Privacy policy

GBP AutoPilotis software that marketing agencies use to look after their clients' Google Business Profiles: scoring each profile, filling in what is missing, drafting replies to reviews, publishing posts, and reporting on where the business appears in local search. This policy explains what it holds, why, and who else touches it.

Two kinds of people appear in it. Agency users sign up and sign in. Businesses are the clients whose profiles an agency manages; they do not sign in, and their information reaches us either from the agency or from Google.

The one permission we ask Google for

When an agency connects a Google account we ask for a single permission, business.manage— which Google describes as “See, edit, create and delete your Google business listings” — together with the account's email address, used only to label the connection so the agency can tell two logins apart. We ask for nothing else. We do not read Gmail, Drive, Calendar, Contacts or anything outside Business Profiles.

What we read

• The Business Profile accounts and locations that the connected Google account manages.
• Profile details for the locations an agency chooses to manage: name, address, phone number, website, description, categories, opening hours, services, service areas, the map pin when Google provides one, the place id and the Maps link.
• Reviews on those profiles: the reviewer's display name as Google shows it, the star rating, the review text, the date, and any reply already posted.
• Posts already published to those profiles.
• How many photos a profile has and when the most recent one was added.
• Performance figures Google reports for those profiles: how many people searched, called, asked for directions or clicked through to the website.

What we write back

Only what has been approved inside the app, and only when it is approved: profile fields (phone, website, opening hours, categories, description, services), replies to reviews, and posts. Nothing is written to a profile that an agency has not chosen to manage. We never delete a listing.

Where the Google credentials live

The refresh token Google issues is encrypted with AES-256-GCM before it is stored, using a key held only in the server environment. It is never sent to a browser, never written to a log, and never shown in the app.

What else we hold

• Agency accounts: name, email address and a password, handled by our authentication provider — we never see the password itself.
• Client records: the business name and contact details an agency enters, plus anything it tells us about the business to steer the AI drafts.
• Billing: subscription status and the customer and subscription identifiers from Stripe. Card details go straight to Stripe and never reach us.
• Work history: a log of what the software did and when, what it spent on searches and AI, and the scores and reports it produced, so an agency can see what happened and what it cost.

What we never do

• We never sell your data, or a client's.
• We never use it for advertising or share it with advertisers or data brokers.
• We never use it to train AI models, and we do not allow our providers to.
• We never use one agency's data to serve another. Every record belongs to one agency.

Who else processes it

These are the only third parties involved, and this is everything each one receives.

• DataForSEO— tells us how many people search for a trade near a town, using Google's own Keyword Planner figures, so a profile check can say what being found is worth. It receives the trade and the town only, from Google's own category for the listing. No business name, no contact details and nothing about the person asking are sent, and the figures come back about the area, never about an individual.
• OpenAI— drafts replies to reviews, post copy and profile text. To draft a reply it receives the star rating, the reviewer's display name and the review text; for other drafts it receives the business's own details. Content sent through OpenAI's API is not used to train their models.
• Serper — runs the searches behind rank tracking, map grids and directory checks. It receives search phrases: the business name, its town, and the services being searched for. No review content and no personal data are sent.
• Stripe — subscriptions and payouts.
• Supabase — the database and sign-in.
• Vercel — hosting.
• Nexus Portal (built on GoHighLevel) — only when an agency connects its own Nexus Portal account. It then receives a task and a note when a client gets a poor review, so the agency sees it in the CRM it already uses.

Some of these operate outside the UK, mainly in the United States. Where they do, transfers rely on the standard contractual clauses or the UK extension to the EU–US Data Privacy Framework.

Reviewers' names and words

A review carries the name of the person who wrote it. That information is already public on Google. We hold it for one reason: so a reply can be drafted and posted, and so an agency can report on ratings over time. It is not used to build a profile of anyone, is not combined with data from anywhere else, and is not sent anywhere other than the providers named above.

Ending it

• Disconnect a Google account on the Google accounts page, in Settings. The grant is handed back to Google at that moment and the stored token is deleted. If Google does not confirm the revoke, the app says so rather than claiming otherwise.
• Delete a client and its profile, reviews, posts, reports and logs are deleted with it.
• Delete an agency account and everything belonging to it is deleted. Write to chao@macaws.ai and we will confirm when it is done.
• You can also withdraw our access from Google's side at any time, at myaccount.google.com/permissions. The software stops being able to read or write those profiles immediately.

Records we must keep for accounting — invoices and payment records — are kept for as long as the law requires, and nothing else.

Your rights

Under UK data protection law you may ask for a copy of what we hold about you, ask us to correct or delete it, ask us to restrict how we use it, or object to a use. Write to chao@macaws.ai. If we get it wrong you can complain to the Information Commissioner's Office at ico.org.uk.

We hold and use this information to provide the service an agency has asked for and paid for, and to meet our legal obligations. Where an agency uploads information about its own clients, the agency decides what is held and we act on its instructions.

Changes

When what the software does changes, this page changes with it, and the date at the top moves. If a change materially affects how your data is handled, we will tell account owners by email rather than leave it to be noticed.

Contact

chao@macaws.ai