Privacy Policy — Reply
Ava Research LLC · Last updated: October 14, 2026
This policy covers Reply (the "Service"), a connector that helps a small business draft a response to a customer review through Muse. The defining rule of the Service: Reply drafts; the owner posts. Reply prepares a response draft for the owner to review — it never posts anything to anyone, ever.
What we store, and why
-
Account ID: an internal ID from your sign-in, used to keep your data separate from everyone else's. Sign-in is handled by Microsoft Entra External ID with a one-time code sent to your email — there is no password, and it asks for nothing but your email address. The Service itself never stores your email address.
-
Reviews you paste: normalized into a review+response record — a customer name and star rating only when your text unambiguously stated them, otherwise left unset.
-
Response drafts: the draft responses Reply prepares for you.
-
Your brand voice: business name, tone description, sign-off, and standard phrases — only if you explicitly set them.
-
Technical logs: request type, outcome, and timing. Logs never contain review contents, customer details, or sign-in tokens.
What we don't collect
The Service only accepts the fields above. We don't ask for or store payment card or bank account numbers, government ID numbers, precise location, photos, or health information. Reply doesn't process payments at all, and it has no integration with any review platform.
Raw text is never kept
The review text you paste is never persisted as text — only its SHA-256 hash, used so a re-pasted review doesn't re-run extraction a second time, and the structured fields extracted from it.
No third-party services
Reply runs entirely on Ava Research's own infrastructure. There are no external data providers, no third-party AI/model API calls, no API keys, and no secrets.
Permissions Muse asks for
One permission, Reply.ReadWrite: it lets Muse read and update your voice profile and review+response records on your behalf. That's all it can touch.
Who can see it
-
You, through your own account.
-
Meta's Muse, if you connect it, acting on your behalf with the permission above.
-
Service providers that host and run the Service (Microsoft Azure, East US 2 region) and handle sign-in (Microsoft Entra External ID), bound by their own security and confidentiality commitments.
-
No one else. We don't sell, rent, or share your data with advertisers or data brokers.
How we protect it
Your data is isolated by account — no owner can read another owner's reviews, responses, or voice profile. Access to the underlying systems is limited to what each part of the Service needs to do its job, and administrative access is limited to Ava Research LLC personnel who need it to operate the Service.
Data retention
-
Reviews, responses, and your voice profile: kept until you delete them or your account.
-
Technical logs: 30 days.
Delete your data
Deletion is self-service — ask Muse directly, no email required. Ask Muse to delete your data, for example "Delete all my Reply data." This permanently removes your voice profile, every review+response record, and every cached draft for your account. This can't be undone.
Disconnect: remove Reply from your connectors in Muse. Disconnecting stops Muse's access but doesn't delete your data — use the self-service deletion above first if you want it gone.
Children's privacy
The Service is not directed at children, and we don't knowingly collect information from anyone under 13.
Changes to this policy
If we make a material change, we'll update the date at the top of this page and, for significant changes, make a reasonable effort to notify active users.
Contact us
Ava Research LLC
privacy@avaresearchllc.com