Application privacy policy

Who is responsible for your data

WEBAVIS.AI, a French SASU with share capital of €1,000, 92 rue Baudin, 92300 Levallois-Perret, France — Nanterre Trade and Companies Register 131 492 878. Contact for any question about your data: contact@webavis.ai

WEBAVIS is the controller for your account: email address, password, sign-in, preferences. For the data a business entrusts to us — its Google listing, its customers' reviews, the contact details of the customers it asks for a review, its team members — WEBAVIS processes it on the business's behalf and on its instructions.

The data we process

Your account: email address, password (never stored in readable form: it is transformed with Argon2, which cannot be reversed), interface language, when your address was confirmed, and your roles and rights in each business you can access.
If you sign in with Google: your Google account ID, email address, first and last name as Google provides them, and language. We request only the “openid”, “email” and “profile” permissions.
Your team: the email address of the people you invite and the proposed role. An invitation expires after 7 days.
Your customers' reviews: for each review, the author's display name on Google, the rating, the text, the date and any reply.
The customers you ask for a review: first name, email address or mobile number, language of the message, the record of their agreement (who collected it, when, with what wording) and how far the request has gone. See the section “Customers asked for a review”.
Content you prepare: drafts of replies, posts, FAQs and city pages, with who approved them and when.
Measuring your visibility in AI engines: the questions asked, the answers received, the sources cited and the businesses named.
A log of sensitive actions (invitations, changes of role, access or primary owner, deletions, data downloads): who did what and when. It protects the account and cannot be altered, except that email addresses are removed after 12 months or when an account is erased.
To limit abuse, attempts are counted per IP address for at most one hour, then forgotten. No IP address is stored in your account.

We collect no payment data today. Payments, when they open, will go through Stripe, and this page will be updated first.

Your Google listing and Google APIs

When you connect your Google Business Profile, you authorise access on Google's consent screen (the “business.manage” permission).

What we read:

the list of your accounts and listings, so you can choose the one to connect;
the listing's information: name, categories, description, website, opening hours, address, phone, and the number of photos;
the reviews on the listing and their replies.

What we write, and only after an authorised person in your business approves it: review replies and posts. Nothing else on your listing is changed.

This information is used only for the features you see in WEBAVIS: your score, your task list, your reviews, your replies, your posts and your public pages. A copy of the listing is saved at each nightly sync to follow how it changes. Google access tokens are encrypted in our database.

WEBAVIS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. In practice: we do not sell this data; we do not use it for advertising; we pass it only to the providers those features need (see “Who receives your data”); it trains no AI model; and nobody at WEBAVIS reads it except with your agreement, for the security of the service, or to comply with the law.

You can withdraw access at any time: from WEBAVIS, by disconnecting your listing — we then revoke the authorisation at Google and erase the tokens — or from your Google account (myaccount.google.com/permissions).

Why, and on what legal basis

Creating and running your account, signing you in, sending service emails; connecting your listing, computing your score, showing your reviews; asking, on your instructions, the customers who agreed to it for a review; drafting suggestions with an AI engine; measuring your visibility in AI engines; publishing, on your approval, your replies, posts, city pages and FAQs: performance of the contract (GDPR Art. 6(1)(b)).
Securing the service — action log, attempt limits, error detection: legitimate interest in protecting the service and its users (Art. 6(1)(f)).
Meeting legal obligations (invoicing, requests from authorities): legal obligation (Art. 6(1)(c)).

We sell no data, show no ads and do no advertising profiling.

Artificial intelligence

WEBAVIS offers drafts written by an AI engine: review replies, posts, FAQs and city pages.

What the engine receives: your business's name and category and, depending on the draft, the text and rating of the review to answer, a page's trade, city and service, the questions already published, and any instructions you add. A review author's name is never sent, nor your email address, nor any account identifier.
Nothing is published without you: a draft stays a draft until an authorised person in your business approves it.
The drafting engine in service is OpenAI (OpenAI, L.L.C., United States). Data sent through its API is not used to train its models and is kept for at most 30 days for abuse monitoring.
To measure your visibility, we send OpenAI, Google Gemini (Google LLC) and Anthropic (Claude), weekly or monthly depending on your plan and whenever you start a measurement, up to five questions — built from your trade and town, or written by you — then their answers to extract the businesses named. We add neither your business's name, nor your reviews, nor any personal data.

If we bring another engine into service, this page will say so first.

Who receives your data

The WEBAVIS team, to run and support the service, as far as necessary. Its operations console shows neither your reviews nor your listing's content.
Members of your business, according to the rights you give them.
OVH SAS (France) — hosting of the application and its database, on a server in Strasbourg; backups in Roubaix.
Google (Google LLC, United States) — Google sign-in, access to your listing, and visibility measurement with Gemini.
OpenAI (OpenAI, L.L.C., United States) — drafting and visibility measurement, within the limits described above.
Anthropic (Anthropic, PBC, United States) — visibility measurement with Claude, within the limits described above.
Resend (Resend, Inc., United States) — sending service emails, including review requests to your customers: the recipient's address and the message.
Twilio (Twilio Inc., United States) — sending review requests to your customers by SMS: the recipient's number and the message, processed in Twilio's European region, in Ireland.
Sentry (Functional Software, Inc.) — error detection for the application and the public pages: technical reports, without cookies or form contents; we remove your email address and IP address from them. Stored in the European Union (Frankfurt).
Better Stack checks from outside that our services respond; it receives no personal data.

