Murmurist Privacy Policy
Last updated: 2 July 2026
Who we are (Controller). Murmurist is operated by Shreekar Shetty, sole trader, Dublin, Ireland (“we”, “us”). Contact: privacy@murmurist.com. We are the data controller for the personal data described below.
What Murmurist does. Murmurist connects to your Google Business Profile, reads your customer reviews, uses AI to summarise them and draft replies, and posts only the replies you explicitly approve.
Data we process
- Account data: your name and email address (from Google or Apple sign-in via our authentication provider, Clerk), and your account identifiers.
- Google Business Profile data: your business locations (name, address, category, contact details) and your customer reviews — including review text, star rating, reviewer display names, and your replies. Review content can include personal data of reviewers.
- OAuth tokens: the Google access token that authorises Murmurist to read your reviews and post your approved replies. Tokens are stored by Clerk, never in our database.
- AI processing data: review text and star ratings are sent to Google's Gemini API (paid tier) to generate summaries and reply drafts. Under Google's paid-tier terms, this content is not used to train Google's models.
- Usage and diagnostics: product analytics events (screens used, features tapped) via PostHog, and crash/error reports via Sentry.
Why we process it (lawful bases, GDPR Art. 6)
- Providing the service you signed up for — syncing reviews, generating drafts, posting approved replies, account management: Art. 6(1)(b), performance of a contract.
- Error logging, service security, and product analytics to keep the service working and improve it during the alpha: Art. 6(1)(f), legitimate interests. You may object at any time (contact us).
Processors and where data goes
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database and backend functions | EU (Frankfurt, Germany) |
| Clerk | Authentication and OAuth tokens | USA — EU-US Data Privacy Framework certified |
| Google (OAuth, Business Profile, Gemini API) | Sign-in, review sync, AI processing | USA/global — paid-tier no-training terms |
| Sentry | Error and crash reporting | EU (Frankfurt, Germany) |
| PostHog | Product analytics | EU (Frankfurt, Germany) |
We have data processing agreements (Art. 28) with each processor. Where data leaves the EEA (Clerk, Google), transfers rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses.
Retention
- Review content: kept for 90 days of inactivity, then automatically deleted from our systems. Google Business Profile remains the source of truth for your full history.
- Account data: kept while your account exists.
- Diagnostics/analytics: per Sentry's and PostHog's standard retention (≤ 90 days for events).
Your rights (GDPR Arts. 15–21)
You can request access, correction, deletion, restriction, portability, and object to legitimate-interest processing. Delete your account and all synced data at any time in the app: Settings → Delete Account. For anything else, email privacy@murmurist.com — we respond within 30 days. You may lodge a complaint with the Irish Data Protection Commission (dataprotection.ie).
Reviewers' data
If you are a reviewer whose review appears in a business's Murmurist account: we process your public Google review on behalf of the business's legitimate interest in managing its public reviews. Deleting your review on Google removes it from Google; it leaves our systems within our retention window. To request earlier deletion, email privacy@murmurist.com.
Children
Murmurist is a business tool and not directed at anyone under 16.
Changes
We will post updates to this policy here and note the date above. Material changes will be announced in the app.