Privacy Policy
This policy explains what information GracefulReply collects, why we collect it, how long we keep it, who helps us process it, and the choices you have. It covers our website, gracefulreply.com, the emails we send, and our service that drafts replies to Google reviews for dental practices.
1. Who we are
GracefulReply provides a done-for-you service that drafts replies to Google reviews for dental practices in the United States. We operate from Brazil. In this policy, “GracefulReply”, “we” and “us” mean the operator of the GracefulReply service. We are the controller of the personal information described below.
Email: admin@gracefulreply.com (this is also our channel for privacy requests)
2. Information we collect
Public business contact information
To find dental practices that may want our service, we collect business information from public sources: the National Plan and Provider Enumeration System (NPPES) registry published by the Centers for Medicare & Medicaid Services, and practices’ own websites. This includes the practice’s name, National Provider Identifier (NPI), address, phone number, website and specialty, email addresses published on its website and the page where we found them, and whether the website shows signs of review or marketing tools. It can include the name and professional credential of the dentist listed in NPPES as the practice’s authorized official.
Information you give us
When you write to us or use the service, we collect your name, email address, practice name, the Google Business Profile or profiles you want covered, your messages, your choices about how replies are delivered, and your preferences for how replies should sound, such as tone and sign-off.
Reviews and replies
To draft replies, we receive the content of reviews posted on your Google Business Profile, such as the reviewer’s display name, rating, text and date. We receive it through Google’s notification emails or by viewing your profile on Google. To learn your office’s voice, we may also read replies already posted on your profile. We keep the drafts we write and the final text you approve, edit or skip.
Approval and consent records
When you approve, edit or skip a draft, we record what you chose and when. If you sign our auto-publish consent, we record your name, email address, the profile or profiles covered, the date and time, and the IP address used, as the consent text says.
Unsubscribe requests
If you ask us to stop emailing you, we keep your email address on a do-not-contact list so that we can keep honoring your request.
Website and email data
Our website does not use cookies, analytics or tracking pixels. Our hosting provider processes technical data, such as IP addresses, to deliver the site and protect it from abuse. Our email tools record deliveries, bounces, replies and unsubscribe requests, and may record when a sales email is opened or a link in it is clicked.
Patient information
We do not ask for patient information and we do not need it. Please do not send it to us. If you send it anyway, we will delete it once we notice it, except where the law requires us to keep it.
3. How we use information
- To contact dental practices by email about our service, using business contact information.
- To provide the service: write drafts, send them to you for approval, post approved replies or give them back to you to paste, send daily summaries, and follow up on approved replies that are not yet confirmed as posted.
- To keep records of what you approved and what you consented to.
- To honor unsubscribe and stop requests.
- To answer your messages.
- To keep the service secure, prevent abuse, and meet our legal obligations.
We do not sell personal information, and we do not use it for targeted advertising. We do not use review content, drafts or your replies to train AI models.
Legal bases under Brazilian law
Where Brazil’s General Data Protection Law (LGPD) applies, we rely on: our legitimate interest in offering our service to businesses, for outreach that uses publicly available business contact information; the performance of a contract, or steps you ask for before one, to provide the service; compliance with legal obligations; and the regular exercise of rights, for keeping approval and consent records.
4. Content from Google
- We use content from Google, such as reviews, only to provide the service to the practice whose profile it comes from.
- We keep it for no more than 30 days. After that, our records keep only identifiers (such as review IDs and dates), the reply text we wrote, and approval and consent records.
- We never combine one practice’s information with another’s, build indexes or reports across practices, or use one practice’s reviews to write another practice’s replies.
- If we use Google APIs, our use of information received from them will follow the Google API Services User Data Policy and the Business Profile API policies.
5. Service providers
We share information only with providers that help us run the service, and only what each one needs to do its job:
- Cloudflare, Inc. (United States): hosting for our website and service, our database, and email routing and delivery for gracefulreply.com.
- Anthropic, PBC (United States): the AI language model that writes reply drafts. It receives the review content and the instructions needed to write each draft.
- Email providers: the companies that host our mailboxes, send our emails, and check whether an email address can receive mail.
- Google: when you give us manager access, we post replies on your Google Business Profile. Google handles that content under its own privacy policy.
We may also disclose information when the law requires it, to protect our rights or the safety of others, or to a successor if our business is transferred, in which case this policy continues to apply to it.
6. International transfers
We operate from Brazil, and our main service providers are in the United States, so your information may be processed in both countries. Where the LGPD applies, we transfer personal information internationally only on one of the bases that law allows.
7. How long we keep information
- Content from Google: no more than 30 days.
- Drafts, approval records and consent records: while you use the service, and afterwards for as long as we need them to show what you authorized or to handle legal claims.
- Business contact information used for outreach: until we no longer need it for that purpose.
- Do-not-contact list: for as long as needed to keep honoring your request.
- Messages you send us: for as long as needed to answer you and keep a record of the conversation.
8. Your choices and rights
Everyone
You can ask us what information we have about you, and ask us to correct it, delete it, or stop using it for outreach. Write to admin@gracefulreply.com. We may need to confirm your identity first. If you ask us to delete your information, we still keep your email address on our do-not-contact list so that we do not contact you again.
Unsubscribing
Reply “stop” or “unsubscribe” to any of our emails, write to optout@gracefulreply.com, use the unsubscribe link in emails that include one, or use our unsubscribe page.
Brazil
If the LGPD applies to you, you have the rights in its Article 18. They include confirmation that we process your data, access to it, correction, anonymization, blocking or deletion of unnecessary or excessive data, portability, information about who we share it with, and objection to processing that does not comply with the law. When you ask us to confirm or give access to your data, we send a complete answer within 15 days. You can also file a petition with Brazil’s National Data Protection Authority (ANPD).
California
The California Consumer Privacy Act applies to for-profit businesses that meet at least one of its thresholds, which are based on annual revenue or on buying, selling or sharing personal information. GracefulReply does not currently meet any of them. We still honor requests from California residents to know, correct or delete their personal information, and we do not sell or share personal information as that law defines those terms.
Do Not Track
Our website does not track visitors over time or across other websites, so it does not respond differently to Do Not Track signals.
9. Children
Our service is for businesses. It is not directed to children, and we do not knowingly collect information from children under 13.
10. Security
We use encrypted connections (HTTPS) for our website and for approval links, limit access to the people and systems that need it, keep passwords and keys out of our code, and delete content from Google within 30 days. No system is perfectly secure. If a security incident affects your information, we will notify you and the authorities as the law requires.
11. Changes to this policy
If we change this policy, we will post the new version on this page with a new effective date. If a change materially affects how we use the information of current customers, we will tell them by email before it takes effect.
12. Contact
Questions or requests about privacy: admin@gracefulreply.com