Privacy Policy
This Privacy Policy explains how TOTOSLOCAL ONE PRIVATE LIMITED (“GBPPromote”, “we”, “us”, “our”) collects, uses, discloses, stores and protects personal data when you visit gbppromote.com, use the GBPPromote services (the “Services”), connect third-party accounts such as Google Business Profile, or interact with us. It also explains your rights and how to contact us.
We collect and use only the information reasonably necessary to provide, secure, support, bill for and improve our Services.
1. Scope & overview
This Privacy Policy applies to website visitors, trial users, paid users, customers and other individuals whose information we process in connection with the Services.
We apply industry-standard privacy and security practices and aim to comply with applicable laws where we operate, including the GDPR for users in the European Economic Area and the United Kingdom, the CCPA and CPRA for California residents, and India’s Digital Personal Data Protection Act 2023.
2. Information we collect
We collect the categories of information necessary to provide and improve our Services.
A. Account & contact data
Name, business name, email address, phone number, address, billing contact details, and tax, GST or VAT numbers where needed for invoicing or compliance.
B. Authentication & account credentials
Username or email address, hashed or securely stored authentication credentials, and OAuth tokens and related credentials for approved integrations — including Google OAuth when you connect a Google Business Profile.
C. Payment & billing data
Payments are processed by secure third-party payment providers. We do not store full card details on our own systems. We may store limited billing metadata such as transaction IDs, payment status, billing history, invoice records and subscription status.
D. Business profile data and third-party integration data
If you connect third-party services such as Google Business Profile, we may access the business profile data needed to provide the Services — business names, locations, categories, reviews, ratings, photos, profile content and related operational data that you authorise us to access.
E. Usage & technical data
IP address, browser type, device information, login timestamps, session activity, feature usage logs, and cookies or similar technologies.
F. Communications
Support tickets, emails, call notes and other communications with our team. If support calls or screen-sharing sessions are recorded, we do so only where permitted and, where required, with notice or consent.
G. Derived, aggregated and de-identified data
We may generate aggregated, statistical or de-identified analytics from usage and performance data for internal reporting, service improvement, capacity planning and product development. This information is not intended to identify individual users.
3. Legal bases for processing
| Legal basis | What we rely on it for |
|---|---|
| Performance of a contract | Creating accounts, providing the Services, managing subscriptions and delivering support |
| Legal compliance | Tax, accounting, fraud prevention, law enforcement and other legal obligations |
| Legitimate interests | Securing the platform, preventing abuse, improving features, monitoring performance and protecting our business and users |
| Consent | Where legally required — including certain marketing communications, optional cookies and specific optional features |
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
4. How we use information
- Create and manage your account, and authenticate users
- Connect, manage and optimise Google Business Profiles and other approved integrations
- Fetch reviews, profile information, insights and analytics
- Generate or assist with posts, replies, summaries or workflows when enabled by you
- Process payments, invoices, renewals and refunds
- Provide customer support and service communications
- Improve product functionality, reliability and user experience
- Detect and prevent fraud, abuse, misuse and security incidents
- Comply with legal obligations and resolve disputes
5. AI & automated processing
Some GBPPromote features use automated systems or third-party AI models to support functionality such as review reply drafting, post generation, content suggestions, summarisation, categorisation and business insight generation.
These features assist users and improve workflow efficiency. We do not use connected customer Google Business Profile data to train generalised third-party AI models without explicit and documented consent.
Where AI-assisted features are available, you may be able to disable them, require approval before use or publishing, or request deletion of related generated content, subject to legal and operational requirements.
We do not use AI to make automated decisions producing legal or similarly significant effects on individuals. If you have concerns about how your data is used in connection with AI-assisted features, contact us at amit@gbppromote.com. Further detail is in our AI Transparency & Compliance statement.
6. Google API data, authorization & Limited Use Updated
GBPPromote connects to Google Business Profile using Google’s official Business Profile APIs and Google’s OAuth 2.0 authorization flow. When you connect Google Business Profile or another supported Google service, we access and process only the Google user data reasonably required to provide the functionality you requested — such as listing management, review management, analytics, profile optimisation and related workflows.
How the Google connection works
- Authorization happens with Google. You sign in to your Google account through Google’s authorization flow and review the permissions requested before granting access.
