Privacy Policy

This Privacy Policy applies to the GBP Reports website and software service (the “Service”). The Service is designed primarily for business and professional users. It applies to website visitors, account users, team members, and users who connect supported third-party services, including Google Business Profile.

We use “we,” “us,” and “our” because the exact legal operating entity must be confirmed before launch. If a customer agreement contains additional privacy terms, those terms also apply to the extent stated in that agreement.

We limit collection to information reasonably needed for the identified purposes described in this policy.

• Account information: name, email address, password-derived authentication data, team or organization information, role, invitation information, and account metadata.
• Subscription information: plan, subscription status, Stripe customer and subscription identifiers, and related billing metadata. Stripe processes payment card details; the Service does not store full payment card numbers.
• Technical and security information: session and language-preference cookies, IP address where recorded in activity logs, request or application logs, and information used to secure, debug, and operate the Service. Infrastructure providers may process browser or device details in server logs.
• Google Business Profile data: authorized account identifiers and names; locations and business information such as address, phone, website, categories, hours, profile and verification information; performance metrics; search keywords; customer reviews; existing owner replies and reply status; and data needed to carry out user-initiated reply actions.
• Support information: the content of messages and information you choose to provide when requesting account, billing, technical, privacy, or deletion support.

The current Service uses cookies needed to maintain authenticated sessions and remember the selected language. The inspected application does not include a third-party advertising or behavioural analytics integration. If analytics or non-essential cookies are added, this policy and any consent controls will be updated before that use begins.

We use information only for identified, legitimate purposes connected with operating and improving the Service.

• Create and maintain accounts, authenticate users, and administer team access.
• Connect authorized Google Business Profile accounts and retrieve permitted business information.
• Display location, performance, search-term, review, and reply information.
• Provide user-controlled review reply workflows and location management tools.
• Generate dashboard views, report previews, and PDF exports.
• Administer subscriptions and provide access to Stripe-hosted checkout and billing management.
• Respond to support, privacy, correction, deletion, and complaint requests.
• Protect the Service, prevent abuse, investigate errors, and meet legal obligations.

The Service accesses Google Business Profile data only after a user who represents that they are authorized completes Google OAuth. The current OAuth scope is used to manage Business Profile information and supports both read functions and user-initiated review reply actions.

The Service uses Google data to provide visible location management, reporting, performance, search-term, review, reply, profile-health, and report features. It stores encrypted OAuth credentials and may temporarily cache limited authorized account, location, metric, search-term, review, reply, and related response fields to operate and improve the performance of those features. It does not use Google API data for advertising, sale, or unrelated profiling.

Google data may be processed by infrastructure providers that host the Service and its database, but only to operate the Service. Human access is restricted to support, security, legal, or other circumstances permitted by the Google API Services User Data Policy and applicable law.

Use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Content obtained through the Google Business Profile APIs is securely cached for no more than 30 calendar days from the time it is retrieved and may be deleted or replaced earlier. The historical date represented by a metric, review, or search term is separate from this cache period.

• Google API Services User Data Policy
• Google Business Profile API policies

Where consent is the appropriate basis for handling personal information, we seek meaningful consent in context and explain the consequences of the choice. Other handling may be permitted or required to provide a requested service, perform a contract, protect the Service, or comply with law.

Canadian privacy requirements, including PIPEDA principles and applicable provincial requirements, are applied where relevant to the organization, individual, transaction, and location. This policy does not claim that every provincial statute applies in every circumstance.

• Accountability and openness about our privacy practices and service providers.
• Identifying purposes before or when information is collected and seeking meaningful consent where required.
• Limiting collection, use, disclosure, and retention to appropriate purposes.
• Taking reasonable steps to keep personal information accurate and protected by safeguards.
• Providing applicable access, correction, consent-withdrawal, and complaint processes.

We do not sell personal information or Google API user data. We do not use Google API user data for targeted advertising or share it with data brokers.

