The fine print, in plain English

Privacy Policy

effective September 30, 2026

WinBack Reviews ("we", "us") is a small business run by a real person. This page explains exactly what information we handle when you use our website and service at winbackreviews.com or aireviewresponce.com, and what we do with it. Short version: we collect the minimum needed to run the service, we never sell your information, and there are no ads or trackers here.

Jump to: if you used a business's website, chat or review email · cookies · deleting your data

What we collect

• If you join the waitlist or try the free tools: your name, business, email, and phone or a note if you add them, so we can tell you when WinBack opens. Nothing else, unless you tick the box for a few more emails (see below).
• What you give at checkout: your email address, phone number and business name, so we can reach you and set up the service. You don't create an account or a password.
• Your subscription status: whether your plan is active, so we know to keep replying. Payments are handled entirely by Stripe, and we never see or store your card number.
• Your reply settings: your business name, type and voice notes, which replies you'd like to approve first, and whether you'd like an email when replies go out.
• Connected accounts: when we connect your Google Business Profile, we store the access Google gives us, encrypted, and use it only to read your new reviews and post replies to them. You can ask us to disconnect at any time, and you can also remove our access from your Google settings yourself.
• Reviews and replies: to answer reviews automatically, we read the reviews on the places we've connected for you, send each one to our AI provider to write the reply, and keep a record of recent replies (the review, what we posted, and when). If you rate a reply or rewrite one before it posts, we keep that too (your last few rewrites, and your notes), so replies can be matched to how you write.
• Reviews left through your website's review box: the reviewer's name, star rating, review text and the reply are stored so they can be shown on your site. We don't ask reviewers for an email address or set cookies on them.
• Chat on your website: what a visitor types is sent to our AI provider so it can answer from the facts you gave us. Conversations aren't stored. If a visitor leaves their details, their name, phone or email and message go to you by email (with the conversation) and into your list of leads (the latest 200).
• Your free WinBack website: a booking request's name, phone or email, what they need and when goes to you by email and into your list of leads. If the visitor gave an email address (here or in the chat), they get one short confirmation in your business's name. We count visits to the page, not who visited. Photos you add are stored with us and shown on your site; the words on it are what you (or the AI, at your request) wrote.
• Your customers' emails: the emails you give us for review requests (a pasted list, a Square sale, a copied invoice) are kept in a customer list with the date we last saw each one. If you switch on "win back lost customers", a customer who hasn't been back in a while gets one "we miss you" email in your words, at most once every six months. Anyone who unsubscribes from your emails never gets another. A customer not seen for two years is dropped from the list.
• The homepage demo: a review you paste there is sent to our AI provider to write the example reply. We don't store it.
• Messages you send us: if you use the contact form, we receive what you write, plus the name and contact details you include, by email.
• Cookies: only the few needed to sign in and remember your page, never for advertising or tracking. The full list is below.

Data from Google

When a business connects its Google Business Profile, we use Google's data only to read that business's reviews and overall rating, post the replies it has asked for, and, if the business switches it on, publish a short thank-you post on its profile twice a month. We don't use it for advertising, don't sell it, and don't let people read it except where needed for security, to comply with the law, or with the business's permission. WinBack Reviews' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove our access at any time from your Google account's security settings.

Approval links

If you choose to approve some replies first, we email you a private link for each one. Anyone with the link can approve, edit or skip that one reply, so please don't forward it. Each link works once and expires after 30 days.

Your private page link

Our emails to you include a link to your own WinBack page, where you can see your replies and change a few settings without signing in. Anyone with that link can do the same, so please keep it to yourself. Ask us any time and we'll replace it; the old one stops working.

Referral links

If you arrive through a customer's referral link, the site remembers which customer sent you in your own browser (local storage, not a tracking cookie) for 60 days, and passes it along if you join the waitlist, get in touch or subscribe. That's only used to thank the person who referred you.

Reviews we quote

With a business's permission, WinBack can quote its public 4 and 5-star Google reviews in a thank-you post on its Google profile, or show them in the review box on its website, always with first names only. It never does this for healthcare or legal practices, or for reviews that mention injuries, legal matters or similar. The same rules apply when WinBack suggests a business's recent 4 and 5-star reviews as social media posts: the business decides whether to share them, and WinBack posts nothing itself.