- We do not ask for or store your Google password. Google provides GBPPromote with OAuth credentials that allow only the access you have authorized.
- Access is permission-based. GBPPromote uses Google API access only for the connected features and Google account permissions you authorize.
- You remain in control. You can revoke GBPPromote’s Google access at any time through your Google Account permissions or by disconnecting the integration in GBPPromote.
- OAuth tokens and integration credentials are protected. We apply the security controls described in section 12, including secure storage of keys, tokens and secrets and least-privilege access practices.
For technical reference, see Google’s Business Profile OAuth documentation and Business Profile API documentation.
GBPPromote’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, we use Google user data only to provide and improve the user-facing features you requested. We do not use Google user data for advertising. We do not sell Google user data. We do not transfer Google user data to third parties except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to users. We do not allow humans to read Google user data unless we have your affirmative agreement, it is necessary for security purposes such as investigating abuse, to comply with applicable law, or the data has been aggregated and de-identified.
Revoking our access to your Google account
You can disconnect GBPPromote from your Google account at any time, independently of us, at myaccount.google.com/permissions. Revoking access stops further data retrieval immediately. Data already retrieved is handled under section 11 (Data retention).
Enterprise and security verification
Customers conducting an IT, privacy or security review may request additional information about GBPPromote’s Google integration, OAuth authorization, data handling and security controls by contacting amit@gbppromote.com. Any supporting information we provide describes our technical integration and security practices and should not be interpreted as an endorsement, sponsorship or certification of GBPPromote by Google.
7. We do not sell or share personal data New
We do not sell personal data, and we do not share personal data for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act as amended by the CPRA. We have not done so in the preceding twelve months.
We do not use customer data or connected Google Business Profile data for third-party advertising of any kind.
California residents also have the right not to receive discriminatory treatment for exercising their privacy rights. We do not deny services, charge different prices, or provide a different level of service because you exercised a right under this policy.
8. Cookies & tracking technologies
| Category | Purpose | Consent required |
|---|---|---|
| Essential | Login, session security, load balancing and core platform functionality. The Services cannot operate without these. | No |
| Functional | Remembering preferences and settings to improve usability. | Where required by law |
| Analytics | Understanding how the platform and website are used so we can improve them. | Yes, where required |
You may manage cookie preferences through your browser settings or through our cookie banner or consent tool where available. Full detail is in our Cookie Policy.
9. Sharing & third parties
We share personal data only where reasonably necessary, and only with:
- Service providers — hosting, cloud storage, analytics, payments, email delivery, customer support, security and infrastructure vendors
- Third-party integration providers — where required to provide a connected service you requested
- Legal, regulatory or governmental authorities — where required by law or valid legal process
- Parties involved in a corporate transaction — a merger, acquisition, restructuring, financing or sale of assets
We maintain contractual and operational safeguards with processors where appropriate, including Data Processing Agreements and transfer safeguards where required.
Our platform integrates with third-party services. Data processed through those services may also be subject to the privacy policies and terms of the relevant third party, and we encourage you to review those separately.
10. Subprocessors New
We use a limited set of subprocessors to operate the Services. Each is bound by contractual confidentiality and data protection obligations, and each processes personal data only on our documented instructions.
| Category | Purpose | Data involved |
|---|---|---|
| Hosting & infrastructure | Running the platform, storing application data and backups | All categories in section 2 |
| Payment processing | Taking payment, managing subscriptions and invoices | Billing contact and transaction metadata. Full card details are handled by the provider and never stored by us |
| Email delivery | Transactional email, notifications and service communications | Recipient address and message content |
| AI model providers | Powering AI-assisted drafting and summarisation where you enable those features | Only the content submitted for that task. Never used to train generalised models |
| Analytics | Understanding platform usage and performance | Usage and technical data |
| Customer support | Handling support conversations and tickets | Contact details and support message content |
The current list of named sub-processors, including each provider’s country of processing, is available on request at amit@gbppromote.com, and is supplied as part of any signed Data Processing Agreement or security review.
We will give reasonable notice of any new subprocessor that materially affects the processing of customer personal data. To request the current list or object to a subprocessor, contact amit@gbppromote.com.
