This policy explains what personal information TrustSpring collects when you visit gettrustspring.com or use the TrustSpring app, what we do with it, and the choices you have. It also covers information about people who leave reviews for businesses that use TrustSpring.
1.Who we are
TrustSpring (“TrustSpring”, “we”, “us”) provides review management software for local businesses. Businesses connect their review profiles, such as a Google Business Profile, and use TrustSpring to read and respond to their reviews.
For information about your own account and our website, we decide how the information is used. For reviews and other content a business brings into TrustSpring, the business decides what to connect and how to respond, and we process that information on its behalf and on its instructions. Questions about how a particular business handles reviews should go to that business; we will help it respond.
2.Information we collect
Account information
When you sign up we collect your email address and name. We sign you in with a one-time code sent to that email address, so we do not store a password for you. We also record which businesses and locations you belong to and your role in each (owner, admin, member or viewer).
Business and location information
The business name, location names and details you enter during setup, the brand voice guidelines, sign-off and never-say list you save, and your automation settings (for example which star ratings may be answered automatically, hold times and daily caps).
Connected review profiles and reviews
When you connect a location’s review profile, we receive identifiers for that connection and the reviews on it: the reviewer’s public display name and profile image, the star rating, the review text and any photos, dates, and the replies already posted. We keep this in our own database so you can search, filter and answer it. The connection itself is made through our review integration partner; we do not receive or store your Google password or Google sign-in tokens.
Replies and activity records
The replies you write, edit, approve and publish, and a record of who did what: who drafted a reply, who edited it, who approved it, and whether it was written by a person, drafted by AI or sent by an automation rule you enabled. We keep these records so a business can see how every published reply came to exist.
Team invitations
When an owner or admin invites someone, we store the invitee’s email address and the access they were offered until the invitation is accepted, revoked or expires.
Messages you send us
If you email us, for example to ask for a demo or for support, we keep that correspondence and the contact details in it.
Technical information
Like most websites, our hosting provider processes technical data such as IP address, browser type and the pages requested, to deliver the service, keep it secure and diagnose problems. The app uses a small number of cookies that it needs to work; see our Cookie Policy. We do not use advertising cookies or third-party analytics trackers.
3.Google and other review platforms
When you connect a location, you sign in on Google’s own pages and grant access to that location’s Business Profile. The access is held by our review integration partner, not by TrustSpring, and we never see your Google password.
What we use that access for
- reading the location’s name and identifiers, so we can match it to your location in TrustSpring;
- reading its reviews and the replies already posted, and keeping them up to date;
- publishing the replies you approve, or that an automation rule you turned on sends; and
- removing a reply when you ask us to.
We do not use it for anything else. We do not post updates, change your business information, read or send messages, or access any other part of your Google account.
Limited use of Google data
TrustSpring’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use that information only to provide the features described above, we do not sell it, we do not use it for advertising, we do not use it to train AI models, and people at TrustSpring read it only with your permission, for security reasons, or where the law requires.
Removing access
An owner or admin can disconnect a location on the Accounts page in TrustSpring at any time. That stops syncing and publishing straight away; reviews already synced stay as read-only history, as described under How long we keep information. You can also remove the access from your Google Account at myaccount.google.com/connections.
The same principles apply to any other review platform we support in the future.
4.How we use information
We use personal information to:
- create and secure your account and sign you in;
- sync reviews from the profiles you connect, show them to the people you have given access, and publish the replies you approve to those profiles;
- generate AI reply drafts when you ask for one, or when an automation rule you enabled applies;
- enforce roles and permissions, and keep the audit records described above;
- tell you when a connection needs attention or something failed;
- answer your questions and demo requests;
- prevent abuse, investigate security incidents and meet legal obligations; and
- maintain and improve TrustSpring.
We do not sell personal information, and we do not use the reviews or replies in your account to advertise to anyone.
Where the law requires a legal basis for processing, we rely on performing our contract with you (running the service you signed up for), our legitimate interests (keeping the service secure and improving it, answering enquiries), compliance with legal obligations, and your consent where we ask for it.
5.AI-drafted replies
When you press Generate, or when an automation rule you turned on evaluates a review, we send the information needed to write the reply to a third-party AI model provider. That is the review (reviewer name, rating and text), the business and location names, your brand voice settings, and any text already in the reply box. Nothing else from your account is sent.
The provider returns a draft; it does not publish anything. We record each generation request, including who asked for it, so a business can review AI use afterwards. We do not use your data to train AI models, and we use our providers’ business API offerings, whose terms do not allow them to train their models on it.
7.How long we keep information
We keep account and business information for as long as the account is active. When a review profile is disconnected, the reviews already synced stay in the business’s account as read-only history until the business deletes them or closes its account; they are not updated any more. Audit records of replies and AI use are kept for as long as the business’s account exists, because their purpose is to explain what happened later.
When an account is closed we delete or anonymise its personal information within a reasonable period, except where we need to keep some of it to resolve disputes, enforce our agreements or meet legal obligations. Backups are overwritten on a rolling schedule.
8.Security
We use encryption in transit, access controls that limit each person to the businesses and locations they have been given, signed and verified webhooks from our integration partner, and secrets kept out of the database and out of the browser. No system is perfectly secure, so we cannot guarantee absolute security, but we will notify affected users and authorities of a breach where the law requires it.
9.Your choices and rights
Owners and admins can remove members, revoke invitations and disconnect review profiles from inside the app. Depending on where you live, you may also have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to withdraw consent. To make a request, email support@gettrustspring.com. We may need to verify your identity first, and we will not treat you differently for exercising your rights.
If you are in the European Economic Area or the United Kingdom, you can also complain to your local data protection authority.
If you left a review for a business
Your review lives on the platform where you posted it, and changes to it must be made there. The business you reviewed controls its TrustSpring account, so please contact it first. If you cannot reach it, email us and we will pass your request on and help where we can.
10.International transfers
We and our service providers may process information in countries other than the one you live in, including the United States. Where the law requires it, we rely on appropriate safeguards, such as standard contractual clauses, for those transfers.
11.Children
TrustSpring is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.
12.Changes to this policy
We may update this policy as TrustSpring changes. We will change the date at the top of this page, and if a change is significant we will tell account owners by email or in the app before it takes effect.
13.Contact us
Questions or requests about privacy: support@gettrustspring.com.