Privacy Policy

Who operates this service

WellRegard is operated by Adeen ur Rehman, an individual solo founder based in Punjab, Pakistan. WellRegard is not currently operated through a registered company or incorporated legal entity.

Scope of this policy

WellRegard is a tool for businesses, agencies, and multi-location operators to connect their Google Business Profile, Facebook Page, and Instagram professional account so WellRegard can help read, draft replies to, and — with a person's approval — post replies to reviews and comments on those accounts. This policy describes how WellRegard handles information for that product.

WellRegard also separately operates a founder-run demo and Report Card tool, where business and review information is entered manually rather than connected through an account. Its own information handling is described in the Demo and Report Card tool section below.

Who this service is for

WellRegard is intended only for use by businesses, agencies, and other organizations, and by people 18 years of age or older authorized to act on their behalf. It is not intended for direct consumer or personal use, and it is not directed at children.

Account and organization information

Creating a WellRegard account requires an email address and password, handled by WellRegard's authentication provider, Supabase. Setting up an organization requires a business name. WellRegard also stores which organization a person belongs to and their role within it (for example, owner or team member), and uses a session cookie to keep a person signed in.

Connecting Google, Facebook, or Instagram

This section describes what WellRegard is designed to do when a business connects one of these accounts. It does not represent that every one of these integrations is already available to the public in a live production environment as of this policy's effective date.

When an authorized person connects a Google Business Profile, Facebook Page, or Instagram professional account, WellRegard receives and stores only the information that connection's authorization (OAuth) grants it access to — never a person's broader Google account, personal Facebook profile, or personal Instagram account, and never anything beyond what the specific permissions requested at connection time allow.

• Google Business Profile: a stable identifier for the connected Google account, an encrypted refresh token used to access the Business Profile API, the granted OAuth scopes, the Business Profile accounts and locations the person selects, and the reviews on those locations (review text, star rating, reviewer display name, and review date, as provided by Google).
• Facebook Page: a stable identifier for the connected Facebook account, the list of Pages that account manages, an encrypted access token for each connected Page, and comments left on that Page (comment text, the commenter's display name as shown by Facebook, and Facebook's own comment identifier).
• Instagram professional account: a stable identifier and username for the connected account, an encrypted access token, and comments left on that account's media (comment text, the commenter's display name as shown by Instagram, and Instagram's own comment identifier).

Every access token WellRegard stores is encrypted before it is written to the database. WellRegard designs the service to avoid exposing provider access tokens in the product interface or in application logs.

AI-assisted draft replies

When a person asks WellRegard to draft a reply to a review or comment, WellRegard sends the review or comment text, the star rating (for Google reviews), the reviewer or commenter's display name, and the business's own configured reply-style preferences (described below) to WellRegard's AI provider, Anthropic, to generate a draft. A generated draft is a starting point, not a finished or verified response — WellRegard does not represent that AI-generated drafts are accurate, and a person at the business must review and explicitly approve a draft before WellRegard will post it. WellRegard does not post any reply automatically without that approval.

Business Voice reply-style preferences

A business may optionally configure how its draft replies should sound: its industry and city, the services it offers, a preferred contact channel and value, desired tone (formality, warmth, brevity), sign-off, whether to use emoji, words to avoid, and example replies. This information is provided directly by the business and is used only to guide AI-assisted drafting for that business's own replies.

Posted replies and operational records

Once a person approves and posts a reply, WellRegard stores the final reply text, when it was posted, and which person approved and posted it. WellRegard also keeps an internal record of each posting attempt (for example, whether it succeeded, failed, or needs to be reconciled against what the provider actually shows) so that a reply is never silently lost or duplicated. This operational record is used internally for reliability and is not shared outside WellRegard.

Billing

WellRegard does not currently offer any live checkout, subscription purchase, or paid-plan enrollment, and does not currently charge anyone. If and when paid plans are offered, Paddle is intended to be WellRegard's payment processor and merchant of record, and the pricing, billing period, and payment terms presented at checkout at that time will apply. WellRegard does not, and will not, receive or store card numbers or other payment instrument details itself — those would be handled directly by Paddle.

Analytics

WellRegard does not currently use any third-party analytics, advertising, or behavioral-tracking service.

Technical and hosting information

WellRegard's application does not intentionally store visitor IP addresses in its application database. However, hosting and infrastructure providers may process request metadata — including IP address, browser or user-agent information, request timestamps, and diagnostic logs — for hosting, security, and operational purposes. This policy does not state a specific retention period for that infrastructure-level data, as it has not been separately verified.

Service providers

The service providers that actually receive or process the information described in this policy are listed below. This list does not include vendors, such as WellRegard's domain registrar, that do not receive or process this information.

