Privacy Policy

Last updated: October 4, 2026

This Privacy Policy explains what information Metis Reply ("we," "us," or "our"), operated by Buried Fables LLC, collects when you use the Service, how we use it, and the choices you have.

1. Information We Collect

• Account information: business name, email address, and password (stored as a salted hash, never in plain text). If you turn on two-factor login, we also store the authenticator registration used to check your codes.
• Invite requests: if you request an invite, your name, business name, email address and any message you include. We use them only to review your request and contact you about it.
• Business content: reviews you add or forward, the responses you approve or edit, and any custom instructions or tone settings you configure.
• Email content: if you use email-based review intake or reply-based approval, the content of emails sent to or from your dedicated inbox address.
• Payment information: handled entirely by Stripe, our payment processor — we never receive or store your full card number.
• Usage and log data: basic technical data (timestamps, actions taken, browser type, and error details) used for security, debugging, and abuse prevention. For rate limits we keep only a scrambled (one-way hashed) form of your IP address, for two days.
• Issue reports and feature requests: descriptions and optional screenshots you submit through "Report a problem" or "Request a feature".
• Team members: if you invite teammates, their email address, role, who invited them, and a record of their actions on your account (for example, who approved a response).
• Homepage preview: if you try the "Try it with a real review" box without an account, the review you paste is sent to our AI provider to write the sample reply. We don't save it.
• Support assistant: questions you ask the in-app support assistant and its answers, kept so each person can see their own conversation history.

2. How We Use Information

• To operate the Service: generate AI response drafts, deliver notifications, and process billing.
• To keep the Service secure, enforce data isolation between customer accounts, and enforce our Terms of Service, including investigating suspected abuse (such as fake reviews, fraud, or attempts to misuse the AI).
• To respond to support requests, issue reports and feature requests. When needed to help you or to keep the Service secure, our staff can view your account's information, including reviews, drafts and screenshots you sent us, and can view your account as you see it, read-only. Each of these views is recorded in our internal audit log.
• To email you about your account: responses ready for approval, usage-limit notices, the weekly summary, the monthly report (Premium and Enterprise), and billing events. We may also send important notices about your service (such as price or terms changes) and, unless you opt out, occasional product news. Every optional email includes an unsubscribe link, and you can choose which ones to receive in Settings. Announcements may also appear as a banner in the app.
• If you turn on the website badge, to show a public image with your reply counts (for example, the share of reviews you've replied to). It never includes review text, reviewer names or star ratings, and you can turn it off at any time.
• If you turn on the testimonial wall (Premium and Enterprise), to show the reviews you pick on your website: the review text, star rating, platform, and the reviewer's first name and last initial, plus your average rating and reply rate. Only reviews you choose are shown, and you can remove them or turn the wall off at any time. Spotlight images use the same first name and last initial and are only created when you download them.
• On Enterprise, if you add report recipients, to email them your weekly and monthly reports (with their own unsubscribe link); if you connect Slack or Microsoft Teams, to send new negative reviews (reviewer name, rating and text) to the channel you chose; and to keep a team activity log (who did what on the account, with their email) for 2 years.
• If you set a review link, to send people who open your short link or scan your QR code to your review page, and to count those visits. We don't store anything about the visitors (a one-way scrambled form of their IP address is kept briefly to avoid counting repeat visits).
• To understand how the Service is used, in aggregate: which days each signed-in person opened the app (to count active users), how much each AI feature costs us, and visits to our public pages (the page, and the site the visitor came from). Visits are counted without cookies: a one-way scrambled form of the visitor's IP address and browser, which changes every day, lets us count a visitor once per day without being able to recognise or identify them.
• To improve the Service, including diagnosing bugs and understanding usage patterns in aggregate.

We do not sell your information, and we do not use your review or business content to train AI models.

3. AI Processing

To draft a response, the review (including the reviewer's name as you entered it), your business name, and your tone and instruction settings are sent to our AI provider, Anthropic, solely to generate that draft; the draft is then checked by a second AI step. If you forward review emails to your inbox address, or approve by replying to an email, that email's text is sent to Anthropic to read the review or your reply. This processing is how the core features work, so it isn't optional.

When you ask the support assistant a question that our Help Center doesn't already answer, your question, the recent conversation, our help content, and basic facts about your account (such as your plan and how much of your allowance you've used) are sent to Anthropic to write the answer.

4. Third-Party Service Providers

We rely on the following subprocessors to operate the Service:

• Vercel — hosting for the website and app, including server logs.
• Supabase — database, authentication, and file storage.
• Stripe — subscription billing and payment processing.
• Resend — outbound notification emails and inbound email intake.
• Anthropic — AI response generation and support-assistant answers.
• Cloudflare — Turnstile bot protection on the sign-up, log-in, password-reset and homepage preview forms. It checks your browser and receives your IP address for that check only.

Each processes data only as needed to provide their service to us and is bound by their own privacy and security commitments.

5. Data Retention

We keep your account and content for as long as your account exists. If your subscription ends, your reviews and responses stay stored so you can reactivate. If you delete your account from Settings, your account and all of its reviews, responses, issue reports, support-assistant history, uploaded files, and every teammate's login are permanently deleted right away. When you remove a teammate, their login is deleted; actions they took on your account (such as approvals) stay part of your account's records. Deleting your account also deletes your customer record at Stripe; Stripe keeps past invoices as tax law requires. Reviewer names and review text you enter are stored only as part of your account and are deleted with it, though copies in emails already sent to you, and in our providers' short-term logs, follow those providers' own retention.

Some records are kept for a limited time and then deleted automatically: support-assistant conversations after 12 months, invite requests and unused invitations 12 months after they were handled or expired, resolved error reports after 90 days, and our internal audit log (which can include your email and business name) after 2 years.

6. Data Security

Customer data is isolated at the database level using row-level security, so one account can never query another account's data — this isn't just an application-layer check. Data is encrypted in transit (TLS) and encrypted at rest by our database and storage provider. Uploaded screenshots are stored in a private bucket and only ever accessed through short-lived, signed links. No system is perfectly secure, but we take these protections seriously.

7. Your Rights

You can access and update most of your information directly from your account settings, download all your reviews and responses as a CSV file (Reviews → Export CSV, or Settings → Account), and delete your account yourself (Settings → Account). For anything else, contact us at the address below — we'll fulfill deletion requests except where we're legally required to retain specific records.

8. California and Other U.S. State Privacy Rights

If you live in California (CCPA/CPRA) or another state with a comprehensive privacy law (such as Colorado, Connecticut, Virginia, or Texas), you have the right to:

• Know what personal information we collect, use, and disclose about you;
• Access a copy of your personal information;
• Correct inaccurate personal information;
• Delete your personal information;
• Not be discriminated against for exercising these rights.

In the past 12 months we have collected identifiers (name, email), commercial information (plan and billing status), internet activity (log data), and the content you submit (reviews and responses), for the purposes described above. We do not sell your personal information or share it for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you.

To exercise any of these rights, use the account tools in Settings (edit, or delete your account) or email us at the address below. We'll verify your request by matching it to your account and respond within 45 days. You may also use an authorized agent; we may ask for proof of their authorization.

9. Cookies

We use cookies only for authentication (keeping you signed in) — not for advertising or cross-site tracking.

10. Children's Privacy

The Service is intended for business use and is not directed at children. We don't knowingly collect information from anyone under 16.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you by email or through the Service before they take effect.

12. Contact

Questions about this policy, or a data access/deletion request? Contact us at hello@metisreply.com.