Heedbird helps businesses understand customer reviews and prepare or publish permitted responses. This policy covers website visitors, the free review analysis, earlier analysis and early-access requests, setting up from this website, and connected business workflows. It explains what data Heedbird accesses, why, where it goes, and how to get rid of it.
In this policy, “you” means a visitor, requester, or business owner using Heedbird. “Reviewer” means a member of the public who has left a review of your business.
What Heedbird accesses
When you connect your Google Business Profile, Heedbird requests the https://www.googleapis.com/auth/business.manage scope. With it, Heedbird reads and writes only the following:
| Data | Why |
|---|---|
| Your business listing details (name, location identifiers) | To know which listing to act on |
| Reviews on your listing — text, star rating, reviewer display name, timestamps, and any existing owner reply | To decide what needs a response, and to avoid replying twice |
| Replies posted by Heedbird | To publish your response |
We also receive your Google account’s email address (the openid and email scopes), to send you the next setup step.
Heedbird does not request access to your Google account beyond these scopes. It does not read your Gmail, contacts, calendar, files, or any other Google service.
Third parties that receive review content
Review content is processed by third-party AI service providers. Heedbird uses these services to analyze reviews and prepare responses. Information shared for this purpose may include review text, star ratings, and relevant business context, such as your preferred tone. See our service-provider information for the providers used and their roles.
Review text may contain a reviewer’s display name and whatever personal details they chose to write publicly. Heedbird does not add any information about the reviewer beyond what is already public on the review.
Depending on which optional features you enable, data also goes to:
- Google — the reply text Heedbird posts to your listing; and, when you set up from this website, what you type into the business search and the sign-in.
- Notification services — when a review needs your decision, or to tell you what Heedbird has done, the review text, its rating, the suggested reply and the reason for flagging it are sent to the notification channel set up for your business.
- Facebook (only if you enable social posting, and only when you approve each post) — a quote card image and caption drawn from a five-star review. Reviewer names are never included in social content.
Heedbird does not sell personal information, does not share it for advertising, and does not use it to build profiles of reviewers.
Google API Services User Data Policy
Heedbird’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained through Google APIs is used only to provide and improve the review-handling features described here, is not transferred to others except as necessary to provide those features (see the section above), is not used for advertising, and is not read by humans except where you have asked us to, where it is necessary for security or to comply with the law, or where the data has been aggregated and anonymised.
Free review analysis
When you look up your business on this website, your browser loads the search results and the reviews directly from Google Maps (see Google’s privacy policy). Heedbird stores nothing from them, except the business’s place ID, which your browser keeps in session storage while the page is open.
“Try it” and “Paste your own”
The examples in the “Try it” section are built into the page and send nothing. If you choose “Paste your own”, the text you paste goes to our server. It removes page clutter, the reviewer names it can recognise, email addresses and phone numbers, then sends what is left to our AI provider to produce one example (see service-provider information). We don’t save or log the pasted text or the example. Names written inside a message are not always removed, so please don’t paste anything private.
To apply a daily limit, our server keeps a one-way, keyed hash of your IP address and how many tries it used that day. It does not store your IP address in readable form, and it deletes these records after two days. We also keep daily totals of how many tries were made, with no text and no IP address.
“Email me a link”
If we can’t connect right away, you can ask us to email you a link to come back and finish. Our website holds your email in encrypted form that only our own system can read, until that system collects it: usually within seconds, and never longer than 14 days. We then send you one email with your link. We delete your address within 90 days of sending it, or 30 days after we first received it if we haven’t sent it. To have it deleted sooner, use the data deletion page.
Homepage request form
Requests made on our homepage request form (a Google link, your email, and optionally the business name, the page the request came from and campaign tags) are emailed once, when the free analysis is available, and deleted within 90 days of that email. Requests we can’t answer are deleted 30 days after the analysis becomes available. Copies of earlier request notifications in our contact mailbox are deleted when the request is.
The request record does not include your IP address. To prevent abuse, the form applies a short-lived rate limit that does not store your IP address in readable form. Our hosting or email providers may separately process connection information and service logs to deliver and secure their services. You can ask us to delete your request at any time using the address below.