• Supabase — provides the PostgreSQL database and authentication infrastructure used to store account, organization, and connected-provider information described above.
• Anthropic — the AI provider used to generate draft replies, as described in "AI-assisted draft replies" above.
• Meta — operates the Facebook and Instagram APIs WellRegard connects to when a business authorizes a Facebook Page or Instagram professional account.
• Google — operates the Business Profile API WellRegard connects to when a business authorizes a Google Business Profile.
• Paddle — intended to be WellRegard's payment processor if and when paid plans are offered, described in "Billing" above. Paddle does not currently process any payment on WellRegard's behalf.
• Resend — sends account-related transactional email, such as sign-up confirmation and password-reset messages.
• Vercel — WellRegard's intended hosting, deployment, and scheduled-task (cron) provider. As of this policy's effective date, WellRegard has not yet deployed to a live production environment on Vercel, so Vercel does not yet process production customer data on WellRegard's behalf.
• Zoho Mail — the business email hosting provider for WellRegard's contact addresses; receives the content of any email sent to those addresses, such as a privacy or deletion request.

Information may be processed in countries where these service providers operate. This policy does not describe the specific countries involved or any particular legal transfer mechanism, as these have not been separately verified.

WellRegard does not sell personal information, and does not share the information described in this policy with any party other than the service providers listed above and as otherwise described in this policy.

Retention, disconnection, and deletion

WellRegard does not currently have an automated schedule that deletes connected Google, Facebook, or Instagram data after a fixed period, and does not currently delete that data automatically if the underlying authorization is revoked through Google's or Meta's own account settings rather than through WellRegard. This information is retained for as long as reasonably needed to provide the service, or until a deletion request is fulfilled as described below.

Reconnecting a Google, Facebook, or Instagram account replaces the stored credential for that connection but does not itself delete previously synced reviews, comments, drafts, or replies. WellRegard does not currently offer a self-service action that removes a connection and its stored data — a deletion request must be sent as described below.

To request deletion of your organization's account or any information described in this policy, email privacy@wellregard.com. For Facebook- or Instagram-specific deletion requests — including from someone who commented on a connected Page or account but never connected it themselves — see the separate Data Deletion page.

Your rights under applicable law

Depending on applicable law and the circumstances, individuals may have rights to:

• Request access to information held about them
• Request correction of inaccurate information
• Request deletion or restriction of information
• Object to certain processing
• Request information about the source of indirectly obtained data
• Complain to an applicable data-protection authority

Requests of this kind can be directed to privacy@wellregard.com. These rights may be subject to legal exceptions, and exercising them does not necessarily mean every internal record will be deleted — see "Retention, disconnection, and deletion" above and the operational-records description earlier in this policy.

Security

Facebook, Instagram, and Google access tokens are encrypted before storage. The database that stores the information described in this policy uses row-level access controls that scope each organization's data to that organization. No security measure is guaranteed to be error-free, and this policy does not promise a level of security, retention, or deletion behavior beyond what is described here.

Suspected security vulnerabilities or security incidents can be reported to security@wellregard.com.

Demo and Report Card tool

Separately from the connected product described above, WellRegard operates a founder-run demo and Report Card tool. Business and review information used by this tool is entered manually by the founder or by an authorized representative of the business the information concerns — this tool does not automatically retrieve reviews from Google or any other source, and it is not connected to the Google, Facebook, or Instagram integrations described above. It is not directed at, and does not knowingly collect information from, individual consumers acting in a personal capacity.

Information used by this tool may include business name, business type, and city; review text, star ratings, reviewer labels, and review dates; source URLs associated with a review; an optional business contact number; and an optional email address and reason submitted through a demo page's removal-request form. This information is used to generate draft review responses, to produce temporary demo pages showing those drafts, and to produce Report Card documents summarizing a business's reviews and draft responses.

A temporary, personalized demo page may be accessible without authentication to anyone who has its link. A demo page may display business name and city, review text, reviewer label, star rating, and an AI-generated draft response. Where a business contact number is provided and an AI-generated response incorporates it, that contact number may become visible on the temporary public demo page. A business contact number should not be provided unless the person providing it is authorized for that number to be displayed publicly in this way. Administrative information, removal-request email addresses, internal identifiers, override reasons, and other operational metadata are not displayed on a public demo page.

Temporary public demo pages are subject to an expiration window and, in some cases, a grace period afterward. Once a demo page has passed its expiration and any grace period, or has been removed, the page may no longer be available and requests to it may return an HTTP 410 (Gone) response. When a demo page is removed or its content is redacted, the publicly visible review text and reviewer label associated with it are cleared, but removal or redaction does not delete every internal record — generated reply text, Report Card records, and some operational metadata associated with a demo may remain in WellRegard's internal systems. A daily automated process checks for demo pages that have passed their retention period and redacts the associated public review content.

Requests to remove a public demo page can be submitted through that demo page, or by contacting takedown@wellregard.com. This address is used only for demo-page removal requests.

Changes to this policy

This policy may be updated as WellRegard's tools and service providers change. Material changes will be reflected by updating the effective date above.

Contact

General inquiries: hello@wellregard.com
Privacy and data requests: privacy@wellregard.com
Legal and policy inquiries: legal@wellregard.com