ReputeLift Privacy Policy

Effective date: 2026-08-06

Last updated: 2026-08-06

1. Introduction & Scope

This Privacy Policy explains how Martello Systems, LLC ("Martello Systems," "we," "us," or "our") collects, uses, shares, and protects personal information when you use ReputeLift at reputelift.com and related applications and services (the "Service"). It applies to information we process about visitors and Account holders.

This Policy also describes how we handle information about your End Users — the people whose details you (as a business using the Service) import into, collect through, or otherwise submit to the Service, such as your contacts, customers, leads, or subscribers. For that End User information, you are the controller and we act as your processor (or "service provider"/"processor" under applicable law): we handle it on your behalf and under your instructions to provide the Service. You are responsible for having a lawful basis and any required consent to collect and use your End Users' information and to instruct us to process or message it.

By using the Service, you agree to the practices described in this Policy. This Policy is incorporated into and subject to our Terms of Service. If you do not agree with this Policy, please do not use the Service.

2. Information We Collect

Account information. When you register, we collect information such as your name, email address, password (stored in hashed form), business name, and team/workspace details you provide.
Customer Data you provide. We collect and store the information you enter or import to run your business through the Service, including any personal information about your End Users — for example names, email addresses, phone numbers, companies, notes, records, and form or intake submissions.
Communications content. Where the Service sends or receives email, SMS/text, voice, or other communications on your behalf, we process the content of those communications along with related metadata (timestamps, delivery status, opt-out status) so we can deliver, organize, and display them for you.
Payment information. Subscription payments are processed by a third-party payment processor (for example, Stripe, Inc.). We do not collect or store your full payment card numbers. The payment processor processes your payment details directly; we receive limited information such as a transaction identifier, the last four digits and card brand, subscription status, and billing metadata.
Usage, device, and log data. We automatically collect information such as IP address, browser and device type, pages and features used, referring URLs, timestamps, and diagnostic/log data.
Cookies and similar technologies. We use cookies and similar technologies as described in Section 7.
Communications with us. If you contact us (for example, at [email protected]), we collect the content of your messages and our correspondence.

We do not intentionally collect sensitive categories of personal information beyond what is needed to provide the Service, and we ask that you not submit sensitive information (such as government ID numbers, health data, or precise geolocation of End Users) unless a product-specific addendum expressly addresses that category.

3. How We Use Information

We use personal information to: provide, operate, and maintain the Service and your Account; store and organize your Customer Data; run the Automations and campaigns you configure; send and receive the communications you direct; provide AI-assisted features that draft, summarize, or analyze content at your request; process subscriptions, billing, and payments; send transactional and account communications to you; provide customer support; monitor, secure, debug, and improve the Service; detect and prevent fraud, abuse, and security issues; and comply with legal obligations and enforce our agreements. We do not sell your personal information, and we do not use your End Users' personal information for our own marketing.

4. Legal Bases for Processing (GDPR/UK GDPR)

Where the GDPR or UK GDPR applies, we process personal information on the following bases: performance of a contract (to provide the Service and process your Subscription); legitimate interests (to secure, improve, and analyze the Service and prevent fraud and abuse, balanced against your rights and freedoms); consent (for optional communications and certain non-essential cookies, which you may withdraw at any time); and legal obligation (to comply with applicable law, including tax and recordkeeping requirements). For personal information about your End Users, you are responsible for establishing the legal basis for collecting and using it and for instructing us to process it; we process it as your processor on your documented instructions.

5. How We Share Information

We share personal information only as described below. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

Service providers / sub-processors. We use a limited set of third-party service providers to operate the Service, engaged as our sub-processors and bound by appropriate confidentiality and data-protection terms. These fall into the following categories: cloud infrastructure and hosting; database and file storage; payment processing and subscription billing; email delivery; SMS and voice delivery (where the Service supports messaging); AI/model providers (for AI-assisted features); and analytics providers (for privacy-respecting, consent-gated usage analytics). On this instance, our current sub-processors in these categories include Stripe (payments), Brevo (transactional and review-request email), Twilio (SMS), Anthropic (the AI model behind AI draft responses and Smart Reply — see Section 5A), OpenAI, Perplexity, Google (Gemini) and SerpAPI (the answer engines queried by the optional AI Visibility add-on — see Section 5A), Google Analytics (consent-managed usage analytics on our marketing site — see Section 7), Google Business Profile and Facebook/Meta (connected review platforms), and our hosting/infrastructure providers.
At your direction. When you send a message, run an Automation, connect an integration, or use an AI feature, we share the necessary information with the relevant provider (for example, sending an End User's phone number to our SMS provider to deliver a message you sent, or sending a review to our AI provider so it can draft a reply — see Section 5A) to carry out your instruction. If you configure an outbound webhook, we also send the event details you asked for to the URL you supplied; that endpoint is yours, and what happens to the data once it arrives there is outside our control.
Legal and safety. We may disclose information if required by law or legal process, or to protect the rights, property, or safety of Martello Systems, our users, or others, or to enforce our Terms.
Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy.
Reseller or partner billing relationship. If you were referred to, or purchase, the Service through a reseller, agency, or channel partner, limited account and billing information may be shared with that party to administer your relationship with them, as described at the point of purchase.