Optional early-access updates
The form no longer offers early access. If you chose “Join early access” earlier, we stored that choice along with your email, business link and optional name, request source, campaign tags, and timestamps, and used it to contact you about Heedbird’s availability. To unsubscribe or delete the signup, email us using the address below.
Browser storage
Optional campaign tracking is off unless you select “Accept optional”. If you accept, the website remembers campaign tags in session storage and includes them with your form submission. If you reject or have not chosen, these tags are not retained for attribution or included with your request. The form works either way.
Setting up from this website uses the sign-up cookie (__Host-hb_start, deleted after 6 hours at most) and, in this tab only, session storage for which setup step you are on and the business’s place ID.
We store your Accept or Reject preference, with the date you chose, in your browser’s local storage for 6 months, so you aren’t asked again in every tab or visit. Use “Cookie & storage settings” in the footer to change it. Rejecting later clears saved campaign tags and stops their inclusion in future requests; it does not remove tags already submitted. You can request deletion of earlier records by contacting us. If browser storage is unavailable, optional campaign tracking stays off. The website does not include third-party advertising pixels or analytics scripts. The business search and the free review analysis are requests your browser makes to Google Maps Platform, a third party.
Facebook Page data
If you configure Facebook publishing, Heedbird stores the Page identifier and access credential, prepared captions and quote-card images, and publication records such as the resulting post identifier. These are used to publish content to your configured Page after you approve it. This workflow does not read private Facebook messages or your personal feed. Formatting drafts for other social services does not give us access to accounts on those services.
Learning for your business
Heedbird uses your business’s preferences, feedback, approved edits, and recorded outcomes to personalize recommendations and responses for your business. This means using relevant business context when preparing future work, rather than treating every request as a fresh start.
This personalization is specific to your business. It does not authorize using your business’s data to personalize another business’s service or to train or fine-tune a shared AI model. Any separate use would require its own assessment of applicable permissions and provider restrictions, updated disclosures, and consent where required.
Personalization records are handled as connected-account data under the retention and deletion provisions below. You can ask us to correct or delete this stored context using our contact address.
What is stored, and where
- Reviews and replies — stored so Heedbird can tell new reviews from ones it has already handled, and keep a record of what it did.
- Your business configuration — business name, listing identifiers, tone preferences, and brand colours.
- Business context for personalization — preferences, feedback, approved edits, and recorded outcomes used to tailor work for your business.
- Your contact for decisions — the account identifier used to reach you on your notification channel and to confirm that a decision came from you.
- Permissions you set — which kinds of replies Heedbird may post automatically, and any changes you make to them.
- Access credentials — the authorization token for your Google account, plus any notification or Facebook credentials you provide. These are stored securely and are never displayed back to you or written into logs.
- An action log — a record of every reply posted, notification sent, or post published, including whether you approved it or it was posted under a permission you set. This exists so that any action taken on your behalf can be accounted for.
- Follow-up records — later checks on what happened after an action, used to improve future work for your business.
Data is held on infrastructure Heedbird controls. Connected-account records are kept for as long as your account is active, unless you request deletion. Website requests are kept for the times described above. You can request removal at any time.
Deleting your data
Follow the data deletion instructions to request removal of website requests, early-access signups, or connected-account data, including Facebook Page data. No Heedbird login is required to make a request.
You can disconnect at any time by revoking Heedbird’s access from your Google account permissions page. That immediately stops Heedbird reading your reviews or posting on your behalf.
To have stored data deleted as well, email the address below. Reviews, configuration, and credentials for your business will be deleted. Replies already published to Google or Facebook are public and must be removed through those platforms directly — Heedbird cannot retract them for you.
Children
Heedbird is a tool for businesses and is not directed at children.
Changes
If this policy changes in a way that affects how your data is handled, the date at the top will change and connected businesses will be told directly rather than being left to notice.
Contact
Questions about this policy, or requests to delete data: hello@heedbird.com.