Privacy Policy | Reputfy

Last updated: 21 October 2026

The short version

We collect only what we need to run reviews, sealing and the business tools.
We never sell personal data.
Reviewers choose the name shown publicly. We never give reviewers' contact details to businesses.
Only fingerprints of reviews are written to a public blockchain, never the reviews or anyone's personal details.

1. What we collect

If you write reviews

Your account identifier from sign-in.
The display name you choose, your reviews, ratings, the month of your visit and the time you posted.
Any messages you send us.

If you use Reputfy for a business

Business details: name, town, category, and the platforms you connect.
Reviews you import or receive, your replies, reply drafts and settings such as brand voice.
Claim and seal records, including how we verified ownership.
Billing records from Stripe, such as plan, amount and status. We do not receive full card numbers.

Automatically

Small values stored in your browser to remember preferences, such as the homepage design you were shown and a draft display name. We do not use advertising cookies.
Basic page interaction counts used to compare homepage designs, linked to your account identifier only if you are signed in.

2. How we use it

To publish and seal reviews and show them on business pages. (Performing our service, and our legitimate interest in trustworthy reviews.)
To verify business owners and issue or revoke seals.
To provide business tools, including generating reply drafts.
To take payments and keep financial records. (Contract and legal obligation.)
To prevent fake reviews, abuse and fraud.
To answer your messages and improve the service.

The public: reviews, display names, ratings and business replies are public by design.
Businesses: see reviews about them and the display name only.
Stripe: processes payments under its own privacy policy.
Anthropic: our hosting and AI provider. Our site runs on Claude, and reply drafts are generated by Claude when a business asks for one.
Google Fonts: our pages load typefaces from Google, which receives your IP address when fonts load.
OpenTimestamps and the Bitcoin blockchain: receive only fingerprints (hashes) of batches of reviews. A fingerprint cannot be turned back into the review.
Authorities: only when the law requires it.

4. How long we keep it

Reviews stay up until the author or a moderator removes them.
Business workspace data is kept while the account is active and deleted within 90 days of closure, except billing records we must keep by law.
Fingerprints already anchored in public cannot be removed, but reveal nothing on their own.

5. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict some uses, and to complain to your data protection authority. California residents have rights under the CCPA and CPRA, including to know and delete personal information, and we do not sell or share personal information for cross-context advertising. To use any of these rights, contact us from the account concerned.

6. Compliance

Our current status for the standards customers ask about most. We only list a certification here once it has been issued by an independent auditor.

7. Security

Access to stored data is controlled by account and role. Private business workspace data can only be read by the account that owns it. No system is perfectly secure, and we will tell affected users promptly if a breach puts their data at risk.

8. Children

Reputfy is not meant for anyone under 16, and we do not knowingly collect their data.

9. Changes

We will post updates here and, for significant changes, tell signed-in users before they take effect.