← Cheers

Privacy Policy

Effective September 7, 2026

This policy explains how WKSJ Inc. (“we”) handles information for Cheers (the “Service”).

1. Information we collect

  • Account: your email and authentication details.
  • Google Business Profile data: when you connect Google, we access your business locations and reviews to draft and post replies. We store an encrypted access token and the locations you select.
  • Billing: subscription status and payment metadata. Card details are handled by Stripe — we never see or store full card numbers.
  • Cheers Intelligence (if enabled): the competitor businesses you add (name and address) and the analysis we derive from your reviews — sentiment, topics, dish mentions, and your reply-voice profile.
  • Usage: basic events (e.g. drafts generated, replies posted) to operate and improve the Service.

2. How we use it

To provide the Service (generate drafts, post replies, manage credits and subscriptions), to secure and improve it, and to communicate with you about your account.

3. Legal bases (GDPR)

Where the GDPR applies, we rely on these legal bases:

  • Account creation: performance of a contract.
  • Review drafting & posting: performance of a contract.
  • Billing & subscriptions: performance of a contract.
  • Security & abuse-prevention logs: legitimate interest.
  • Marketing emails: consent or legitimate interest.

4. Service providers

We share data only as needed with the processors that run the Service. Each acts on our instructions and only for the purpose listed:

  • Google (Business Profile): your locations, reviews, and the replies you post — the source of the reviews you work on and the destination for the replies you approve.
  • Anthropic (Claude): review text and, for Reply Voice, your own past replies — used to analyse individual reviews, write your weekly digest, summarize competitor reviews, and distil your reply voice.
  • Cloudflare: hosting and Workers AI, the model that turns a review’s text into a draft reply.
  • Google Places API: the competitor businesses you add — we send the business name and address you enter and receive that business’s public profile and a small sample of its public review text.
  • OpenAI: an alternative draft model, used only if enabled for your account. When it is, review text is sent there instead of to Workers AI.
  • Stripe: payments and subscription status.
  • Supabase: database and authentication.
  • Resend: operator alert emails about system health. These contain no customer, review, or reply content.

We use these AI providers to process your data, not to learn from it: review text and replies are sent to Anthropic and Cloudflare Workers AI (and to OpenAI only if it is enabled for your account) under terms that do not permit training their models on your data. We don’t sell your personal information.

5. Google user data & Limited Use

When you connect Google, we access your Google Business Profile data (your locations and reviews) solely to provide the Service — drafting and posting the replies you approve. Cheers’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not use Google data for advertising, do not sell it, do not use it to train generalized AI/ML models, and limit human access except as needed to provide or secure the Service or as required by law.

Where Google user data goes: it is stored by Supabase, served by Cloudflare, and — for the review text itself — sent to Anthropic and to Cloudflare Workers AI (or OpenAI, if enabled for your account) so they can draft and analyse replies on our behalf. Those providers are bound by terms that do not permit training their models on your data, and none of them receives Google user data for any other purpose.

6. International transfers

Some processors (e.g. Google, Anthropic, Cloudflare, Stripe, Supabase, OpenAI, Resend) may process data in the United States or other countries. Where required, such transfers are made under an appropriate safeguard (e.g. Standard Contractual Clauses or the EU-US Data Privacy Framework).

7. Data security

We use commercially reasonable administrative, technical, and organizational measures to protect information (including encryption of stored access tokens). However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Retention

We keep your data while your account is active and as needed to provide the Service and meet legal obligations.

9. Account deletion

Upon a verified account-deletion request, we delete or anonymize your personal information within a reasonable period, unless retention is required for legal, tax, dispute-resolution, fraud-prevention, or security purposes.

10. Your rights

Subject to applicable law, you may exercise the following rights:

  • Access — obtain a copy of your data.
  • Correction — fix inaccurate data.
  • Deletion — request erasure.
  • Portability — receive your data in a portable format.
  • Restriction — limit certain processing.
  • Objection — object to certain processing.
  • Complaint — lodge a complaint with your data-protection regulator.

To exercise any right, reach us via the “Report an issue” option in the app. You can also disconnect Google at any time (revoking our access) and cancel your subscription from the billing portal.

11. California privacy rights

If you’re a California resident, you have the right to know, access, correct, and delete your personal information, and to opt out of its “sale” or “sharing.” We do not sell or share your personal information, and we won’t discriminate against you for exercising these rights. To make a request, use the “Report an issue” option in the app.

12. Contact

Reach us via the “Report an issue” option in the app.

WKSJ Inc., 875 3rd Ave, New York, NY 10022.