11. Data retention
We retain personal data only for as long as reasonably necessary to provide the Services, operate the platform, resolve disputes, enforce agreements and comply with legal, tax, accounting and regulatory obligations.
| Data type | Retention period |
|---|---|
| Account & billing records | While the account is active, and up to 7 years afterwards where required for legal, tax or accounting purposes |
| Usage logs & technical records | A limited period for operational, fraud prevention, security, troubleshooting and analytics purposes |
| Generated content & workflow records | In accordance with product settings, support needs, internal retention practices and legal obligations |
| Google Business Profile data | While the integration is connected. On disconnection or deletion request, removed or anonymised within a reasonable period |
When deletion is requested, we will remove or anonymise data within a reasonable period, subject to legal obligations, legitimate operational needs and backup cycles. Data may persist in encrypted backups for a limited time before those backups expire on their normal schedule.
12. Security & breach notification Updated
- Encryption in transit using HTTPS or TLS
- Encryption at rest where feasible and appropriate
- Role-based access controls and least-privilege access practices
- Secure storage of keys, tokens and secrets
- Logging, monitoring and access review practices
- Security testing, maintenance and incident response processes
No system is completely secure. If a personal data breach occurs, we will act promptly to contain and investigate it.
Notification timeframes
Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, in line with GDPR Article 33.
Where the breach is likely to result in a high risk to individuals, we will also notify affected individuals without undue delay. Where we act as a processor for a customer, we will notify that customer without undue delay so they can meet their own obligations.
13. Your privacy rights
Depending on your location and applicable law, you may have the right to:
- Access — request a copy of the personal data we hold about you
- Correction — request that inaccurate or incomplete data is corrected
- Deletion — request erasure, subject to legal or contractual limits
- Objection or restriction — object to or restrict certain processing
- Portability — receive certain personal data in a portable format
- Withdraw consent — where consent is the legal basis for processing
- Revoke third-party permissions — including disconnecting GBPPromote from your Google account at myaccount.google.com/permissions
- Non-discrimination — you will not receive worse service for exercising a right
To exercise your rights, contact amit@gbppromote.com. We may need to verify your identity before processing certain requests, and we will respond within the period required by applicable law.
Right to complain to a regulator New
If you are in the European Economic Area or the United Kingdom, you have the right to lodge a complaint with your local data protection supervisory authority, in addition to contacting us. If you are in India, you may escalate to the Data Protection Board after exhausting our grievance process in section 19. We would appreciate the opportunity to address your concern first, but that does not limit your right to complain.
14. International data transfers
Your data may be processed in countries other than your own, including India, the United States and the European Union, depending on our infrastructure, vendors and the services you use.
Where required by law, we use appropriate safeguards for those transfers, including contractual protections such as Standard Contractual Clauses or comparable measures, together with technical and organisational security measures.
15. Children’s privacy
GBPPromote is not intended for individuals under 18 years of age, and we do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will delete it promptly. If you believe a child has provided us with personal data, contact us at amit@gbppromote.com.
16. Law enforcement & legal requests
We may disclose personal data where required to comply with applicable law, court orders, valid legal process or lawful requests from public authorities, or where necessary to protect the rights, property, safety and security of GBPPromote, our users or others.
Where we are legally permitted to do so, we will make reasonable efforts to notify the affected customer before disclosing their data in response to such a request.
17. Data Processing Agreement
Where we process personal data on your behalf as a processor, our Data Processing Agreement sets out the terms of that processing. Enterprise customers and other eligible customers may request a signed copy by contacting amit@gbppromote.com.
18. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our services, operations, legal requirements or data practices. Material changes will be posted on this page with an updated effective date, and where appropriate we will notify you by email or through the platform.
Continued use of the Services after an update may constitute acceptance of the revised policy where permitted by law. Where a change requires your consent under applicable law, we will seek it.
19. Grievance officer New
In accordance with India’s Digital Personal Data Protection Act 2023 and applicable rules, we have appointed a Grievance Officer to address questions and complaints about how we handle personal data.
If you are not satisfied with our response, you may escalate to the relevant supervisory authority or data protection board in your jurisdiction, as set out in section 13.
20. Contact & privacy requests
For questions, privacy requests, complaints or concerns about this Privacy Policy or our data handling practices:
Related legal documents
These documents apply alongside this Privacy Policy.