Privacy Policy

• We only use your data to run the features you use in GBPNinja.
• We never sell your data, and we never use Google user data for advertising.
• We don't read your Gmail inbox. With Gmail connected we can only send the emails you ask us to send.
• You can disconnect Google at any time, and delete your account and data.

Account information. When you sign up or sign in (with Google or with an email and password through Google Firebase Authentication), we receive your name, email address and profile photo. We never see your Google password.

Google Business Profile data (only if you connect it, with the business.manage permission): the business accounts and locations you choose to manage, and for those locations their profile details (name, categories, address, hours, description, services, photos), reviews and your replies, posts, and performance insights such as views, calls and direction requests.

Gmail (only if you connect it, with the gmail.send permission): the email address of the connected account. This permission lets GBPNinja send email from your account; it does not let us read, search or delete your email.

Google Search Console data (only if you connect it, read-only): search queries, clicks, impressions and positions for the website properties you choose.

Information you enter, such as message templates, review requests (customer name, email or phone number you provide), tasks, notes, posts you draft, and competitors you add.

Technical information. A sign-in cookie that keeps you signed in, plus basic server logs (IP address, browser type, time of request) used for security and troubleshooting. We don't use advertising or cross-site tracking cookies.

We access Google user data only to provide the features you turn on:

• Business Profile: show your profiles' performance, reviews and posts; post replies and updates you write or approve; publish posts you schedule; and run the profile audit.
• Gmail: send review request emails and test emails that you create and send from GBPNinja, from your own address.
• Search Console: show the searches your website appears for on the Ranking page.
• Sign-in: identify you and show your name and photo in the app.

Limited Use. GBPNinja's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the user-facing features described above.
• We do not transfer Google user data to others, except as needed to provide those features, to comply with the law, or as part of a merger or acquisition with notice to you.
• We do not use or transfer Google user data for advertising, including retargeting or personalized ads.
• We do not sell Google user data, and we do not use it to build user profiles or for credit or lending decisions.
• No person at GBPNinja reads Google user data unless you ask us to (for example for support), it is needed for security (such as investigating abuse), it is required by law, or it has been aggregated and anonymized for internal operations.
• We do not use Google user data to develop, improve or train generalized artificial intelligence or machine-learning models.

We don't sell personal information. We share it only:

• With service providers that run the service for us under confidentiality obligations: Google Cloud and Firebase (authentication), our hosting and database providers, and Google's own APIs when you act on your profiles or send email.
• With your team: people you invite to your workspace can see the profiles and data you give them access to.
• For legal reasons: when required by law, or to protect the rights, safety and security of our users and GBPNinja.

• Data is sent over encrypted connections (HTTPS).
• Google access tokens are encrypted at rest (AES-256) and used only by our servers; they are never sent to your browser.
• Access to production data is limited to staff who need it to operate the service.

No system is perfectly secure. If a breach affects your data, we will notify you as required by law.

• Disconnect Google any time in Settings. We revoke our access with Google and delete the stored tokens immediately. You can also remove access at myaccount.google.com/permissions.
• Google data we cached for the features (such as reviews and insights) is deleted within 30 days after you disconnect or delete your account.
• Delete your account by emailing us from the account's address. We delete your account and workspace data within 30 days, except what we must keep by law. Backups are overwritten within a further 30 days.

Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to object to or restrict some processing. To make a request, contact us at the address below. We will not discriminate against you for using these rights.

GBPNinja is a business tool and is not meant for anyone under 16. We don't knowingly collect information from children.

If we change this policy, we will update the date at the top. For significant changes, especially to how we use Google user data, we will tell you in the app or by email before they take effect.

Questions or requests: support@gbpninja.com. We reply within 5 business days.