Emails about WinBack itself

If you join the waitlist, we email you once to confirm and once the day WinBack opens. If you also tick the box asking for a few emails about how it works, you get three short ones over two weeks and then no more. They stop early if you reply or use the stop link at the bottom of each one. We count clicks on the links in those three emails, so we know which ones are useful; nothing else is tracked.

If you used a business's website, chat or review email

WinBack runs websites, chat boxes and review emails for small businesses. When you use one, the business decides what's done with your details and we handle them on its behalf:

• A booking request or the chat's "leave your details": your name, phone or email and message go to that business only, by email and into its list of leads (its latest 200). If you gave an email, you get one short confirmation from the business. We never contact you for ourselves or add you to any list of ours.
• What you type in a chat is sent to our AI provider to write the answer, and isn't stored. The answers are written by AI from the facts the business gave us, so check anything important (prices, times) with the business.
• A review request or "how did we do?" email: the business gave us your email because you're its customer. Every email has an unsubscribe link, and unsubscribing stops all emails from that business through us, for good.
• No cookies are set on a business's WinBack website, chat or review box, and nothing tracks you across sites.

To have your details deleted, ask the business, or email drew@winbackreviews.com with the business's name and the email or phone you used, and we'll delete them within 30 days.

Review request emails

If a business asks us to, we email its customers a short request for a review on its behalf. We use those email addresses to send that request and at most one reminder, and, only if the business switches it on, the occasional "we miss you" email described above. The request records are deleted after 180 days. Every email has an unsubscribe link, and once someone unsubscribes, that business can't ask them through us again. The business is responsible for having a relationship with the people it gives us.

The services that help us run this

Like nearly every online business, we rely on a few trusted providers, and only send each one what it needs to do its job:

• Groq: writes the replies. It receives review text and your business details, solely to produce replies.
• Google: to read your Google reviews and post the replies, once connected.
• Resend: sends our emails (reply summaries and approval requests).
• Stripe: processes payments and manages subscriptions. Your card details go directly to Stripe, never to us.
• Upstash: hosts our database (your details, reply settings, encrypted connections, recent replies).
• Render: hosts the service itself.
• Google Fonts: our own pages (not the businesses' websites or chat) load their typefaces from Google, so your browser's address reaches Google when it fetches them. Google says it doesn't set cookies or use this for advertising.
• Google Places: when you use the free review audit, the business name you type is looked up on Google to find its public reviews.

We do not sell or rent your personal information to anyone, ever, and we don't share it for advertising.

Cookies and what's saved in your browser

No advertising, analytics or tracking cookies, so there's no cookie banner to click through. Only these, each needed for something you asked for:

• arr.sid and arr_auth: keep the owner signed in to the admin pages (30 days). Set only when someone signs in.
• wb_client and wb_c: remember a client's private page on this device, so the "Your page" link works (180 days). wb_client_no remembers that you chose "forget this device".
• wbRef (saved in your browser, not a cookie): which customer referred you, for 60 days, if you came through a referral link.
• A few preferences saved in your browser on our own tool pages: a half-typed form so you don't lose it, and which list filter or banner you last chose. They never leave your device.

You can clear any of these from your browser settings at any time; the only effect is signing you out or forgetting a preference.

How long we keep things

Your details are kept while you're a customer, and deleted within 30 days of your asking. We keep your 200 most recent replies, plus the reviews left through your website's review box for as long as you keep the box on your site. Disconnecting an account deletes our copy of its access.

Your choices & rights

• You can cancel your subscription anytime from Stripe's billing page, or by asking us.
• You can ask us to delete your information: press "Delete my data" at the bottom of your WinBack page, or email drew@winbackreviews.com. It's done within 30 days (after cancelling, if you're still subscribed), and we email you when it is. Stripe keeps its own billing records, as the law requires.
• You can ask what information we hold about you and get a copy (your page also has "Download all my reviews and replies"), or ask us to correct it. We answer within 30 days, wherever you live, and never treat you differently for asking.

Security

Everything travels over encrypted connections (HTTPS), access to connected Google accounts is stored encrypted, and approval links are stored only in a scrambled (hashed) form.

Children

This service is for businesses and isn't directed at anyone under 16, and we don't knowingly collect information from children under 13. If you think a child has given us their details (say, through a business's chat or booking form), email us and we'll delete them.

Changes

If we change this policy, we'll update this page and the date at the top.

Contact

Questions? Email drew@winbackreviews.com or call (401) 297-8170.