Privacy policy

Effective October 16, 2026

Business Profile Studio helps account holders prepare and publish Google Business Profile updates. Contact: winabhi.ak@gmail.com.

Information handled

The app stores your name, email address, account identifier, connected Google account details, encrypted Google refresh tokens, and encrypted AI provider API keys. If you use email/password sign-in, it stores a salted password hash. It stores saved booking URLs and post history, including post text, business identifiers, image references, publish status, and API errors. It retrieves the Business Profiles you are authorized to manage from Google. Uploaded images are stored in Cloudflare R2 for publishing.

Use and sharing

Google account access is used to sign you in, retrieve your authorized businesses, and publish updates you explicitly approve. Google user data is used only for these visible functions and is not sold or used for advertising. When you request AI generation, your uploaded image and optional notes are sent to the AI provider you select (Gemini, OpenAI, or OpenRouter). Do not include information in images or notes that you do not want that provider to receive. The app does not send Google OAuth tokens or your retrieved profile list to the AI provider. Provider processing is subject to that provider's terms and privacy policy.

Cloudflare hosts the app, database, and image storage. Google receives approved post text, CTA details, and the image URL when you publish. Post image URLs are accessible to anyone who knows the URL so Google can retrieve them; do not upload confidential images. The app uses essential HttpOnly session and OAuth state cookies. Infrastructure providers may process operational logs, network information, and request metadata.

Retention and control

Account data, provider settings, saved URLs, images, and post history remain stored until removed by the operator. You can remove provider keys and disconnect Google business connections in the app. Disconnecting a business connection removes its stored refresh token; it does not remove an independently linked Google sign-in identity or posts already published to Google. You can revoke Google authorization in your Google account permissions. Email winabhi.ak@gmail.com to request account and retained-data deletion. Data is retained until deletion is requested. Backup and infrastructure retention may be subject to Cloudflare's policies.

Google API data

The app's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including Limited Use requirements.