Privacy Policy - AfterSay

1. Scope and our role

AfterSay is a business service used by companies and professionals to manage reputation, request reviews and testimonials, respond to reviews, receive private feedback, publish approved testimonials, and understand reputation-related activity.

For account, billing, security, support, product-usage, and AfterSay's own business operations, AfterSay determines why and how personal information is processed. For customer information, review-request information, testimonial requests, private feedback, and similar information a business submits to the Service, the business customer generally determines the purpose of the processing and AfterSay processes that information to provide the Service. If you received a request or submitted information through one of our business customers, questions about that business's own use of your information should generally be directed to that business.

2. Information we collect

Account and team information

We may collect names, email addresses, team or business names, authentication information, account preferences, team membership, invitations, and information you provide when contacting support.

Billing information

Payments are processed by Stripe. We may receive billing status, subscription details, payment-method type, the last four digits of a payment method, invoices, and transaction identifiers. We do not receive or store complete payment-card numbers.

Business and customer information

Businesses may submit customer names, email addresses, phone numbers, external customer references, notes, and other information needed to send requests or manage customer relationships. We also process delivery and interaction information associated with requests, such as whether a request was sent, clicked, completed, opted out, or failed.

Reviews, replies, private feedback, and recovery information

We process review content, star ratings, review-author information provided by connected services, business replies, AI-generated reply drafts, private feedback, recovery status, internal notes, assignments, and follow-up information where those features are used.

Testimonials and photos

When a testimonial is requested or submitted, we may process the testimonial text, submitter name, display preference, contact information, consent to publish, and an optional photo. Businesses may also manually add testimonials. Publicly published testimonials or photos may be visible to anyone through AfterSay-hosted pages, widgets, or the business's own website.

Google-connected information

If a business connects Google, we may access and process information necessary to provide the connected features, including Google Business Profile account and location identifiers, business profile information, reviews and replies, review counts and ratings, performance metrics, search-keyword metrics where available, OAuth tokens, and related synchronization metadata. We may also use Google Places data, including Place IDs and public business information, to support competitor benchmarking and business lookup features.

AI feature inputs and outputs

When AI-assisted features are used, AfterSay may send the minimum content reasonably needed to generate the requested result to our AI service provider. This can include review text, star rating, business context, testimonial or feedback text, and structured reputation facts. We also may record limited usage metadata such as model, feature, token counts, and timestamp for cost and reliability monitoring.

Technical and usage information

We may collect IP address, browser and device information, timestamps, request and error logs, security events, pages or features used, and other diagnostic information needed to secure, maintain, and improve the Service.

Cookies and local storage

We use cookies and similar browser storage that are necessary for authentication, security, session management, preferences, and operation of the Service. If we introduce optional analytics or advertising technologies, we will update our disclosures and provide controls where required by law.

3. How we use information

We use information to:

provide, operate, maintain, secure, and improve the Service;
authenticate users and manage teams, permissions, and subscriptions;
send review and testimonial requests on behalf of business customers;
synchronize reviews, replies, business profile data, and performance information from connected services;
generate AI-assisted review replies, summaries, captions, follow-up suggestions, and other requested content;
manage private feedback, customer recovery workflows, testimonials, and public widgets;
calculate reputation metrics, recommendations, and competitor comparisons;
process billing and manage subscriptions;
provide support and communicate about service, security, billing, and material product changes;
detect fraud, abuse, unauthorized access, and violations of our Terms; and
comply with law, enforce agreements, and protect the rights and safety of AfterSay, our customers, and others.

4. Google API data

When you connect a Google account or Google Business Profile, you authorize AfterSay to access the Google data needed for the features you choose to use. We use that information only to provide and improve user-facing AfterSay features, such as displaying and responding to reviews, synchronizing business locations, reporting Business Profile performance, and managing connected reputation workflows.

We do not sell Google user data, use it for targeted advertising, or transfer it to data brokers. We may disclose it to service providers only when reasonably necessary to provide or secure the features you use, or when required by law. OAuth credentials and tokens are treated as sensitive authentication information and are not made public.

