Privacy Policy

GMB Copilot · gmbcopilot.com · Last updated: July 28, 2026

This Privacy Policy explains how GMB Copilot ("GMB Copilot," "we," "us," or "our") collects, uses, stores, shares and protects information when you use our application and website at gmbcopilot.com (the "Service"). GMB Copilot is an approval-first automation tool that helps an authorized operator manage Google Business Profiles on behalf of the businesses that own or control them.

By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.

1. Who we are

GMB Copilot is operated by Eric ("the operator") as a single-agency tool. You can reach us at [email protected] with any question about this policy or your data.

2. Information we collect

2.1 Google account and OAuth data

When you connect a Google Business Profile to GMB Copilot, you authorize us through Google's OAuth consent flow using the https://www.googleapis.com/auth/business.manage scope. Through this authorization we receive and store:

OAuth tokens. An access token and an offline refresh token that let the Service act on the Business Profiles you authorize. We never receive or store your Google password.
Basic account identifiers. The Google email address associated with the authorization, used to identify the connection.

2.2 Business Profile data

Once connected, and only for the profiles you authorize, we access and store the Business Profile data needed to operate the Service. This includes business name, address, phone, website, categories, hours and special hours, attributes, service items, descriptions and action links; local posts, photos and videos; questions and answers; reviews and their content, star ratings and reviewer display names; and performance metrics such as calls, direction requests, website clicks and search keyword impressions.

2.3 Data you provide

Brand and content settings you enter, such as services, brand voice notes, offers, banned phrases and example posts, which are used to draft content for your approval. We also keep an audit log of actions taken in the Service, recording who approved what and when.

2.4 Basic technical data

Standard operational data such as log entries and error diagnostics needed to run and secure the Service. We do not use advertising trackers.

3. How we use information

To draft posts, review replies, Q&A answers, media captions and business information updates for a human operator to review.
To display proposed changes as before and after "diff cards" and publish them to Google only after a person approves them, or after an auto-approve rule the operator has explicitly configured.
To monitor authorized profiles for third party or Google initiated changes and alert the operator.
To generate performance reports for the profiles you manage.
To maintain security, prevent abuse and keep an audit trail.

Content drafting is performed with the help of a third party AI model provider (Anthropic's Claude API). Only the data needed to draft a specific item is sent for that purpose.

Google API Services User Data Policy: Limited Use

GMB Copilot's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained through the Google Business Profile APIs is used only to provide and improve the user facing features described in this policy; is not sold; is not used for advertising; and is not transferred to others except as necessary to provide or improve the Service, to comply with applicable law, or as part of a merger or acquisition, and only in ways consistent with the Limited Use requirements. Humans do not read this Google user data except with your explicit consent to resolve a specific issue, where required for security or to comply with the law, or where the data has been aggregated and anonymized.

We do not sell your data or Google user data, and we do not use it for advertising. We share data only with:

Google, to read and, upon your approval, write to the Business Profiles you authorize through the Business Profile APIs.
Service providers that operate the Service under confidentiality obligations, limited to what they need to perform their function. These include our cloud hosting and database provider, our AI content provider (Anthropic) for drafting, and our email provider for alerts and reports.
Legal and safety recipients, where required by law or to protect the rights, property or safety of our users or others.
Business transfers, in connection with a merger, acquisition or asset sale, consistent with the Limited Use requirements above.

5. Data storage and security

Encryption of tokens. OAuth refresh tokens are stored encrypted at rest using a libsodium sealed box, with the encryption key held separately from the database.
Access controls. Access to the Service is restricted to authorized operator accounts.
Data in transit is protected with TLS.
Webhook verification. Real time notifications from Google are verified via Google signed tokens before processing.

No system is perfectly secure, but we take reasonable measures appropriate to the sensitivity of the data we handle.

6. Data retention and deletion

We retain data for as long as a Business Profile is connected to the Service and as needed to provide it. You may disconnect a profile at any time. When a profile is disconnected, or when a client relationship ends, we delete the stored OAuth tokens and remove our access, and we delete or anonymize the associated Business Profile data within a reasonable period, except where retention is required by law or for legitimate audit and security purposes.

You can also revoke GMB Copilot's access at any time from your Google Account's third party access settings. To request deletion of your data, email [email protected].

7. Your choices and rights

You control which profiles are connected and can disconnect them at any time. Depending on your location, you may have rights to access, correct or delete your personal data. Contact us to exercise them. Because GMB Copilot acts on Business Profiles at the direction of the profile's owner or manager, requests are handled together with that authorizing party where appropriate.

8. Children

The Service is a business tool and is not directed to children under 16. We do not knowingly collect personal information from children.

9. International users

The Service may process and store data in the United States or other countries where our providers operate. By using the Service, you understand your data may be transferred to and processed in those locations.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by additional notice.

11. Contact

Questions about this policy or your data: [email protected].