5A. AI Features & AI Providers

ReputeLift has three optional AI features. Each one sends data to a third-party AI provider to produce your result. This section says exactly what leaves the Service, to whom, and why. None of it is used to train anyone's models, and none of it is used for our own marketing.

1. AI draft responses to reviews. When you ask ReputeLift to draft a reply to a review, we send to Anthropic: your business name and category, the response tone you selected, and the review itself — the star rating, the reviewer's display name, and the full review text. Anthropic returns a suggested reply. Nothing is posted anywhere; you review, edit, and approve it yourself.

2. Smart Reply (AI replies to inbound texts and emails). If you turn Smart Reply on for a channel, then when one of your customers texts or emails you we send to Anthropic, in order to understand and answer that message: the customer's message text; the recent message history for that conversation; your business name, category, phone number, email address, and street address; and, as grounding material so the reply is accurate rather than generic, an extract of your most recent reviews — including the reviewer display names and review text. We do not add the customer's phone number or email address to what we send — those stay in our own systems and go only to the SMS or email provider that has to deliver the reply. (Anything a customer typed into their own message travels with that message, so if they wrote a callback number in the text, it goes.) A single inbound message normally makes three to four calls to the provider.

3. AI Visibility (the optional AEO add-on). To measure whether AI answer engines recommend your business, we send a generated buyer-intent question — built from your business category and city, or written by you — to OpenAI, Perplexity, Google (Gemini) and SerpAPI (which retrieves the Google AI Overview). Those questions contain no customer or reviewer information. We read the answers back to see whether your business and your competitors are cited.

About other people's reviews. Features 1 and 2 send the names and review text of people who reviewed your business to Anthropic. Those individuals are your End Users under this Policy, not ours: you are the controller of that information and we process it as your processor on your instruction, which in this case is your decision to switch the feature on. That review content is already public on the review platform it came from, but it is personal information nonetheless, and we would rather say so plainly than describe this as "AI-assisted content."

AI providers are sub-processors, not co-controllers. They process what we send solely to return the output for you, under their own commercial terms; they are not permitted to use it to improve their general models, and we do not authorize any other use.

Turning it off. You can pause every AI feature at once, or switch off any one of them, in Settings → AI Controls. That switch is checked before anything reaches an AI provider, so turning a feature off stops the processing itself, not just the display of a result. Smart Reply is off by default and the AI Visibility add-on is a separate paid subscription; if you never enable them, no data reaches those providers.

6. International Data Transfers

We are based in the United States, and the Service is operated from and primarily processes data in the United States. If you or your End Users are located outside the United States, your information will be transferred to, stored, and processed in the United States and possibly other countries where our sub-processors operate, where data-protection laws may differ from those in your country. Where required by applicable law (for example, for transfers of personal information out of the EEA, UK, or Switzerland), we and our sub-processors rely on appropriate safeguards, such as Standard Contractual Clauses or an equivalent legal transfer mechanism, and take steps designed to ensure your information receives an adequate level of protection. By using the Service, you consent to this transfer and processing, subject to this Policy and applicable law.

7. Cookies & Analytics

We use strictly necessary cookies to keep you logged in, secure your session, and remember your preferences — these are always active because the Service cannot function without them.

For usage analytics we use Google Analytics 4 on our public marketing pages, and how it works depends on where you are. If you are in the EEA, the UK, or Switzerland, Google Analytics does not load at all until you accept our cookie banner — until you choose, and if you decline, no analytics script is loaded, no analytics cookies are set, and nothing about your visit is sent to Google. Everywhere else, including the United States, Google Analytics loads on your first page view, which means that first page view is measured, and we show you a notice with a one-click opt-out; opting out stops analytics immediately and is remembered on that browser, so nothing further is collected on that visit or any later one. In every region we honor the Global Privacy Control browser signal and any opt-out you have previously set, and neither ever loads analytics or shows you a banner. You can change your mind at any time by clearing this site's stored preferences in your browser.