What becomes public, and only on your approval: city pages and FAQs published on pro.webavis.ai show your business's name, trade, address, phone, website, opening hours, Google rating and number of reviews. Approved review replies and posts are published on Google under your business's name. Review authors' names and review texts are never published on pro.webavis.ai.

Between businesses: if you try to connect a listing already managed in another WEBAVIS workspace, and only if Google confirms you manage it too, you are shown that workspace's name and its owner's email address. If you ask them for access from WEBAVIS, they receive your name and email address by email.

Transfers outside the European Union

The server hosting the application and its database is in France, and so are its backups.

Google, OpenAI, Anthropic, Resend and Twilio are established in the United States. Sentry error reports are stored in the European Union.

Review authors

If you left a review on the Google listing of a business that uses WEBAVIS, that business sees your review in WEBAVIS as it does on Google: your display name, rating and text. The business is responsible for this processing; WEBAVIS acts on its behalf.

Your name is sent to no AI engine and is published nowhere by WEBAVIS. The text of your review may be sent to the AI engine to suggest a reply to the business, which reads it before anything is published. If you delete your review on Google, it is deleted from WEBAVIS at the next nightly sync.

To exercise your rights, contact the business, or contact@webavis.ai and we will pass it on.

Customers asked for a review

A business that uses WEBAVIS may send you an email or an SMS after your visit inviting you to leave a review on its Google listing. It does so only if you agreed to be contacted: the business attests to it when it adds you, or you say so yourself on its form. The business is responsible for this processing; WEBAVIS acts on its behalf.

What we keep: your first name, your email address or mobile number, the language of the message, how your agreement was collected (by whom, when, with what wording), when messages were sent, and whether you followed the link to Google. We do not know whether you left a review or what you wrote, and we do not try to find out.

You receive at most two messages: the request, then a single reminder, which is not sent if you have already followed the link. Messages go out Monday to Saturday, between 9 am and 8 pm. The wording is the same for every customer: it offers nothing in return and suggests no rating. Your contact details are sent to no AI engine and are used for nothing else.

Every message has a link to stop being contacted: one click is enough, and it is final for that business. To remember it without keeping your address, we keep an irreversible fingerprint, specific to that business, from which the address cannot be recovered.

SMS messages are sent under the name “WEBAVIS” by our provider Twilio, and begin with the business's name. They cannot be replied to: to stop being contacted, follow the link in the message.

To exercise your rights, contact the business, or contact@webavis.ai and we will pass it on.

How long

Account and business: while they are active. A deletion takes effect at once — access closed, public pages taken down, Google access revoked — and the data is erased for good 30 days later; until then, support can undo the deletion at your request.
Reviews, replies, listing copies and visibility measurements: while the business exists; erased with it. Disconnecting the listing stops the sync but does not delete them.
Review requests: the customer's first name and address or number are erased 90 days after the last message sent, or after the request is stopped or cancelled — the business can also erase them at once. What stays is the status, the dates and the record of the agreement, with nothing that identifies the person. A stop is kept, as a fingerprint, while the business exists.
Invitations: deleted 90 days after acceptance, withdrawal or expiry.
Sensitive-action log: email addresses are removed after 12 months; the record of what happened is kept.
AI engine usage log (date, engine, volume and cost, business name, no content at all): kept for our accounts.
Session tokens: 30 minutes (access) and 7 days (refresh); expired tokens are purged every night.
Per-IP attempt counts: at most 1 hour.

Security

Encrypted connections (HTTPS) on all our domains; passwords transformed with Argon2; Google tokens and access keys encrypted in the database; 30-minute sessions renewed for at most 7 days; mandatory email confirmation; access rights defined action by action, and each business sees only its own data; nothing is published without approval by a named person.

Cookies

The application uses only cookies it needs to work or to remember your preferences: no advertising cookies, no audience measurement, no third-party trackers. So no consent is required.

webavis_access — keeping you signed in (session token): 30 minutes.
webavis_refresh — renewing the session without asking for your password again: 7 days.
webavis_oauth_state and webavis_gbp_state — protecting Google sign-in and connection against forgery: 10 minutes.
webavis_locale — remembering your language: 1 year.
webavis_theme — remembering light or dark: 1 year.

The application also keeps, in your browser, the language you prefer for review replies. Public pages on pro.webavis.ai set no cookies.

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. In the application, you can download your data and your business's data, and delete your account or your business. For anything else, write to contact@webavis.ai: we answer within one month.

You may lodge a complaint with the CNIL — 3 place de Fontenoy, 75007 Paris, cnil.fr.

Changes

We will tell you about any significant change to this policy by email or in the application, before it applies.