GBP Tools Data Processing Addendum
Effective: November 1, 2026
Version: 2026-11-01
1. Scope and roles
1.1 This Addendum is part of the GBP Tools Terms of Service between Pitch + Pivot, LLC ("we", "us") and the business, agency or consultant that holds a GBP Tools account, on a paid plan or not ("Customer"). It covers personal information we process for Customer through the Service, as the Terms define it ("Customer Personal Data"). That includes information about Customer's business, its clients' businesses and the people in them, Customer's own team, and people who appear in its profiles, such as reviewers. It applies to managed accounts (Terms section 18) too, except that Terms section 18 sets when we stop work and delete data.
1.2 For Customer Personal Data, Customer decides the purposes (as a controller, or as a processor acting for its client), and we process it for Customer as its processor or service provider. We decide the purposes, as a controller, for our own records about Customer's account, billing, security and product analytics, which our Privacy Policy covers.
2. Processing details
| Item | Detail |
|---|---|
| Subject matter | Providing GBP Tools to Customer |
| Duration | While Customer's account exists, then section 8 |
| Purpose | Reading Google Business Profile data, scoring profiles and recommending changes, drafting and, on approval by Customer or its client or through the automatic features Customer turns on, publishing posts, replies and profile changes; rank maps and AI visibility checks; reports, alerts and approval emails; securing and supporting the Service; creating statistics that can't identify any customer or person; and improving the Service using data that can't identify any customer or person |
| People | Customer's staff; its clients' owners, staff and contacts; reviewers, people who manage the profiles on Google, and others who appear in Customer's profiles |
| Types of data | Names, email addresses, phone numbers, business addresses, Google account emails, review text, ratings and reviewer names, photos, notes and comments, performance numbers and the search terms customers used |
| Sensitive data | Not intended. Customer must not put sensitive information (for example, health information about patients) into the Service beyond what already appears in public reviews. We don't sign business associate agreements under HIPAA, and this Addendum isn't one. |
3. What we do
We will:
(a) process Customer Personal Data only to provide, secure and support the Service, to create statistics that can't identify any customer or person, and to improve the Service using data that can't identify any customer or person, following Customer's documented instructions (the Terms, this Addendum and the settings Customer chooses). If the law requires other processing, we'll tell Customer first unless the law forbids that. We'll tell Customer if we believe an instruction breaks the law;
(b) make sure people who can access it are bound by confidentiality, and limit staff access by the rule in section 6;
(c) keep the security measures in section 6;
(d) help Customer, at no charge for reasonable requests, to answer people who use their privacy rights and to meet its duties on security, breach notices and assessments, including information Customer reasonably needs for a privacy impact assessment or a transfer assessment (for example, under Quebec law);
(e) delete Customer Personal Data as section 8 says;
(f) give Customer the information it reasonably needs to show compliance, as section 9 says;
(g) if a government or court asks us for Customer Personal Data, tell Customer first unless the law forbids it, and disclose only what we must.
Google user data in Customer Personal Data also stays under the limits in our Privacy Policy, section 4.3.
4. What Customer does
Customer confirms that:
(a) it and each client have the right to connect each profile and to have us process the data as Customer sets it up;
(b) it has each client's express, written permission to act for it, covering each automatic feature Customer turns on for that client (Terms, section 6.1);
(c) it gives clients and others any notices the law requires;
(d) the contacts it adds may receive the emails Customer sets up;
(e) it won't instruct us to process data unlawfully.
Customer removes any client, contact or team member who should no longer be in the Service.
5. Sub-processors
5.1 Customer authorizes the sub-processors in the first table of our Privacy Policy, section 8. The public services in the second table receive only the business addresses, website domains and search words listed there.
5.2 We bind each to data protection terms that protect Customer Personal Data at least as well as this Addendum, and we remain responsible for them. We don't use Customer Personal Data to train AI models. Under their API terms, Anthropic and OpenAI don't train their models on it.
5.3 We'll give at least 30 days' notice of a new sub-processor by email to the account owner and by updating the first table in our Privacy Policy, section 8. If we must replace a sub-processor urgently to keep the Service secure or running, we may make the change first and give notice as soon as we can. Customer may object on reasonable data protection grounds within 30 days of the notice. If we can't resolve the objection, Customer may cancel with immediate effect, and we'll refund the prepaid fees for the rest of that month.