We may disclose limited information to service providers that operate the Service, including application hosting and managed database providers and Stripe for payment processing. We may also disclose information to professional advisers, a purchaser in a legitimate corporate transaction subject to appropriate safeguards, or authorities where required by law. Providers may use information only for the services they provide to us and under applicable contractual or legal duties.

The inspected implementation does not send Google Business Profile data to an external AI provider. If that practice changes, we will update our disclosures and obtain any consent required before the new use.

Service providers may process information in Canada, the United States, or other jurisdictions where they operate. Information processed outside your province, state, or country may be subject to the laws and lawful access requirements of that jurisdiction. We do not represent that all information remains in Canada.

We retain personal information only for as long as reasonably needed for the identified purposes, subject to legal, accounting, security, dispute, and backup requirements. Different categories may have different retention periods.

The Service may request Google Business Profile information for historical date ranges supported by Google. Each locally cached copy of Google API Content, including cached source or derived fields used by Google-dependent features, is retained for no more than 30 calendar days from its actual retrieval and may be refreshed, replaced, or deleted earlier. A historical reporting date does not extend or shorten that cache period.

A verified deletion request may be subject to legal or technical exceptions. Disconnecting Google stops future authorized access through the disconnected credentials but does not by itself delete the user’s Google Business Profile or automatically delete all historical SaaS records.

We use reasonable administrative, technical, and organizational safeguards appropriate to the sensitivity of the information. The implementation includes HTTPS-compatible transport, HTTP-only session cookies, server-side access controls, signed OAuth state, and encrypted storage of Google access and refresh credentials. No system can be guaranteed to be completely secure.

Subject to PIPEDA and applicable provincial privacy law, you may ask for access to personal information about you, information about its use and disclosure, correction of inaccurate information, withdrawal of consent where legally available, or deletion where applicable. You may also raise a privacy complaint or challenge our compliance.

We may need to verify identity and authority before responding. Some information may be withheld or retained where an exception applies, and we will explain the basis where required.

If a comprehensive U.S. state privacy law applies to you and to the Service, you may have rights to know or access personal information, request deletion, request correction, obtain a portable copy where applicable, and opt out of sale, targeted advertising, or qualifying sharing. You may also have a right to limit certain uses of sensitive personal information, appeal a denied request, and receive non-discriminatory treatment for exercising privacy rights.

These rights, definitions, exceptions, and business thresholds vary by state. This section does not state that the CCPA/CPRA or every state law applies to the Service in all circumstances. We do not currently sell personal information or use Google API data for targeted advertising.

Email info@tensorcanada.com with the subject “Privacy Request.” Describe the account and request, but do not send passwords or payment-card details. We may ask for information needed to verify identity, account authority, and jurisdiction. Authorized agents may be required to provide proof of authority.

We will respond in accordance with the timelines and procedures required by applicable law. If applicable law provides an appeal right after a request is denied, you may appeal by replying to our decision or emailing the same address with the subject “Privacy Appeal.”

You may withdraw consent where legally permitted. A team owner can disconnect Google Business Profile from Settings. Disconnecting revokes the applicable Google OAuth authorization where technically available, removes locally stored access credentials, and prevents future access through that connection. Google-dependent synchronization, review reply, and reporting functions may stop working.

You may also revoke access in your Google Account settings. Disconnecting does not delete or transfer ownership of a Google Business Profile and is separate from deleting the SaaS account or requesting deletion of stored information.

The Service is intended for business and professional use and is not directed to children under 13. We do not intentionally design the Service to collect personal information from children.

We may update this policy as the Service or legal requirements change. We will display an updated effective date. Material changes to how Google user data is accessed, used, stored, or shared may require prominent notice and renewed consent before the new practice begins.

For privacy questions, access or correction requests, deletion requests, consent withdrawal, or complaints, contact info@tensorcanada.com. We will review the concern and explain available escalation options where required by applicable law.