Privacy Policy

This Privacy Policy applies to the LocavoIQ website and software service (the “Service”). The Service is designed primarily for business and professional users. It applies to website visitors, account users, team members, and users who connect supported third-party services, including Google Business Profile.

LocavoIQ (域见) is developed and operated by Tensor Marketing Ltd. References to “we,” “us,” and “our” mean Tensor Marketing Ltd. For privacy and personal information requests, contact info@locavoiq.com.

We limit collection to information reasonably needed for the identified purposes described in this policy.

• Account information: name, email address, password-derived authentication data, team or organization information, role, invitation information, and account metadata.
• Subscription information: plan, subscription status, Stripe customer and subscription identifiers, and related billing metadata. Stripe processes payment card details; the Service does not store full payment card numbers.
• Technical and security information: session and language-preference cookies, IP address where recorded in activity logs, request or application logs, and information used to secure, debug, and operate the Service. Infrastructure providers may process browser or device details in server logs.
• Google Business Profile data: authorized account identifiers and names; locations and business information such as address, phone, website, categories, hours, profile and verification information; performance metrics; search keywords; customer reviews; existing owner replies and reply status; and data needed to carry out user-initiated reply actions.
• Support information: the content of messages and information you choose to provide when requesting account, billing, technical, privacy, or deletion support.
• Local SEO information: search keywords, selected grid coordinates and search area, language, device settings, scan schedules, business matching and competitor selections; public business search results such as names, addresses, phone numbers, website links, ratings, review counts and observed rankings.
• Website SEO information: submitted websites and page URLs, selected scan scope, publicly retrievable page content and HTML, titles, headings, metadata, links, structured data, response codes, and diagnostic findings. Public business pages may contain personal information, for example an individual business owner’s contact details.
• Scan and report records: task status, timestamps, usage and quota accounting, selected report content, and your acceptance of first-scan notices, including account, workspace, notice version and acceptance time.

The current Service uses cookies needed to maintain authenticated sessions and remember the selected language. We do not use third-party advertising or behavioural analytics tools. If analytics or non-essential cookies are added, this policy and any consent controls will be updated before that use begins.

We use information only for identified, legitimate purposes connected with operating and improving the Service.

• Create and maintain accounts, authenticate users, and administer team access.
• Connect authorized Google Business Profile accounts and retrieve permitted business information.
• Display location, performance, search-term, review, and reply information.
• Provide user-controlled review reply workflows and location management tools.
• Generate dashboard views, report previews, and PDF exports.
• Administer subscriptions and provide access to Stripe-hosted checkout and billing management.
• Respond to support, privacy, correction, deletion, and complaint requests.
• Protect the Service, prevent abuse, investigate errors, and meet legal obligations.
• Carry out scans you request or specifically schedule, compare public local business results, identify website issues, and compare available website contact information with your connected location within the Service.
• Maintain scan history and selected report snapshots, account for separate map-point and website-page allowances, and record your scan authorization and acceptance of notices.

If you choose Sign in with Google, we request your Google account identity, verified email address and basic profile information to authenticate and link an existing account. We store your Google account identifier for future sign-ins; we do not store Google login access or refresh tokens, or your Google password. Login alone does not authorize access to Business Profile data. Connecting Business Profile is a separate action and requests the business.manage scope.

The Service accesses Google Business Profile data only after a user who represents that they are authorized completes Google OAuth. The current OAuth scope is used to manage Business Profile information and supports both read functions and user-initiated review reply actions.

The Service uses Google data to provide visible location management, reporting, performance, search-term, review, reply, profile-health, and report features. It stores encrypted OAuth credentials and may temporarily cache limited authorized account, location, metric, search-term, review, reply, and related response fields to operate and improve the performance of those features. It does not use Google API data for advertising, sale, or unrelated profiling.

Google data may be processed by infrastructure providers that host the Service and its database, but only to operate the Service. People may read specific Google user data for support only after you affirmatively agree to that access. Exceptions are limited to necessary security investigations, legal obligations, or aggregated data used for internal operations as permitted by Google’s Limited Use requirements and applicable law.

Use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Content obtained through the Google Business Profile APIs is securely cached for no more than 30 calendar days from the time it is retrieved and may be deleted or replaced earlier. The historical date represented by a metric, review, or search term is separate from this cache period.

• Google API Services User Data Policy
• Google Business Profile API policies

Where consent is the appropriate basis for handling personal information, we seek meaningful consent in context and explain the consequences of the choice. Other handling may be permitted or required to provide a requested service, perform a contract, protect the Service, or comply with law.

Canadian privacy requirements, including PIPEDA principles and applicable provincial requirements, are applied where relevant to the organization, individual, transaction, and location. This policy does not claim that every provincial statute applies in every circumstance.

• Accountability and openness about our privacy practices and service providers.
• Identifying purposes before or when information is collected and seeking meaningful consent where required.
• Limiting collection, use, disclosure, and retention to appropriate purposes.
• Taking reasonable steps to keep personal information accurate and protected by safeguards.
• Providing applicable access, correction, consent-withdrawal, and complaint processes.

We do not sell personal information or Google API user data. We do not use Google API user data for targeted advertising or share it with data brokers.

We may disclose limited information to service providers that operate the Service, including application hosting and managed database providers and Stripe for payment processing. We may also disclose information to professional advisers, a purchaser in a legitimate corporate transaction subject to appropriate safeguards, or authorities where required by law. Providers may use information only for the services they provide to us and under applicable contractual or legal duties. These general disclosure provisions do not expand permitted uses of Google user data: any transfer of Google user data in a merger, acquisition or sale of assets requires your explicit prior consent and compliance with Google’s Limited Use requirements.

