Privacy Policy

What information we collect

We collect the following categories of personal information:

• Shop owner information: your name, email address, phone number, and business details (business name, location, industry, staff names and services) provided during onboarding or in your settings.
• Sign-up enquiries: the name, email address, phone number and business details you send us through the form on concierly.co.
• Customer review data: the reviewer's name as it appears on the review platform (e.g. Google), their rating, and the text of their review.
• Customer contact information: the first names and phone numbers of your customers, and the service and date you provide, so we can send them review request SMS messages, plus the ratings and feedback they give in response. You are solely responsible for obtaining valid express consent from each customer under Canada's Anti-Spam Legislation (CASL) before providing their contact details to us.
• Google connection: access tokens that let us read your Google Business Profile reviews and post the replies you approve.
• Business analysis: checks of your website and Google Business Profile, your search rankings, and public information about nearby competitors.
• AI-generated content: draft responses generated by our system in response to customer reviews.
• Support requests and account activity: messages you send us through the app, and a log of actions taken in your account (such as approvals, edits, and replies posted automatically under a rule you turned on).
• Records of your agreement: when you accept our Terms of Service or give consent in the app (for example, to post replies automatically), we record what you agreed to, when, your account, and the IP address and browser you used. We keep these as evidence of your agreement for as long as your account exists.

Website analytics

Our marketing website (concierly.co) uses Google Analytics to understand visitor traffic and measure which pages and referral sources lead to signups. This collects pseudonymous usage data (e.g. pages viewed, approximate location, referring site) via cookies. We do not use Google Analytics for advertising or ad personalization, and this data is not linked to your shop owner account. You can opt out using your browser's cookie settings or a browser extension such as Google's Analytics Opt-out Add-on.

Why we collect it

We collect this information solely to provide our review response service — helping you draft, review, and publish replies to customer reviews. We do not sell personal information and do not use it for advertising purposes.

How your information is processed

When a customer review is received, the review text, the reviewer's first name and your business details are sent to the Anthropic API (Claude) to generate a draft response. We remove the reviewer's last name before sending anything to Anthropic, and from the SMS and email notifications we send you. Anthropic processes this data under its commercial terms and does not use it to train its models.

Each draft is then checked by TypeSafe for problems such as promising a refund, admitting fault or revealing private details. We send TypeSafe the draft, the review text without the reviewer's name, and your business details. TypeSafe does not use this data to train its models.

Review notifications and alerts are transmitted via Twilio, a third-party SMS provider, as part of the core service.

Data residency

Our database and files are stored in AWS Canada (ca-central-1), located in Montréal, Quebec. We have chosen this region specifically to keep data within Canada in support of PIPEDA compliance obligations.

Processing outside Canada

Some of the service providers listed below, including Anthropic, TypeSafe, Twilio, Resend, Stripe and Google, process data in the United States. When we send them information, it may be accessible to courts, law enforcement and national security authorities in the United States under its laws. We send each provider only what it needs to perform its part of the service, and we require them to protect it.

Third-party service providers

We share data with the following third parties only to the extent necessary to operate the service:

• Anthropic — AI processing of review text to generate draft responses.
• TypeSafe — AI quality checks on draft responses before they reach you.
• Twilio — SMS delivery for two purposes: (1) approval notifications and alerts sent to you as the business owner; and (2) review request messages sent to your customers' phone numbers that you provide (where you have obtained the required CASL consent).
• Resend — Email delivery (account, billing, review and support notifications).
• Stripe — Payment processing. We do not store payment card details; all billing data is handled by Stripe.
• Google — Google Business Profile API for review data and response publishing; Google Maps Places API for business location lookups.
• Amazon Web Services (AWS) — cloud infrastructure, database storage, and user authentication (AWS Cognito).

Data retention

Personal data associated with your account is retained for the duration of your subscription. If your account is suspended (for example after a cancellation or a failed payment), all data remains intact and your account can be reactivated. Accounts that remain suspended for 90 days are permanently deleted, after advance warnings by email. You can also ask us to delete your account at any time by writing to privacy@concierly.co; we will delete it within 30 days, except for records we are legally required to keep. Information we obtain from Google Maps about businesses is kept for no more than 30 days. Anonymized and aggregated platform data (containing no personal identifiers) may be retained indefinitely for service improvement purposes.

Your rights under PIPEDA

Under PIPEDA, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete personal information.
• Request deletion of your personal information, subject to legal and contractual obligations.
• Withdraw consent to our handling of your information, subject to legal and contractual restrictions. Without it, we may not be able to provide the service.

To exercise any of these rights, please contact us at privacy@concierly.co. We will respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.

Contact

For any privacy-related questions or concerns, please contact our privacy officer at privacy@concierly.co.