Legal
Privacy Policy
Effective July 21, 2026
Mores is a review-management tool for local businesses. This policy explains, in plain language, what we collect, why we collect it, who else touches it, how long we keep it, and how to get it deleted. If anything here is unclear, email privacy@mores.ca.
1. What we collect
Account information. Your email address, your name, and a password hash (or, if you sign in with Google, the identifier Google returns). We never store your password in readable form.
Business information. The business and location details you enter — name, industry, website, addresses, phone numbers, logo, brand-voice samples, and reply templates.
Review content. Reviews you import or sync, including the review text, star rating, the reviewer name as the platform publishes it, and the review date. We also store the replies drafted for you, your edits, and the moderation score for each draft.
Connected-account credentials. When you connect Google Business Profile or another review platform we store the OAuth tokens or API credentials needed to sync reviews and publish replies on your instruction. These are encrypted at rest with AES-256-GCM before they are written to the database.
Review-request contacts. If you use review request links or review request emails, we store the customer name and email address you supply, along with the delivery status and the unsubscribe state for that contact.
Billing information. Your plan, subscription status, renewal dates, and the identifiers Lemon Squeezy gives us. Card numbers are handled by Lemon Squeezy and never reach our servers.
Usage and technical data. Product analytics events, page views, IP address, browser and device information, and error diagnostics.
Free public tool.Text you paste into the public review-reply generator is sent to Google's Gemini API to draft a reply and is not stored in an account. We record a rate-limit counter keyed to your IP address so the tool cannot be abused.
2. How we use it
We use your data to run the product you signed up for: importing your reviews, drafting replies in your brand voice, scoring those drafts against Google's review-reply moderation rules, publishing the replies you approve, sending the notifications and digests you turn on, producing your analytics, and billing you.
We use aggregate, non-identifying usage data to understand which features matter and to fix bugs and abuse. We do notsell your data, rent it, or share it with advertisers, and we do not use your review content or brand-voice samples to train our own models. Review text sent to Google's Gemini API is processed under Google's API terms for paid services.
We only email you about your account, your reviews, and your billing — plus product announcements you can unsubscribe from at any time.
3. Why we are allowed to process it
Where the GDPR or UK GDPR applies, we rely on: performance of a contract (running the service you bought), legitimate interests (security, abuse prevention, product improvement), consent (marketing email, and the review-request messages you send to your customers on your own legal basis), and legal obligation (tax and accounting records).
For review-request emails, you are the controller of your customers' contact details and you are responsible for having a lawful basis and the required consent before sending. Mores acts as your processor for those messages and records an unsubscribe state we honour on your behalf.
4. Subprocessors
These are the third parties that process data on our behalf. We use no others for customer data.
| Provider | What it does | What it sees |
|---|---|---|
| Supabase | Postgres database, authentication, and file storage | Everything in your account: profile, businesses, reviews, replies, connected-account credentials |
| Google (Gemini API) | Drafting reply text and scoring drafts for moderation risk | Review text, reviewer first name, star rating, business name, and your brand-voice settings |
| Google (Business Profile API) | Importing your reviews and publishing approved replies | OAuth tokens, location identifiers, review and reply content |
| Lemon Squeezy | Payments, subscriptions, invoices, and tax handling (merchant of record) | Billing email, subscription and payment records. Card details go to Lemon Squeezy directly — Mores never sees or stores them |
| Resend | Transactional email (verification, review alerts, digests, billing receipts) | Your email address and the contents of the messages we send you |
| Vercel | Application hosting, CDN, and request logs | HTTP request metadata including IP address and user agent |
| PostHog | Product analytics — which features are used and where people get stuck | Pseudonymous usage events, page views, and a user identifier |
| Sentry | Error and performance monitoring | Stack traces, request context, and the account identifier attached to an error |
Some of these providers operate outside your country, including in the United States. Where required, transfers rely on the providers' standard contractual clauses.
5. Security
All traffic to Mores is encrypted in transit with TLS. Credentials for connected accounts — Google OAuth tokens and review-platform API keys — are encrypted at rest with AES-256-GCM using a key held outside the database. Account data is isolated per customer by row-level security policies enforced in Postgres, so one account cannot read another's rows.
To be explicit about what we do notclaim: Mores is not SOC 2 certified, is not HIPAA compliant, and we do not sign Business Associate Agreements. Do not store protected health information in Mores. Our moderation check flags health and treatment details in a draft reply so you don't publish them, but that is a safeguard against accidental disclosure, not a compliance certification.
6. How long we keep it
While your account is open: we keep your businesses, reviews, replies, and settings so the product works and your history stays intact.
After you delete an account: we delete your account data within 30 days. Connected-account tokens are revoked and destroyed immediately on disconnect or deletion.
Billing records are retained for as long as tax and accounting law requires (typically seven years), and email suppression records (unsubscribes and bounces) are kept indefinitely, because deleting them would mean emailing someone who asked us not to.
Backups roll off on their own schedule and are fully replaced within 35 days.
7. Your data and deletion requests
You can access and correct most of your data directly in the app, and export your reviews and replies as CSV at any time.
Depending on where you live, you may also have the right to a copy of your data in a portable format, to correction, to deletion, to restrict or object to processing, and to withdraw consent. To exercise any of these, email privacy@mores.ca from the address on your account. We respond within 30 days and will not charge you or degrade your service for asking.
You can delete your account yourself from Settings, which removes your data on the timeline described above. If you believe we have mishandled your data you may complain to your local supervisory authority.
9. Children
Mores is a business tool and is not directed at anyone under 16. We do not knowingly collect data from children. If you believe a child has given us data, email us and we will remove it.
10. Changes to this policy
If we change this policy in a way that materially affects you, we will email account holders and update the effective date at the top of this page before the change takes effect.
11. Contact
Privacy questions, data requests, and complaints: privacy@mores.ca. General support: support@mores.ca.