Privacy Policy

RepStation is operated by Townsend Marketing LLC, located in St Augustine, Florida. This policy describes information handled through getrepstation.com and the RepStation business management service. Contact: info@townsend-marketing.com. Mailing address: [OWNER TO CONFIRM]. Effective date: [OWNER TO APPROVE].

This is an owner-review draft, not an approved policy. Where a customer supplies information about its contacts, staff or clients, that customer determines its business purposes and is responsible for an appropriate legal basis and notices. The allocation of controller/processor responsibilities and any data-processing agreement require review before publication.

Account information includes email address, first name, business name, profile details, organization membership and account access information. Password registration is handled by our authentication service. Google sign-in can provide an identity and email address; it does not itself authorize Calendar or Gmail access.

Business information includes onboarding answers, services, pricing, hours, brand voice, offers, policies, AI REP configurations and permissions. Workspace information includes CRM contacts and companies, addresses and contact details you provide, opportunities, notes, tags, custom fields, tasks, appointments, operational records, campaigns and saved drafts.

Communications information includes recipients, sender addresses, message text and HTML, subjects, conversation records, consent and opt-out preferences, approval decisions, provider message identifiers, delivery results and errors. Invoicing information includes customers, line items, amounts, due dates and manually recorded payment amounts, dates, methods and recording users. We also hold subscription-plan and complimentary-access records.

Connected-service information and operational information include granted permissions, account identifiers, synchronization state, timestamps, errors, saved conversations with AI REPs and activity records. Do not submit sensitive personal information unless necessary, authorized and appropriate for your use of the service.

Information supports account authentication, organization workspaces, requested business tasks, customer management, scheduling, drafts, approvals, authorized sends, synchronization and troubleshooting. Selected records can be supplied to AI processing when a user requests an AI REP response or business task. Access depends on the requesting user's organization and permissions.

Customers control the records they enter and the services they authorize. A connection listed in the catalog is not necessarily active. RepStation does not represent an integration as connected merely because a provider is listed.

Calendar and Gmail use separate connection consent. Both request openid and email to identify the connected Google account. Calendar requests calendar.calendarlist.readonly to list calendars and calendar.events to read, create, update and delete events on the selected calendar. RepStation presents calendars the account can edit. Gmail requests gmail.send to send email the user has approved. These connections do not request Gmail inbox-reading or Google Contacts permissions; Google Contacts import is not implemented.

Calendar synchronization is initiated on demand. Calendar event titles, descriptions, locations, start and end times and cancellation status can become local appointment records. Appointment changes can be sent back to Google; local appointment deletion queues deletion of the associated Google event on a subsequent synchronization. Recurring events may be received as individual instances. Calendar-derived appointments also participate in the linked Tasks workflow.

Gmail receives the recipient, sender, subject, message body and any reply-to information needed for the approved outgoing email. RepStation stores its draft, approval record and send result, including the provider message identifier. It does not download your Gmail inbox through this integration or create drafts in Google's Drafts folder.

RepStation stores the connected account's identifier and email, granted scopes, selected calendar, synchronization cursor, connection status and error timestamps. Access and refresh tokens are encrypted before application storage and used by server-side code, not returned to the browser. Business appointment and communication copies remain in your workspace until removed through applicable record controls or a reviewed deletion request.

Disconnecting stops future synchronization and sending through that connection, attempts Google token revocation and clears the locally stored tokens and sync cursor. It does not erase existing appointment copies, message records or the account metadata row. You may also remove RepStation's access through your Google account security settings. Removing access does not delete data already saved in RepStation or email already delivered to recipients. To request removal of retained copies, contact info@townsend-marketing.com; deletion scope and timing must be confirmed before publication.

Google API Services User Data Policy, including its Limited Use requirements, applies to use of Google API data. The current Calendar/Gmail implementation uses authorized data to provide scheduling, synchronization and approved email sending. No Google-data advertising or unrelated profiling workflow was identified in the reviewed application code.

Some workspace records can be supplied as context for AI REP tasks. Requests to the AI provider specify store: false; this setting alone does not establish gateway retention or provider training restrictions. A statement that Google user data is never used for model training, or a claim of Limited Use compliance, cannot yet be made from the application code alone.

PRE-PUBLICATION REQUIREMENT: verify and document applicable AI gateway/provider retention, training, human-access and onward-sharing terms; identify any Google-derived data in AI context and either enforce its exclusion or verify permitted feature-specific processing. Confirm no advertising use, unrelated profiling, general model training or prohibited human access. Final Limited Use wording requires owner and legal approval.

Where a customer authorizes Facebook or Instagram through Meta, RepStation can store Page and professional Instagram identifiers, names, granted permissions and encrypted Page tokens. Configured comment-to-DM rules process matching comment identifiers, commenter identifiers/usernames and comment text, and record private-reply results and errors. A customer-enabled rule can send a private reply automatically; not every private reply receives an individual Approval Center review.