We do not use advertising cookies and do not use cookies to sell your data or track you across unrelated websites for advertising. You can control cookies through your browser settings and, where applicable, through our consent banner; disabling some cookies may affect functionality.

8. Data Retention

We retain personal information for as long as your Account is active and as needed to provide the Service, then for a reasonable period afterward to comply with legal, tax, accounting, and recordkeeping obligations, resolve disputes, and enforce our agreements. We also retain opt-out and suppression records as needed to honor unsubscribe and STOP requests. When information is no longer needed, we delete or anonymize it. You may request deletion as described in Section 10; certain records (such as billing records) may be retained where required by law, and some information may persist for a limited period in routine backups before being overwritten on their normal cycle.

9. Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information, including encryption in transit, hashed passwords, encryption of sensitive stored credentials, access controls, and reputable infrastructure and payment providers. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your Account credentials confidential. If we become aware of a breach affecting your personal information, we will notify you and applicable authorities as required by law.

10. Your Privacy Rights

Depending on where you live, you may have rights to: access a copy of the personal information we hold about you; correct inaccurate information; delete your personal information; port/export your data; object to or restrict certain processing; withdraw consent where processing is based on consent; and non-discrimination for exercising your rights.

California residents (CCPA/CPRA). You have the right to know what personal information we collect, access, correct, and delete it, and to opt out of any "sale" or "sharing" of personal information — note that we do not sell or share personal information as those terms are defined under California law, so there is generally nothing to opt out of, but we will honor a request if you make one. You also have the right not to be discriminated against for exercising your rights.

EEA/UK/Swiss residents (GDPR/UK GDPR). You have the rights listed above and the right to lodge a complaint with your local data protection supervisory authority.

Other U.S. state privacy laws. If another applicable U.S. state privacy law grants you rights similar to those above, we will honor requests to exercise those rights in accordance with that law.

If your request concerns information that one of our business customers controls (for example, you are an End User of a business that uses ReputeLift), please contact that business directly; we will assist them as their processor where appropriate and as required by law. To exercise any right with us directly, email [email protected]. We will verify your request and respond within the timeframes required by applicable law.

11. SMS / Phone Data Handling

Where the Service supports SMS or voice communications, phone numbers and messaging content are processed to deliver the communications the relevant business directs. We share a recipient's phone number with our SMS/voice provider only to deliver the messages and calls sent through the Service, and we maintain opt-out and suppression records to honor STOP requests. We do not sell phone numbers, and mobile opt-in/opt-out data collected through the Service is not shared with third parties for their own marketing purposes. Message frequency depends on usage, and message and data rates may apply to recipients per their carrier plans. See any SMS/Messaging Policy posted alongside this Policy for further detail.

12. Children's Privacy

The Service is intended for business users who are at least 18 years old (or such other minimum age as stated in a product-specific addendum) and is not directed to children. We do not knowingly collect personal information from anyone under 13 (or, where a product-specific addendum sets a different threshold consistent with applicable law, that threshold — for example, some products require parental consent for users between 13 and 16). If we learn that we have collected personal information from a child in violation of this Section, we will delete it. If you believe a minor has provided us information, contact [email protected].

13. Third-Party Links & Services

The Service may contain links to, or integrate with, third-party websites, platforms, and services that we do not control. This Policy does not apply to those third parties. We encourage you to review the privacy practices of any third-party site or service before providing it with information.

14. Automated Decision-Making

We do not use your personal information, or your End Users' personal information, to make decisions that produce legal or similarly significant effects concerning you or them without human involvement.

AI draft responses and AI Visibility results are always suggestions or analyses for your review; you decide whether and how to act on them. Smart Reply is different and we want to be exact about it. You choose its level per channel: *off*, *draft only* (it writes, you send), *approve before send* (it writes, and the reply waits in your approval queue until you release it), or *fully automatic* (it composes and sends the reply to your customer without a person reading it first). Fully automatic is off by default and you switch it on yourself; when it is on, your customer is receiving a message written by an AI system with no human in the loop, and neither we nor the model add a notice to the message saying so. Even then, the engine escalates to a human instead of replying when it reads a message as legal, medical, a refund or cancellation, a complaint, a request to speak to a person, or simply beyond what it can answer from your own records — and you can stop it instantly from Settings → AI Controls. You remain the sender of, and responsible for, every message it sends on your behalf.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and may provide additional notice (for example, by email or an in-product notice). Your continued use of the Service after the changes take effect constitutes acceptance of the updated Policy.

16. Contact

If you have questions or requests regarding this Privacy Policy or your personal information, contact Martello Systems, LLC — ReputeLift, at [email protected] (reputelift.com).