We currently do not send Google Business Profile data to an external AI or large language model (LLM) provider. We plan to add LLM-assisted features. Before enabling an external provider, we will identify the provider, the data sent, its purpose and retention arrangements in our disclosures, and obtain the required consent before any transfer. Google authorization alone does not authorize this future transfer. We do not use Google user data to train general-purpose AI models.

Search data services and website scanning services receive the search keywords, coordinates and search settings, or website domains, page URLs and crawl settings needed to perform your requested scan. Website scanning involves retrieving and storing public page HTML to support analysis. We do not send your LocavoIQ password, payment-card details or Google OAuth tokens to these services. We compare connected location contact fields within the Service; the original Google contact values are not included in retained mismatch evidence.

Email delivery services process recipient addresses and message content for account communications and reports you arrange. Service providers may process information outside Canada as described below.

Service providers may process information in Canada, the United States, or other jurisdictions where they operate. Information processed outside your province, state, or country may be subject to the laws and lawful access requirements of that jurisdiction. We do not represent that all information remains in Canada.

You can delete your personal account in Security settings. The last workspace owner must first hand over ownership, or close the workspace after removing other members, ending subscriptions, resolving billing and disconnecting Google. Closure stops synchronization, scheduled reports and new SEO scan submissions; it does not delete Business Profiles on Google or automatically issue refunds. Some business, billing and security records remain under our Privacy Policy and applicable law. Contact info@locavoiq.com to request deletion of stored data.

We retain personal information only for as long as reasonably needed for the identified purposes, subject to legal, accounting, security, dispute, and backup requirements. Different categories may have different retention periods.

The Service may request Google Business Profile information for historical date ranges supported by Google. Each locally cached copy of Google API Content, including cached source or derived fields used by Google-dependent features, is retained for no more than 30 calendar days from its actual retrieval and may be refreshed, replaced, or deleted earlier. A historical reporting date does not extend or shorten that cache period.

A verified deletion request may be subject to legal or technical exceptions. Disconnecting Google stops future authorized access through the disconnected credentials but does not by itself delete the user’s Google Business Profile or automatically delete all historical SaaS records.

Generated report records and SEO report snapshots are available for 20 days from generation and are then removed through scheduled cleanup. Exported copies you download or share are under your control. Google API content remains subject to its original cache expiry; creating another report does not renew that expiry.

Scan history, results and issue records are retained for up to 365 days to support comparison and reporting, then removed through scheduled cleanup. Website projects, customer-selected scan settings and business associations remain while the workspace is active unless deletion is requested. Closing a workspace stops new scan submissions and recurring scans; results of already accepted tasks may still be collected. SEO data stored by the Service and scan-notice receipts are scheduled for deletion 30 days after closure. These periods do not override records required for billing, security or legal obligations.

External scan services may retain task records for up to 12 months; result-access windows may be shorter. The 20-day report period applies to our report records and does not mean that every external task record or page copy is deleted at that time. We coordinate verified deletion requests with relevant processing services, subject to applicable legal obligations and technical limitations. Backup copies are removed through normal backup rotation.

We use reasonable administrative, technical, and organizational safeguards appropriate to the sensitivity of the information. We protect accounts and Google authorization credentials through secure sessions, access controls and encrypted credential storage. No system can be guaranteed to be completely secure.

Subject to PIPEDA and applicable provincial privacy law, you may ask for access to personal information about you, information about its use and disclosure, correction of inaccurate information, withdrawal of consent where legally available, or deletion where applicable. You may also raise a privacy complaint or challenge our compliance.

We may need to verify identity and authority before responding. Some information may be withheld or retained where an exception applies, and we will explain the basis where required.

If a comprehensive U.S. state privacy law applies to you and to the Service, you may have rights to know or access personal information, request deletion, request correction, obtain a portable copy where applicable, and opt out of sale, targeted advertising, or qualifying sharing. You may also have a right to limit certain uses of sensitive personal information, appeal a denied request, and receive non-discriminatory treatment for exercising privacy rights.

These rights, definitions, exceptions, and business thresholds vary by state. This section does not state that the CCPA/CPRA or every state law applies to the Service in all circumstances. We do not currently sell personal information or use Google API data for targeted advertising.

Email info@locavoiq.com with the subject “Privacy Request.” Describe the account and request, but do not send passwords or payment-card details. We may ask for information needed to verify identity, account authority, and jurisdiction. Authorized agents may be required to provide proof of authority.

We will respond in accordance with the timelines and procedures required by applicable law. If applicable law provides an appeal right after a request is denied, you may appeal by replying to our decision or emailing the same address with the subject “Privacy Appeal.”

You may withdraw consent where legally permitted. A team owner can disconnect Google Business Profile from Settings. Disconnecting revokes the applicable Google OAuth authorization where technically available, removes locally stored access credentials, and prevents future access through that connection. Google-dependent synchronization, review reply, and reporting functions may stop working.

You may also revoke access in your Google Account settings. Disconnecting does not delete or transfer ownership of a Google Business Profile and is separate from deleting the SaaS account or requesting deletion of stored information.

Map ranking scans and website scans use public search and webpage information independently of the Google Business Profile connection. Disconnecting Google does not itself delete their history or replace turning off scan schedules. You can turn off weekly map scans in location settings; turning them off stops future scheduled scans but does not cancel tasks already accepted. Contact our privacy address to request deletion of stored SEO data or withdraw permission for future processing.

The Service is intended for business and professional use and is not directed to children under 13. We do not intentionally design the Service to collect personal information from children.

We may update this policy as the Service or legal requirements change. We will display an updated effective date. Material changes to how Google user data is accessed, used, stored, or shared may require prominent notice and renewed consent before the new practice begins.

For privacy questions, access or correction requests, deletion requests, consent withdrawal, or complaints, contact info@locavoiq.com. We will review the concern and explain available escalation options where required by applicable law.