Skip to content
Review Automation Manager
DE/EN

Privacy Policy

Last updated: 18 Oct 2026

Highlighted items must be confirmed by the operator before publication.

1. Controller and contact details

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Mustafa Eren
Kirchenweg 2
5071 Salzburg, Austria
Phone: +43 660 1111400
Email: app@komutan.at

Data protection officer: to be confirmed by the operator: not appointed / appointed.

2. Scope of data processing

This policy covers (a) visits to this website and (b) the operation of Review Automation Manager, which processes reviews of Google Business Profiles for which an authorised person has explicitly granted access.

Review Automation Manager is software privately developed by the operator for their own use; it is not publicly offered, sold or provided by subscription. Because it processes personal data of third parties (in particular reviewers), it is not assumed that the exemption for purely personal or household activities (Art. 2(2)(c) GDPR) applies; this policy therefore applies in full.

The application may process the following categories of data:

  • Google Business Profile information (e.g. business name)
  • Account and location identifiers
  • Review identifiers
  • Public display name of the reviewer
  • Star rating
  • Review text
  • Review timestamps
  • Generated reply texts
  • OAuth authorisation data (access and refresh tokens)
  • Technical processing and error logs

3. Processing when visiting the website

When you visit this website, the hosting provider processes technically necessary data (e.g. IP address, time, requested page, browser information) to deliver the website and ensure its security. The website is provided via the Lovable platform.

This website uses no analytics or tracking tools and no contact form. Contact is by email; we process the data you send to answer your enquiry.

4. Google OAuth 2.0 and permissions

Access to Google Business Profiles takes place exclusively via Google OAuth 2.0 with the explicit consent of an authorised person. The requested scope is:

https://www.googleapis.com/auth/business.manage

  • It enables authorised access to Google Business Profile data.
  • The application uses it to read reviews of the relevant profiles.
  • The application uses it to publish review replies through the authorised profile.
  • Technically, this scope may also allow other Google Business Profile management operations. The application uses it to process and reply to reviews.

The application does not collect Google account passwords.

The OAuth authorisation only grants technical data access. Automatic review replies additionally require the prior, specific and express consent of the business owner (see Terms of Use, section 4).

5. Data from Google Business Profile

New reviews are notified by Google Business Profile and retrieved by the automation. The data listed in section 2 is processed to generate a reply, take existing replies into account and publish the reply through the authorised profile.

Google API Services User Data Policy: The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The data is used solely to provide the features described, is not sold, is not used for advertising, and is shared with service providers only to the extent described in this policy.

6. AI-assisted processing via OpenAI

To generate replies automatically, review texts, star ratings, reviewers' public display names and related business information are sent to and processed by OpenAI via the OpenAI API.

Provider: OpenAI (for users in the EEA: OpenAI Ireland Limited, Dublin, Ireland; possibly affiliated companies in the USA). Processing may take place outside the EU (see section 11). Data processing agreement (DPA) with OpenAI in place: to be confirmed by the operator.

AI-generated replies may contain errors. Replies are published automatically within the authorisation; not every reply is necessarily reviewed by a human.

7. Google Cloud as technical service provider

The application runs on Google Cloud Platform (Google Cloud EMEA Limited, Ireland / Google LLC, USA):

  • Cloud Run – runs the automation (retrieval, reply generation, publishing).
  • Pub/Sub – receives notifications about new reviews; messages may contain account, location and review identifiers.
  • Secret Manager – stores OAuth tokens and credentials.
  • Cloud Storage – stores configuration and processing data (e.g. information about reviews already processed).
  • Cloud Logging – processing status and technical error logs, which may contain identifiers and possibly excerpts of processed content.

Region(s) used: to be confirmed by the operator. We do not claim that all data is stored exclusively in the EU.

8. Access tokens and technical security measures

OAuth tokens are stored in Google Cloud Secret Manager. Access to cloud resources is restricted to authorised operator accounts. Data is transmitted encrypted (HTTPS/TLS). No tokens, keys or review data are stored or displayed on this website.

Despite appropriate measures, no system can guarantee absolute security.

9. Purposes and legal bases

  • Operating the software for authorised business profiles – legal basis: to be confirmed by the operator / legally reviewed.
  • Processing personal data of reviewers (display name, review text) to reply to public reviews – presumably Art. 6(1)(f) GDPR (legitimate interest in replying to public reviews) – to be legally reviewed.
  • Operation, security and error analysis – Art. 6(1)(f) GDPR.
  • Answering email enquiries – Art. 6(1)(b) or (f) GDPR.

Allocation of roles (e.g. operator as controller, joint controllership or processing on behalf of the owners of the relevant profiles) and legal bases: to be legally reviewed and confirmed before publication.

10. Recipients and processors

  • Google (Google Business Profile API; Google Cloud Platform)
  • OpenAI (reply generation via the OpenAI API)
  • Hosting provider of this website (Lovable)

Published replies are publicly visible on the relevant Google Business Profile. Data is not shared for advertising purposes.

11. International data transfers

Using Google and OpenAI may involve transfers to third countries, in particular the USA. Possible bases are the adequacy decision for the EU-US Data Privacy Framework (where the recipient is certified) or EU Standard Contractual Clauses.

Transfer mechanisms actually relied on per provider: to be confirmed by the operator.

12. Retention and deletion

Data is stored only as long as necessary for the stated purposes and in line with Google's policies on storing content from the Google Business Profile API.

  • OAuth tokens: until the permission is revoked or use ends – deletion period after revocation to be confirmed by the operator
  • Data on processed reviews and replies (Cloud Storage): to be confirmed by the operator
  • Technical logs (Cloud Logging): to be confirmed by the operator
  • Data sent to OpenAI: according to OpenAI API retention policies – to be confirmed by the operator
  • Email enquiries: until resolved, unless statutory retention obligations apply

13. Cookies and similar technologies

This website does not use cookies for analytics, marketing or tracking. Should non-essential technologies be used in future, this will happen only after your consent.

14. Rights of data subjects

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), and the right to withdraw consent.

You have the right to lodge a complaint with a supervisory authority; in Austria: Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

15. Revoking permissions

Google access can be revoked at any time at https://myaccount.google.com/connections. Revocation stops future access; deleting data already processed is a separate process and can be requested by email to app@komutan.at.

16. Contact for privacy requests

Please send requests to app@komutan.at with the subject “Privacy”.

17. Changes to this privacy policy

We update this policy when the application or the law changes. The version published on this page applies. In case of doubt, the German version prevails.

Review Automation Manager is an independent application and not a product of Google LLC. Google Business Profile and Google are trademarks of Google LLC.