Privacy Policy

1. Data controller

In accordance with Article 13 GDPR and the LOPDGDD, the controller of your personal data is:

We have not appointed a Data Protection Officer because the cases in Article 37(1) GDPR do not apply (our core activity is not large-scale processing or processing of special-category data). You can send any privacy query to [email protected].

2. Purposes of processing

We process the personal data you provide or that we obtain when you connect your Google account only for the following purposes: • Providing the service: creating and managing your account, syncing Google Business Profile listings and reviews, generating AI reply drafts and posting replies when you authorise it. • Billing, accounting and tax: collecting subscriptions, issuing invoices and meeting tax obligations. • Customer support: handling queries, incidents and support requests. • Service communications: operational notices about your account, billing, security or material product changes. • Product improvement and analytics: measuring how the platform is used to fix issues and improve Relvio, as allowed by this policy and, where required, your consent. • Marketing: campaign measurement (Google Ads and Meta) and, where applicable, commercial communications, based on consent or legitimate interest. • Legal compliance and fraud prevention.

3. Legal bases

The legal bases for the processing described above are: • Performance of a contract (Art. 6(1)(b) GDPR): to register you, connect Google Business Profile and provide Relvio. • Legal obligation (Art. 6(1)(c) GDPR): in particular commercial, accounting and tax duties. • Consent (Art. 6(1)(a) GDPR): for non-essential cookies, advertising measurement and, where applicable, marketing emails. You may withdraw consent at any time. • Legitimate interest (Art. 6(1)(f) GDPR): service security, fraud prevention, aggregated product improvement and the establishment or defence of legal claims. You may object at any time.

4. Personal data we collect

We only collect the data strictly needed for each purpose, applying the minimisation principle in Article 5(1)(c) GDPR:

We do not process special-category data (Art. 9 GDPR) such as health, racial origin, political opinions or biometric data. Relvio is aimed at professionals and businesses, not at private individuals leaving Google reviews as consumers.

5. How we use Google data

We use data from your Google account exclusively to provide Relvio: • Display and manage your Google Business reviews in the dashboard. • Generate AI-suggested replies. • Post replies on your behalf when you authorise it. • Provide analytics and metrics for your locations. • Automatically sync new reviews. We NEVER use your Google data to: • Sell it or share it with third parties unrelated to providing the service. • Advertise or market products unrelated to Relvio. • Develop products other than Relvio. • Train AI models that benefit other users or third parties.

6. Compliance with Google API Services User Data Policy

Relvio’s use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. This means: • We only request the minimum permissions needed to provide the service. • We use your Google data solely for the purposes described in this policy. • We do not transfer your Google data to third parties except as needed to provide or improve Relvio, comply with law, or as part of a merger, acquisition or sale of assets with your prior consent. • We do not allow humans to read your Google data except for security, to comply with law, or to provide technical support with your explicit consent. You can revoke Relvio’s access at any time from your account settings or from https://myaccount.google.com/permissions.

7. Recipients

We do not sell, trade or rent your personal data or Google data. We only disclose information: • To processors that help us operate Relvio, under a contract meeting Article 28 GDPR. • When required by a competent authority or by law. • With your explicit consent for a specific purpose. • If Relvio or Sentinel Peak SL is transferred to a third party, with the safeguards and, where required, prior information demanded by the GDPR.

8. Processors

To provide the service we work with the following processors, acting on documented instructions and with Article 28 GDPR safeguards. AI reply drafts are generated with the AI SDK and may be sent to OpenAI and/or Anthropic depending on the model used:

9. International transfers

When a processor involves a transfer outside the European Economic Area, we apply the safeguards in Articles 44 to 49 GDPR: European Commission adequacy decisions or Standard Contractual Clauses (SCC 2021/914), together with supplementary technical measures. In particular, the use of Google, Stripe, Meta, OpenAI, Anthropic or other providers with US infrastructure may involve international transfers covered by the EU-US Data Privacy Framework or by standard contractual clauses.

10. Retention and deletion

We keep data only as long as needed for the purposes described or as required by law: • Account and Google Business data: while the account is active and connected. If you cancel or disconnect Google, we will delete Google data within 30 days, unless we must keep it for a legal obligation. • Tax data and invoices: 6 years (Spanish Commercial Code Art. 30 and General Tax Law Art. 66). • Support communications: while needed to resolve the query and then for the limitation period of legal claims (up to 5 years). • Cookies and analytics: as set out in the Cookie Policy, for a maximum of 24 months. You can request deletion at [email protected]. We will handle the request within one month, unless we must retain certain information by law.

11. Your rights

You may exercise at any time the rights in Articles 15 to 22 GDPR and 12 to 18 LOPDGDD: • Access: know which personal data we process. • Rectification: correct inaccurate or incomplete data. • Erasure: request deletion when the data is no longer needed. • Objection: object to processing based on legitimate interest. • Restriction of processing: in the cases in Article 18 GDPR. • Portability: receive your data in a structured, commonly used, machine-readable format. • Withdrawal of consent, without retroactive effect. • Not to be subject to automated decisions with significant legal effects. • Revoke Relvio’s access to Google from your account or Google’s permissions panel. How to exercise them: email [email protected] stating the right you want to exercise and, if needed to identify you, attaching a copy of your ID. We will reply within one month, extendable by two months in complex cases. If you believe your rights have not been addressed, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid (https://www.aepd.es).

12. Security measures

We apply technical and organisational measures appropriate to the risk: • TLS encryption in transit (HTTPS). • Encryption at rest where the provider supports it. • Role-based access control and authentication. • Google OAuth 2.0: we never store your Google password. • Backups and infrastructure monitoring. • Periodic review of processors and data-processing agreements. If a security breach involving a risk to your rights occurs, we will notify the AEPD within 72 hours (Art. 33 GDPR) and, where required, you (Art. 34 GDPR).

13. Children

Relvio is a professional service for businesses. It is not intended for anyone under 18 and we do not knowingly collect data from children. If we become aware that we have collected a minor’s data, we will delete it.

14. Automated decisions and AI

Relvio uses artificial intelligence to generate reply drafts from the review text, your listing and the settings you choose (tone, language, style). To do so we use the AI SDK and may send that content to one or more model providers, specifically OpenAI (GPT) and Anthropic (Claude). The specific provider and model may vary depending on availability and Service configuration. That suggestion does not by itself produce legal effects: you review, edit or reject the text before publishing. We do not use your reviews or Google data to train generalised AI models or to benefit other customers. We ask these providers not to use the content to train their models, to the extent their terms allow. We do not carry out profiling with legal effects within the meaning of Article 22 GDPR.

15. Cookies

We use strictly necessary cookies for the site to work (language, session and security) and, where applicable, analytics, attribution and advertising cookies. Details, duration and how to manage them are set out in the Cookie Policy. Non-essential cookies require your consent under Article 22.2 of the Spanish LSSI-CE and AEPD cookie guidelines.

16. Changes to this policy

We may update this Privacy Policy to reflect legal, product or vendor changes. We will publish any change on this page, with the date of the latest update. If a change is material, we will inform you through the usual contact channels with reasonable notice.

17. Contact

If you have questions about this policy or about how we process your data: Sentinel Peak SL Avenida Monforte de Lemos, 137, puerta 2, planta 10, 28029 Madrid, Spain Email: [email protected] Phone: +34 633 626 724 Website: https://www.relvio.io We will reply within 48 business hours.