Privacy Policy
Last updated: 24 August 2026
GBP Manager (“the Service”) is operated by The GBP Experts (“we”, “us”). It helps businesses and the agencies that represent them manage their Google Business Profile listings. This policy explains what data the Service handles, why, and who it is shared with.
The Service is business software used by an organisation that has an account with us. If you are an employee or client of such an organisation, that organisation decides what listings are connected and who may access them.
Google user data we access
When you connect a Google account, Google asks you to approve specific permissions. We request only the ones below, and use each solely for the stated purpose. Google Drive access is not part of signing in: it is requested separately, and only if you choose to upload photos to your listings from a Drive folder.
| Permission | What it lets us do | Why we need it |
|---|---|---|
openidhttps://www.googleapis.com/auth/userinfo.emailhttps://www.googleapis.com/auth/userinfo.profile |
Read your email address, name and profile picture | To sign you in and show who is signed in |
https://www.googleapis.com/auth/business.manage |
Read and update the Google Business Profile listings your Google account manages — business details, hours, categories, attributes, photos, posts, reviews and review replies | This is the core of the Service: showing your listings, detecting changes Google makes, publishing your edits, and replying to reviews |
https://www.googleapis.com/auth/driveRequested separately, only if you use media upload |
Within one Google Drive folder you nominate: list its image and video files, download
them, create Uploaded and Skipped subfolders inside it, and move
each file into one of those after it has been processed |
To upload those photos and videos to your Business Profile. Files are moved after processing so the same photo is never uploaded twice. We do not read, change or delete anything outside the folder you nominate, and we never delete your files |
Limited Use
GBP Manager’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, we do not sell Google user data, do not use it for advertising, and do not use it to build unrelated profiles. Human beings do not read your Google user data except where you have asked us to (for example, to resolve a support request), where required by law, or where necessary for security and abuse investigation.
We do not use Google user data to train generalised artificial intelligence or machine learning models.
Other information we hold
- Account details — your name, email address, profile picture URL, role, and (if you sign in with a password) a salted hash of that password. We never store your password itself.
- Google credentials — the OAuth access and refresh tokens Google issues when you connect an account, so scheduled syncs can run without you being present.
- Listing data — a copy of the Business Profile information described above, including reviews and their authors’ public display names and photos as published by Google.
- Activity records — sign-ins, changes made through the Service, and a change history of your listings, used for audit and troubleshooting.
How we use it
- Displaying and managing your listings, reviews, posts and photos.
- Detecting changes Google or a third party makes to your listings, and alerting you.
- Generating draft or automatic review replies, listing descriptions and posts, where you have enabled those features.
- Measuring visibility for keywords you choose, through map grid scans.
- Sending operational email — sync alerts, review notifications and invitations.
- Keeping the Service secure, diagnosing faults, and meeting legal obligations.
We do not sell your data, and we do not use it for advertising.
Who we share it with
We share data only with the service providers needed to operate the Service:
| Provider | What they receive | Why |
|---|---|---|
| Google Cloud Platform | All Service data (hosting and database) | The Service runs on Google Cloud Run and Cloud SQL |
| Google Gemini API | Review text, business name and category, and any reply instructions you set | To generate the AI drafts you request. Sent only when you use an AI feature |
| DataForSEO | A keyword and map coordinates — no personal or account data | To run map grid rank scans |
| Our email provider | Recipient address and message contents | To deliver notification and invitation email |
We may also disclose data where required by law, or to protect the rights, safety and security of our users or the Service.
Where data is stored, and for how long
Data is stored in Google Cloud data centres in the United States. We keep listing and activity data for as long as your organisation has an account, because the Service’s value depends on historical comparison. Records are deleted within 30 days of an account being closed, except where we must retain them by law.
Disconnecting and deleting your data
- You can revoke GBP Manager’s access to your Google account at any time from your Google Account permissions page. Doing so immediately stops all further access.
- An administrator in your organisation can remove your user account from Settings → Users.
- To request deletion of your organisation’s data, email support@gbp-manager.com. We will confirm and complete the deletion within 30 days.
Security
Traffic is encrypted in transit with TLS. Credentials and data are held in managed Google Cloud services with access restricted to the small number of staff who need it. Access within the Service is controlled by roles, and one customer’s data is not visible to another. No system is perfectly secure, but we take these obligations seriously and will notify affected customers promptly if a breach occurs.
Children
The Service is business software and is not directed at anyone under 16.
Changes
If we change this policy materially, we will update the date above and notify account administrators by email before the change takes effect.
Contact
Questions about this policy, or requests relating to your data, can be sent to support@gbp-manager.com.