6. Security
We keep these measures:
- encryption in transit, and encryption of Google access tokens at rest;
- database access rules that keep each customer's data separate for signed-in users, plus database checks that stop any writer, our own server included, from attaching one customer's data to another customer's location;
- links in approval and report emails that open a page without signing in expire (approval links after 14 days, report links after 45 days); unsubscribe and remove-my-access links don't expire, so people can always use them;
- rate limits on public pages and on those links;
- this staff access rule, which also appears in our Terms and Privacy Policy: Our staff (our employees and contractors) see the data in a self-serve account, whether in the app, in our staff tools or in our database, only: (a) with the permission of someone on that account, for specific help they asked for; (b) for security, including investigating abuse or a bug; (c) to comply with the law; or (d) as statistics combined across accounts that don't identify anyone, for internal operations. We log staff access to self-serve accounts in the app. For a managed account, our team also works in your account to do the work you hired us for (Terms section 18).
7. Breaches
We'll tell Customer without undue delay, and within 72 hours after we confirm a breach affecting Customer Personal Data. We'll share what we know at the time: what happened, the data affected, likely effects and what we're doing. We'll send more as we learn it. Customer decides whether to tell its clients, individuals and regulators, and we'll help. Telling Customer about a breach isn't an admission of fault.
8. Deletion
- Removing a client: when Customer removes a client in the Service, we stop work on that client's Google profiles, and disconnect them and delete the client's data from the Service, including stored files, within 7 days. Usage records follow Privacy Policy section 6.
- Deleting the account: Customer asks us at support@gbptools.com, and we delete all Customer Personal Data in the Service, including stored files, within 30 days.
- After the plan or the Google connection ends: we delete content from Google within 30 days after the plan ends or the Google connection ends, whichever comes first. An agency account is deleted when Customer asks us (Deleting the account, above). A single business's account is deleted 12 months after its plan ends, and we email the account owner 30 days before.
- Accounts that never start a plan: we delete content from Google within 30 days after Customer's last free profile check. A single business's account is deleted 12 months after anyone last signed in to it, and we email the account owner 30 days before.
- On request: Customer can ask us at support@gbptools.com to delete or export Customer Personal Data at any time; we'll do it within 30 days and confirm in writing when it's done. Exports come in a standard format such as CSV or JSON.
- Managed accounts: we keep the account, its history and content from Google while the client is with us, and delete them within 30 days after Customer asks once the service ends (Terms section 18).
- Backups and logs: backups are kept for up to 30 days, then overwritten. Provider logs keep data only until they expire on their own schedule. We keep what the law requires us to keep, and protect it under this Addendum while we do.
9. Information and audits
Once a year, on 30 days' notice and under confidentiality, we'll answer Customer's written questions about how we protect Customer Personal Data, and give the documents that answer them. If those answers don't reasonably show compliance, after a confirmed breach, or where a regulator requires it, Customer (or an independent assessor it chooses, bound by confidentiality) may carry out a reasonable assessment, at Customer's cost, during business hours, without access to other customers' data. We'll cooperate.
10. Where data is processed
The Service is offered to businesses based in the United States or in Canada outside Quebec, and we and our main sub-processors process data in the United States. Customer is responsible for telling its clients that their information is processed there.
11. US state privacy laws
Where US state privacy laws, including California's, apply, we are Customer's service provider or processor, and we will not:
- sell or share Customer Personal Data;
- keep, use or disclose it for any purpose other than the purposes in section 2, or outside our direct relationship with Customer;
- combine it with other data, except as those laws allow.
We'll comply with those laws as they apply to us and give Customer Personal Data the level of privacy protection they require. We process it only for the purposes in section 2. We'll help Customer respond to consumer requests as section 3(d) says. We'll tell Customer if we can no longer meet these obligations. Customer may take reasonable steps to make sure we use Customer Personal Data as this Addendum allows, and to stop and fix any unauthorized use.
12. Liability, precedence and changes
12.1 Liability under this Addendum is subject to the limits in section 14 of the Terms. If this Addendum conflicts with the Terms about personal information, this Addendum controls.
12.2 We may update this Addendum as section 17 of the Terms describes. Changes to sub-processors follow section 5.3.
13. Contact
Pitch + Pivot, LLC, 640 Ellicott St, Buffalo, NY 14203, support@gbptools.com. Notices go to the account owner's email.