Meta controls permission approval, eligibility and messaging restrictions. Availability depends on actual authorization. Local disconnect clears the stored token and stops use of that connection; retained comment/delivery records are not automatically purged. Provider-side revocation is not confirmed by that local action. LinkedIn and Google Business Profile connections are not implemented in the reviewed app; their catalog listings do not mean RepStation accesses those accounts.

AI REPs are software, not human employees. They may process user prompts and selected business knowledge, customer records, conversations and sales, marketing, reputation, customer-care or operations context to support requested work. Prompts and selected context are sent through Lovable's AI gateway to the configured AI provider, currently using an OpenAI-compatible service.

Approval Center governs actions configured to require review, including approved email/SMS sends and many draft workflows. Separately enabled rule-based tasks and Meta private replies have their own controls. Review outputs for accuracy, lawful content and appropriate disclosure before use. Provider contractual retention and training practices remain to be verified; this draft does not promise zero retention or no training.

RepStation's subscription billing and checkout are not switched on in the reviewed implementation. Plan prices and subscription records do not establish a processed charge. Complimentary accounts have their fee waived and do not require a credit card or automatically convert to paid.

Customer invoicing is separate from RepStation subscriptions. Invoices and manual payment entries record business transactions; recording a payment does not collect funds or verify a bank/card settlement. No operational Stripe card-collection flow was found, so Stripe is not described here as an active processor. If payment collection is enabled later, the final policy must identify the actual processor and information shared.

Implemented safeguards include authentication, organization-scoped data policies, member/administrator checks and server-side checks for sensitive actions. External communications credentials and Google/Meta tokens use application AES-GCM encryption and restricted server-side access. Connection status responses do not include these credentials.

These safeguards are not a guarantee against unauthorized access, loss or interruption and do not establish a certification or regulatory compliance claim. Organization members may access records permitted by their role and workspace policies. Hosting encryption, support access, backup protections and operational access reviews require additional verification.

Information is shared as necessary with the service categories used for hosting/authentication/data storage, AI processing, authorized account connections and message delivery. The application uses Lovable/Lovable Cloud and its underlying managed database/authentication services, Lovable's AI gateway and the configured AI provider. Google and Meta receive information for connections you authorize. A customer's connected Resend and Twilio accounts receive email/SMS recipients and content when used. Invitation delivery uses the platform's transactional-email service.

Authorized organization users can see information according to their workspace permissions. Delivered communications also reach their intended recipients, whose subsequent handling is outside RepStation's controls. Requests from authorities or disclosures needed to protect rights must be evaluated under applicable law. Provider legal entities, processing regions, contracts and a complete subprocessor list must be confirmed before publication; this list is an implementation inventory, not a verified contractual register.

The application retains saved workspace records to support ongoing business use; no comprehensive account-erasure workflow or general automatic retention schedule was identified. Some record types offer deletion controls. Revoking complimentary access or disconnecting an integration is not account deletion and leaves existing business records in place.

Request access, correction, export or deletion at info@townsend-marketing.com. We will need to verify your identity and authority for the organization; contact data supplied by a business may require coordination with that business. CRM export covers selected CRM records, not a complete account export.

PRE-PUBLICATION DETAILS: approve a deletion-request procedure, response timing, retention periods, backup/log handling, exceptions for legal obligations and treatment of retained integration copies. No fixed deletion deadline or complete backup erasure promise is made in this draft.

Authentication uses browser storage to maintain sign-in state. The sidebar control can write a sidebar_state cookie with a seven-day lifetime to remember its state. Where Lovable diagnostic hooks are present, errors, stacks and route paths may be forwarded for troubleshooting.

No active Google Analytics or Meta advertising-pixel integration was found in the reviewed app. Hosting-level analytics and log retention have not been verified; the final policy must reflect those practices as well. Clearing browser storage may sign you out or reset preferences.

Rights depend on location, applicable law and the role of the business handling your information. Where applicable, rights may include access, correction, deletion, portability, objection/restriction and withdrawal of consent. Some US state laws may provide rights concerning targeted advertising, sale/sharing, sensitive information and appeals. This draft does not assert that any specific statute applies or that a particular threshold is met.

Send requests to info@townsend-marketing.com. Before publication, confirm jurisdictions served, applicable rights, an authorized-agent and appeals process, response periods and whether any sale/sharing opt-out or universal opt-out handling is required.

RepStation is a business management service, not designed for children. Do not use it to knowingly submit children's personal information without an appropriate lawful basis and required permissions. The account eligibility age and any minors-related data handling procedure require owner/legal approval. Contact us if you believe a child's information was submitted inappropriately.

Connected providers and AI services may process information outside your location. Production hosting regions, provider processing locations and any applicable transfer safeguards are not verified in this draft. Do not treat this policy as evidence of a particular data-residency commitment or approved international-transfer mechanism.

Policy changes will be identified by the Last Updated date. Required notice of material changes and their effective date must be approved before publication. Contact Townsend Marketing LLC at info@townsend-marketing.com. Postal address: [OWNER TO CONFIRM].