Privacy Policy
Effective 2026-11-04 · Last updated 2026-11-04
SpecReply is an early-access drafting tool, not yet open to the public, that helps quality staff at food and beverage businesses answer their customers' supplier questionnaires from their own documents. This policy explains what we collect, why, who sees it, how long we keep it, and the choices and rights you have. If anything here is unclear, email hello@specreply.com and we will explain it plainly.
In plain English: We collect what we need to run SpecReply. We do not sell your information, we do not show ads, and you can ask to see, correct and delete your data.
1. Who we are, and who is responsible for your data
In plain English: MemoryMaps, LLC runs SpecReply. A business decides what happens to the documents and files it uploads, and we handle them on its behalf.
MemoryMaps, LLC d/b/a SpecReply ("SpecReply," "we," "us," "our") operates specreply.com (the "Service").
The Service is used by businesses (and their staff). Who is responsible for your information depends on how you use the Service:
- We are the controller of the information about people who use the Service directly: business owners and staff, and visitors to our website. "Controller" means we decide why and how that information is used, and this policy describes it.
- The business is the controller of the documents and files it uploads, and of any personal information in them. We process them on the business's behalf and on its instructions, as its service provider (or "processor"), under our Data Processing Addendum. If you are named in a document, contact the business to access, correct or delete that information; if you contact us instead, we will pass your request to the business and help it respond.
2. What we collect
In plain English: The details you give us, the records needed to provide the Service, and a small amount of technical data to keep it secure and working.
Account details
Your name, email address and, if you add one, phone number, and how you sign in. If you sign in with Apple or Google, we receive only the identifier and email address they share with us.
Business information
Details about a business that uses the service: its name, address, staff names and roles, branding, and subscription status.
Payment information
Card details go directly from your device to Stripe and never reach our servers. We keep Stripe's references for your subscription, your plan, its status and billing dates, and the status of the latest invoice.
Uploaded documents and files
The documents and files a business adds to the service (customer questionnaires, food safety plans, certificates, spec sheets, allergen matrices and past answers), and any text or data taken from them. They can contain personal information about the people named in them, such as names and work contact details.
Content processed by AI features
When you use an AI-assisted feature (AI-drafted answers to customer questionnaires, based on the documents you upload), the content you submit to it is sent to our AI provider (Anthropic) to produce the result. Our provider may not use it to train its models.
Logs and security data
Technical records our servers create when you use the service: IP address, browser or app details, the requests made, and timestamps.
Messages you send us
What you write when you contact us for support or with a request, and our replies.
3. What we do not collect or do
In plain English: No selling, no ads, no tracking across other companies' apps and websites.
- We do not sell personal information, and we do not share it for cross-context behavioral advertising.
- There is no advertising in the Service. We do not use advertising identifiers and we do not track you across other companies' apps or websites.
- Card numbers, security codes and bank account numbers never reach our servers.
- We do not ask for your location.
- We do not read your contacts, calendar, microphone or photos.
- We do not use your information to make automated decisions that have legal or similarly significant effects on you.
4. How we use it
In plain English: To run the Service, keep it secure, and talk to you about it.
- Account details: to create and secure your account, sign you in, and contact you about your account.
- Business information: to set up and run the business's workspace and bill its subscription.
- Payment information: to bill subscriptions and handle refunds and disputes.
- Uploaded documents and files: to store and process them for the business, on its instructions.
- Content processed by AI features: to provide the AI-assisted features you choose to use.
- Logs and security data: to keep the service secure and reliable, prevent abuse and fraud, and enforce rate limits.
- Messages you send us: to answer you and keep a record of what was agreed.
We also use information when the law requires it, to enforce our Terms of Service, and to protect the rights, safety and property of our users, the public and ourselves. We may create aggregated or de-identified statistics that cannot reasonably be used to identify anyone, and use them to understand and improve the Service.
5. Who we share it with
In plain English: Only with the people and providers who need it to deliver the Service, and with authorities when the law requires.
| Who | Why | What they receive |
|---|---|---|
| Our service providers (list) | Hosting, payments, email and security | Only what each needs to do its job for us, under contracts that require them to protect it |
| Stripe | To process subscription payments | The payment details you enter directly with Stripe, and the amount and a reference for the payment |
| Apple and Google | Sign-in, if you choose Sign in with Apple or Google | What is needed to confirm your sign-in |
| Courts, regulators and law enforcement | When the law requires it, or to protect someone's safety | Only what the request lawfully requires |
| A company that acquires us | If we are involved in a merger, acquisition or sale of assets | The information covered by this policy, which would stay protected by it; we will tell you before it becomes subject to a different policy |
Our service providers are: Amazon Web Services, Neon, Vercel, Cloudflare, Stripe, Microsoft 365, and Anthropic. Stripe handles payment details under its own privacy policy. We also share information when you ask us to.
6. Payments
In plain English: Stripe handles your card. We never see the number.
Subscription payments are processed by Stripe, a certified PCI Level 1 payment processor. Your card details go directly from your device to Stripe and never reach our servers. We keep only Stripe's references for your subscription, your plan, its status and billing dates, and the status of the latest invoice.