AfterSay's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements where applicable.

You can disconnect Google from AfterSay at any time through the Service. You may also revoke AfterSay's access through your Google account. Disconnecting may disable features that depend on Google data.

5. AI processing

AfterSay uses OpenAI's API to power certain AI-assisted features. We send only the information reasonably needed to produce the requested output. OpenAI states that business and API data is not used to train its models by default. OpenAI may process and retain API data according to its then-current service terms, security practices, and retention settings.

AI-generated content can be inaccurate or inappropriate. AfterSay may offer automated publishing features when a business enables them, but the business remains responsible for its settings and for content published on its behalf.

6. How we disclose information

We may disclose information in the following circumstances:

Service providers. We use vendors that help us host infrastructure, send email, process payments, provide AI functionality, store files, monitor reliability, and otherwise operate the Service. They receive only the information reasonably needed to perform their services.
Business customers and team members. Information submitted through a business customer's requests or workflows is made available to authorized members of that business's AfterSay team.
Public publishing at your direction. Testimonials, photos, review widgets, or other content a business chooses to publish may become publicly accessible.
Legal and safety reasons. We may disclose information when reasonably necessary to comply with law, respond to valid legal process, prevent fraud or abuse, investigate security incidents, or protect rights and safety.
Business transfers. Information may be transferred as part of a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business, subject to applicable law and contractual obligations.
With your direction or consent. We may disclose information when you ask us to or otherwise consent.

We do not sell personal information or Google user data, and we do not share personal information for cross-context behavioral advertising.

7. Data retention

We retain information for as long as reasonably necessary to provide the Service, maintain security and business records, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary by data type and how the Service is used.

Business customers can delete many records directly in AfterSay. When an account, team, request, connection, or other record is deleted, related information may be removed or deidentified according to the Service's behavior and our legal obligations. Limited copies may remain temporarily in backups, logs, fraud-prevention systems, or records we are legally required to retain.

Google-sourced content and Google Places information are refreshed, cached, retained, or deleted in accordance with the applicable Google terms and policies. OAuth tokens are retained only while needed to maintain the connection or as otherwise required for security and recordkeeping.

8. Security

We use administrative, technical, and organizational safeguards designed to protect information, including encrypted network transport, access controls, secure credential handling, and monitoring. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. You are responsible for protecting your account credentials and controlling access to your team.

9. Your choices and privacy rights

Depending on where you live, you may have rights to access, correct, delete, receive a copy of, restrict, or object to certain processing of your personal information. You may also have the right to withdraw consent where processing is based on consent. We will honor applicable rights subject to verification and legal exceptions.

Account holders can update certain information in the Service and can delete their account or team where those controls are available. Businesses can also remove customers, requests, testimonials, and connected services through the product.

If your information was submitted to AfterSay by one of our business customers, that business may be the appropriate party to handle your request. You may contact the business directly or contact us and we will assist as appropriate.

Review and testimonial request recipients can use available opt-out or unsubscribe controls. Service, billing, security, and account messages are not marketing messages and may still be sent when necessary.

10. International use

AfterSay is operated from the United States. If you access the Service from another country, your information may be transferred to and processed in the United States and other countries where our service providers operate. Where required, we use appropriate legal mechanisms for international transfers.

11. Children's privacy

AfterSay is a commercial service intended for businesses and professionals and is not intended for children. Account holders must be at least 18 years old. We do not knowingly collect personal information directly from children through account registration. If you believe a child has provided personal information to us improperly, contact us so we can investigate and take appropriate action.

12. Changes to this policy

We may update this Privacy Policy as AfterSay changes. We will post the updated version here and revise the effective date. If a change materially affects how we use information already collected, we will provide additional notice or request consent where required by law or applicable platform policy.

13. Contact us

AfterSay is operated by Code Wize Technologies LLC, a Florida limited liability company.

Privacy questions or requests: privacy@aftersay.app

General support: support@aftersay.app