. We are not responsible for the privacy practices of those sites.

Changes to This Policy

We may update this Privacy Policy from time to time. You will be notified of material changes via email or platform notifications. Continued use of LuxeReply after such updates constitutes acceptance.

Electronic Acceptance

If you process personal data through our services, our Data Processing Agreement (DPA) applies and is incorporated by reference into this Privacy Policy and our Terms of Service. It governs how we handle personal data on your behalf and is available for review on request or at signup.

Bot Protection (Cloudflare Turnstile)

To protect our sign-up and sign-in forms from automated abuse, we use Cloudflare Turnstile, a service provided by Cloudflare, Inc. Turnstile runs invisibly in your browser and analyses technical signals, such as your IP address, browser and device characteristics, and interaction patterns, in order to tell genuine people apart from automated scripts. It is not used to build an advertising profile of you, and it does not track you across other websites.

Cloudflare processes this data on our behalf as our processor, under the Cloudflare Turnstile Privacy Addendum, which is incorporated into this Policy by reference. Our legal basis is our legitimate interest in keeping the service secure and available to genuine users (Article 6(1)(f) GDPR).