7. How long we keep it
In plain English: As long as needed to provide the Service and meet our legal obligations, then we delete it.
| Information | How long we keep it |
|---|---|
| Account details | Until you delete your account |
| Business information | Until you delete your account |
| Payment information | 7 years |
| Uploaded documents and files | While the business's account is open, and up to 90 days after it closes |
| Content processed by AI features | Until you delete your account |
| Logs and security data | 30 days |
| Messages you send us | 3 years |
When you delete your account, we hide your profile right away and permanently delete your account data 30 days later; until then, you can change your mind. Backups are overwritten on a rolling basis within 35 days, and are never used to restore deleted data except to recover from a disaster. When a business closes its account, we delete its data within 90 days, except records we must keep by law, such as payment and tax records (7 years).
8. Your rights and choices
In plain English: Ask to see, correct or delete your data, and opt out of messages, by emailing us.
Wherever you live, you can ask us to:
- Access the personal information we hold about you, and give you a copy in a portable format.
- Correct information that is wrong or incomplete. Most details can be edited in your account settings.
- Delete your information. See Delete your account for how to do it on the web.
- Object to or restrict how we use it, and withdraw consent you gave us.
You also control messages directly: and use the unsubscribe link in any non-essential email.
To make a request, email hello@specreply.com from the address on your account. We may need to confirm it is you before we act, and we will respond within 30 days. If we cannot do what you ask, we will explain why, and you can appeal by replying to our decision; if your appeal is denied, you can contact your state attorney general. We will not treat you differently for exercising your rights. For personal information in a document a business uploaded, the business decides: contact it directly, or ask us and we will forward your request.
9. California privacy rights
In plain English: California law gives you specific rights and requires specific disclosures. We do not sell or share your information.
This section applies to California residents and supplements the rest of this policy. In the last 12 months we collected the following categories of personal information, from the sources listed, for the purposes described in "How we use it":
| Category | Examples | Sources |
|---|---|---|
| Identifiers (such as name, email address, phone number, account ID, IP address, device identifiers) | Account details, business information, uploaded documents and files, logs and security data, and messages you send us | You, Apple or Google, if you sign in with them, the business and its staff, your device, and our servers |
| Personal information in customer records (Cal. Civ. Code § 1798.80(e)), such as contact details | Account details, payment information, uploaded documents and files, content processed by AI features, and messages you send us | You, Apple or Google, if you sign in with them, the business and its staff, and Stripe |
| Commercial information (such as purchases and payment history) | Business information and payment information | You, the business and its staff, and Stripe |
| Internet or other electronic network activity (such as logs and app interactions) | Logs and security data | Your device and our servers |
| Professional or employment-related information (such as a staff member's role) | Business information and uploaded documents and files | The business and its staff |
- Disclosures for a business purpose. We disclosed each category above to our service providers, for the purposes described in this policy.
- No sale or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising, and have not done so in the last 12 months. We do not knowingly sell or share the personal information of consumers under 16.
- Sensitive personal information. We do not collect sensitive personal information as defined by California law.
- Retention. We keep each category for the periods in "How long we keep it."
- Your rights. You have the right to know what personal information we collect, use and disclose; to access it; to delete it; to correct it; to opt out of its sale or sharing (which we do not do); to limit the use of sensitive personal information (which we use only as permitted); and not to be discriminated against for using these rights.
- How to exercise them. Email hello@specreply.com. We verify requests by confirming control of the email address on the account. You can use an authorized agent; we will ask for proof that you gave the agent signed permission, and may ask you to confirm your identity directly.
- Global Privacy Control. We treat a Global Privacy Control signal from your browser as a request to opt out of sale and sharing.
- Shine the Light. We do not disclose personal information to third parties for their own direct marketing.
- Information we process for a business. For records we hold as a business's service provider, please make your request to the business. If you send it to us, we will pass it on.
Residents of other US states with comprehensive privacy laws have similar rights, and we honor those requests in the same way.
10. Security
In plain English: Encrypted connections, encrypted storage, strict separation between businesses, and access only for those who need it.
We protect information with encryption in transit (HTTPS/TLS) and at rest, separation of each business's data enforced in the database itself, short-lived sign-in tokens, least-privilege access for our team, and audit logs. No system is perfectly secure; if we learn of a breach that affects your personal information, we will notify you and the authorities as the law requires. Details, and how to report a vulnerability, are on our Security page.
11. Children
In plain English: SpecReply is not for children under 18.
The Service is not directed at children under 18, and we do not knowingly collect personal information from them. If you believe a child under 18 has given us personal information, email hello@specreply.com and we will delete it.
12. Where your information is processed
In plain English: In the United States.
We are based in the United States, and we and our service providers store and process information there. If you use the Service from outside the United States, your information is transferred to the United States, where data protection laws may differ from those where you live.
13. Cookies and similar technology
In plain English: The website uses only what it needs to work. No advertising cookies.
We use cookies and browser storage to keep you signed in, to protect the Service, and to remember your preferences. There are no advertising cookies and no third-party tracking pixels. See our Cookie Policy for the details.
14. Changes to this policy
In plain English: We announce material changes at least 7 days before they take effect.
We may update this policy from time to time. For material changes, we will notify you by email or in the Service at least seven (7) days before the change takes effect. The "Last updated" date at the top of this page shows the latest revision. Clarifications and corrections that do not reduce your rights may be made without notice.
15. Contact us
In plain English: Email us with any privacy question or request.
- Company: MemoryMaps, LLC d/b/a SpecReply
- Address: 11750 W 135th St #1551, Overland Park, KS 66221-9395, United States
- Privacy questions and requests: hello@specreply.com