Privacy policy

Last updated 25 October 2026

Buni Reviews ("Buni", "we") is a Singapore business that helps restaurants understand and reply to their Google reviews. This policy explains what data we collect, why, and what you can ask us to do with it. We follow Singapore's Personal Data Protection Act 2012 (PDPA).

Data we collect

• Client accounts. The name and email address of each person at a client business who signs in to Buni, and the business's name and Google Maps listing.
• Google reviews. For each client, and for any competitor the client chooses to compare with, we collect the reviews shown publicly on Google Maps: the reviewer's public display name, the rating, the review text, the date, and any owner reply.
• Google Business Profile data. When a client adds Buni as a manager on their Google Business Profile, we use the Google Business Profile API to read that profile's reviews and location details, and to post replies to reviews that the client has approved.
• What clients create in Buni. Reply drafts, reply guidelines, and questions asked in the comparison chat.
• Technical data. Error reports from the app (the page and browser type) to help us fix problems. The app stores a sign-in token in your browser to keep you signed in. This website and the app use no advertising or analytics trackers.

How we use it

• To produce each client's review summaries, category breakdowns, trends and competitor comparisons.
• To draft replies to reviews and, once the client approves them, post them to the client's Google Business Profile.
• To run client accounts: sign-in, password reset and sign-in codes by email.
• To keep the service working and secure.

We do not sell data, use it for advertising, or use it for anything other than providing Buni to the client it belongs to.

Google user data

Buni's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We access a Google Business Profile only after its owner adds Buni as a manager, and only to read its reviews and location details and to post approved replies.
• We use this data only to provide Buni's features to that business.
• We do not transfer it to others except as needed to provide those features (see "Who processes data for us"), to comply with the law, or with the business's permission.
• We do not use it to train general AI models, and no person at Buni reads it except with the business's permission, for security, or to comply with the law.

A business can remove Buni's access at any time by removing Buni as a manager in its Google Business Profile settings.

Who processes data for us

• Hosting: our server is in Singapore. Encrypted backups are stored with Cloudflare R2.
• AI analysis: review text is sent to Z.ai, an AI model provider, to write summaries, tag categories and draft replies. Their servers may be outside Singapore.
• Email: account emails are sent through Resend.

When data leaves Singapore, we take steps so that it is protected to a standard comparable to the PDPA.

How long we keep it

We keep a client's data while they use Buni. When a client stops, we delete their account, reviews and generated content within 30 days, and it leaves our backups within a further 30 days.

Your choices

• Clients can ask to see, correct or delete their data, or withdraw consent, at any time.
• If you wrote a Google review that appears in Buni and want it removed from our copy, email us with the restaurant and the review, and we will delete it within 30 days.

Contact and Data Protection Officer

Email our Data Protection Officer at hello@buni.sg. We reply within 30 days.

Changes

If we change this policy, we will update this page and the date at the top, and tell clients by email about any important change.