Privacy Policy

Last updated: December 10, 2025

AppSpeaker.io ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our AI-powered review management service, in compliance with the General Data Protection Regulation (GDPR) and applicable Polish data protection laws.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Google OAuth data: Your email address, name, and Google account identifier
• Profile preferences: Your preferred language for the admin interface
• Subscription information: Your subscription tier and billing status (payment details are handled by Stripe)

1.2 App Store Data

When you connect your developer accounts, we access:

• App reviews: Review text, ratings, author names, timestamps, and device information from Google Play and/or Apple App Store
• App metadata: Package names, app names, and version information
• OAuth tokens: Access and refresh tokens to communicate with app store APIs (encrypted at rest)

1.3 Service Usage Data

We collect data about how you use our Service:

• Generated responses: AI-generated response text and your edits
• Custom instructions: Instructions you create to guide AI response generation
• Response history: Status and timestamps of sent responses
• Feature usage: Which features you use and how often

1.4 Analytics Data

We use Google Analytics to collect anonymized usage statistics:

• Pages visited and time spent on pages
• Browser type and device information
• Referring websites
• General geographic location (country/region level)

We do not log your IP address in our application servers.

2. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

Purpose	Legal Basis
Providing the Service	Contract performance (Art. 6(1)(b) GDPR)
Account management	Contract performance (Art. 6(1)(b) GDPR)
Processing payments	Contract performance (Art. 6(1)(b) GDPR)
Service improvement	Legitimate interest (Art. 6(1)(f) GDPR)
Analytics	Consent (Art. 6(1)(a) GDPR)
Marketing communications	Consent (Art. 6(1)(a) GDPR) / Legitimate interest (Art. 6(1)(f) GDPR)
Legal compliance	Legal obligation (Art. 6(1)(c) GDPR)
Security and fraud prevention	Legitimate interest (Art. 6(1)(f) GDPR)

3. How We Use Your Information

We use your data to:

• Provide the Service: Fetch reviews, generate AI responses, and send responses on your behalf
• Manage your account: Handle authentication, subscriptions, and preferences
• Improve AI quality: Analyze response patterns to improve our AI suggestions (using aggregated, anonymized data)
• Provide support: Respond to your inquiries and troubleshoot issues
• Send communications: Service updates, security alerts, and marketing communications
• Ensure security: Detect and prevent fraud, abuse, and security incidents
• Comply with law: Meet legal and regulatory requirements

3.1 Marketing Communications

By creating an account, you consent to receive marketing communications from us, including:

• Product updates and new feature announcements
• Promotional offers and discounts
• Tips and best practices for using our Service
• Newsletters and educational content
• Surveys and feedback requests

You can unsubscribe from marketing emails at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Updating your preferences in account settings
• Contacting us at wojciech@appspeaker.io

Note: Even if you unsubscribe from marketing emails, you will still receive essential service communications (security alerts, billing notifications, Terms updates).

4. Third-Party Services and Data Sharing

We share your data with the following categories of third-party service providers:

4.1 Infrastructure and Hosting

• Google Cloud Platform (GCP): Cloud hosting, database storage, and infrastructure (EU/US regions)
• Google Cloud Secret Manager: Secure storage of API keys and secrets

4.2 Authentication

• Google OAuth 2.0: User authentication and authorization for Google Play Developer API access
• Apple Sign-In: User authentication for App Store Connect API access (where applicable)

4.3 AI Services

• Google AI (Gemini): AI response generation and translation services. Review text is sent to Gemini API to generate responses.

4.4 Payment Processing

• Stripe: Secure payment processing. We do not store your credit card information. Stripe handles all payment data in compliance with PCI-DSS standards.

4.5 Analytics and Monitoring

• Google Analytics: Website usage analytics (anonymized)
• Sentry: Error tracking and application monitoring

4.6 Legal Disclosure

We may disclose your data if required by law, court order, or to:

• Comply with legal obligations
• Protect our rights, property, or safety
• Prevent fraud or security threats
• Respond to lawful requests from public authorities

5. Data Storage and Security

5.1 Data Location

Your data is stored on Google Cloud Platform servers. Data may be processed in the European Union and/or United States, depending on service configuration.

5.2 Security Measures

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit: All data transmitted via HTTPS/TLS
• Encryption at rest: OAuth tokens encrypted using AES-128 (Fernet encryption)
• Access control: Role-based access and per-user data isolation
• Secure authentication: OAuth 2.0 delegation (we never see your Google password)
• Input validation: Protection against SQL injection, XSS, and other attacks
• Regular updates: Security patches and dependency updates

5.3 Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours (as required by GDPR)
• Notify affected users without undue delay if the breach poses a high risk

6. Data Retention

6.1 Active Accounts

We retain your data for as long as your account is active and as needed to provide our services.

6.2 Account Deletion

When you delete your account:

• Your personal data will be deleted within 30 days
• Some anonymized, aggregated data may be retained for analytics
• Backup copies may persist for up to 90 days before full deletion
• Data required for legal compliance may be retained as required by law

6.3 Review Data

Note that reviews displayed in AppSpeaker.io are fetched from Google Play / App Store. Deleting your AppSpeaker.io account does not delete reviews from the app stores themselves - that data is controlled by Google and Apple.

7. Your Rights (GDPR)

Under GDPR, you have the following rights regarding your personal data:

Right	Description
Access	Request a copy of your personal data we hold
Rectification	Request correction of inaccurate or incomplete data
Erasure	Request deletion of your personal data ("right to be forgotten")
Restriction	Request limitation of processing in certain circumstances
Data Portability	Receive your data in a structured, machine-readable format
Objection	Object to processing based on legitimate interests
Withdraw Consent	Withdraw consent at any time (for consent-based processing)

7.1 How to Exercise Your Rights

To exercise any of these rights, please contact us at wojciech@appspeaker.io. We will respond to your request within 30 days.

7.2 Revoking App Store Access

You can revoke our access to your Google Play Developer account at any time:

• Go to your Google Account settings
• Navigate to Security > Third-party apps with account access
• Remove AppSpeaker.io from the list

7.3 Supervisory Authority

If you believe we have violated your data protection rights, you have the right to lodge a complaint with a supervisory authority. In Poland, this is:

Prezes Urzedu Ochrony Danych Osobowych (PUODO)
ul. Stawki 2
00-193 Warszawa
Poland
Website: uodo.gov.pl

8. Cookies and Tracking

8.1 Types of Cookies We Use

Cookie Type	Purpose	Duration
Essential/Session	Authentication, security, session management	Session
Preferences	Remember your settings (language, theme)	1 year
Analytics (Google Analytics)	Understand how users interact with our service	Up to 2 years

8.2 Managing Cookies

You can control cookies through your browser settings. Note that disabling essential cookies may prevent you from using our Service.

8.3 Google Analytics

We use Google Analytics to analyze website traffic. Google Analytics uses cookies to collect anonymized information about your visits. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

9. Children's Privacy

AppSpeaker.io is not intended for users under 18 years of age. We do not knowingly collect personal data from children under 18. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately.

10. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, where our service providers operate.

For transfers outside the EEA, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all processors
• Reliance on adequacy decisions where applicable

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the updated policy on our website
• Updating the "Last updated" date at the top
• Sending an email notification for material changes

We encourage you to review this Privacy Policy periodically.

12. Data Protection Officer

For any questions or concerns about how we handle your personal data, or to exercise your data protection rights, please contact: