Privacy Policy
Last Updated: August 31, 2026
1. Introduction
AleafChat (“we”, “our”, or “us”), operating via aleafchat.com, provides an autonomous AI-driven software platform designed to help businesses monitor, draft, and respond to customer reviews (including Google Business Profile reviews) and direct messages (including Instagram DMs).
We are deeply committed to protecting your personal data and respecting your privacy rights. This Privacy Policy explains what information we collect, how we process it, the measures we take to secure it, and your rights under applicable privacy laws, including the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
2. Google API Services User Data Policy Compliance
AleafChat integrates with Google APIs (specifically the Google Business Profile APIs and OAuth 2.0 services) to read and reply to business reviews on your behalf.
AleafChat's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We only request permissions strictly required to manage your business profile reviews and authenticate your account.
- We do not sell Google user data to third parties, data brokers, or advertising networks.
- We do not use or transfer Google user data for serving advertisements (retargeting, personalized, or interest-based ads).
- We do not allow humans to read your private data unless you have provided explicit affirmative consent for a specific support ticket, or where required by law.
3. Information We Collect
When you use AleafChat, we may collect the following types of information:
Account & Contact Data
Your name, business email address, hashed password, and organization or brand name provided during registration.
Connected Platform Data
OAuth tokens (stored encrypted via AES-256), connected location IDs, public reviews, customer ratings, reviewer names, and public Instagram message contents necessary to generate replies.
AI Context & Business Rules
Business FAQs, custom brand voice settings, tone preferences, and guidelines you enter into the prompt playbooks.
Usage & Telemetry Data
Activity logs, API request IDs, IP addresses, browser types, and response latency for security, rate-limiting, and error diagnostics.
4. How We Use Your Information
- To provide, operate, and maintain the AleafChat review & DM automation software.
- To generate contextual, brand-aligned AI draft replies to incoming reviews and messages.
- To securely post approved responses back to Google Business Profile or Instagram.
- To authenticate your login sessions and prevent unauthorized access or account takeovers.
- To monitor system health, detect abuse, enforce rate limits, and provide technical support.
5. Data Security & Encryption
We employ strict security practices to safeguard all customer and platform data:
- Encryption in Transit: All data transmitted between your browser, our servers, and third-party APIs is encrypted using modern TLS 1.3 / HTTPS.
- Encryption at Rest: Sensitive OAuth access and refresh tokens are encrypted in our database using 256-bit AES encryption (`TOKEN_ENCRYPTION_KEY`).
- Password Hashing: Passwords are encrypted with industry-standard bcrypt (12 rounds) and never stored in plaintext.
6. Your Rights & Data Deletion (GDPR & CCPA)
You maintain complete ownership of your data. You may exercise any of the following rights at any time:
- Disconnect Accounts: You can disconnect your Google Business Profile or Instagram account instantly from your Dashboard Settings. Disconnecting immediately revokes our API access and purges your tokens.
- Right to Erasure (“Right to be Forgotten”): You can request full deletion of your user account, stored reviews, and message histories by submitting an erasure request via
/api/gdpr/eraseor emailing support. - Data Export: You can download a complete JSON export of your stored reviews and activity logs.
7. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy Team: