Privacy Policy

What this service does

GBP Reviews lets an agency connect a Google Business Profile, cache its reviews, and make those reviews available through an authenticated API.

Information we collect

We store the agency account email address and password digest, API credentials created within the service, and operational records needed to secure and maintain the account.

When an agency authorizes Google access, we receive and store the Google account identifier and email address, encrypted OAuth access and refresh tokens, granted scopes, authorization status, Business Profile account and location resource names, and the selected Google Place ID.

We retrieve and cache Business Profile review data, including reviewer display name and profile photo URL, rating, review text, publication time, business-owner reply, average rating, and total review count.

How we use information

We use this information only to authenticate users, connect and refresh selected Business Profiles, display synchronization status, provide the review API, protect the service, diagnose errors, and meet legal obligations. We do not sell Google user data or use it for advertising.

How information is shared

Information may be processed by hosting, database, and infrastructure providers that help operate the service, or disclosed when required by law. Review data is returned only through API keys belonging to the agency that connected the location. We do not share Google user data with unrelated third parties.

Storage, security, and retention

OAuth tokens are encrypted at rest. Access to reviews is tenant-scoped and requires an agency session or API key. Disconnecting Google revokes the connection and stops scheduled synchronization, but cached reviews remain available so existing integrations do not fail unexpectedly.

We retain account and cached review data while the service is active or as needed for legitimate operational and legal purposes. An agency may request deletion of its account, OAuth credentials, and cached data through the support contact shown in the service or Google OAuth consent screen.

Google API data

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Changes and contact

We may update this policy as the service changes. The effective date above identifies the latest revision. Questions or deletion requests may be sent through the support contact displayed in the service or its Google OAuth consent screen.