GBP Tools Privacy Policy
Effective: November 1, 2026
Version: 2026-11-01
In short
This summary isn't the full policy; the sections below are.
- We collect what we need to run GBP Tools: your account details, the Google Business Profile data you connect, and how you use the app.
- We use Google data only to provide and improve the features you see in GBP Tools. We don't use it to train AI models.
- We don't sell personal information, Google data included, or use it for advertising.
- We use service providers (hosting, email, payments, AI drafting, rank maps) who work for us under contract, and a few public services that get only business addresses, website domains and search words (section 8).
- You can get a copy of your data, correct it and delete it. Email support@gbptools.com. Section 10 explains how.
1. Who we are
Pitch + Pivot, LLC, 640 Ellicott St, Buffalo, NY 14203 ("we", "us") does business as GMB Gorilla and runs GBP Tools: the app, the free name check, the free profile check, the suspended-listing tools and our website (together, the "Service"). We decide how your personal information is used for it. Questions: support@gbptools.com. Our person in charge of protecting personal information (our privacy contact) is Garrett Smith, Owner (support@gbptools.com). GBP Tools is not affiliated with or endorsed by Google.
This policy explains how we handle personal information. It is not part of our Terms of Service, except where the Terms point to it for a specific promise.
If you are a client of an agency that uses GBP Tools, your agency decides what we do with your information in GBP Tools, and we act for them (see section 9). If GMB Gorilla manages your profile for you (a "managed" account, Terms section 18), this policy explains how the app handles your data.
2. What we collect
When you use the app
- Account: your name if you give it, email address, sign-in details (password hash, or your Google or email sign-in; with Google sign-in, also your Google name and profile picture), the account you belong to and your role.
- Business and contacts: business names, addresses, phone numbers, websites, logos, contact names and emails for reports and approvals, and notes and instructions you type.
- Google Business Profile data (when you connect Google, see section 4): profile details and attributes, verification status, photos, posts, reviews (including the reviewer's public name and text), replies, performance numbers, the search terms customers used, and who manages the profile.
- Your website: we read the public pages of the business website you give us to check facts and draft content.
- Your choices and records: approvals, comments, edits, the automatic features you turn on or off, which versions of our Terms and Data Processing Addendum you agreed to and which version of this policy you were shown, and when (with a scrambled form of your internet address and your browser type at that moment), and your email preferences and unsubscribes.
- Billing: your plan and billing status, and the Stripe customer ID. Stripe collects your card details; we never see your full card number.
- Usage: pages and actions in the app, page load times, and technical data such as browser type. Analytics run only after you sign in (section 7).
- Support: messages you send us.
If GMB Gorilla manages your profile
Details from your order with GMB Gorilla (such as your name, business details, keywords and intake answers), your billing status from that order, and the Google access you gave our team.
When someone asks you to share a Google profile
If a GBP Tools customer asks you to share a profile with them, we have your name and email (from them), any short note they wrote, the Google login you connect with, and which profiles you choose to share.
When you use the free tools without an account
- Free name check: the business name and city you search, and the public listing result. To enforce daily limits we store a scrambled form of your internet address (a hash made with a secret key), never the address itself. We set a cookie for 7 days so your result can carry over if you sign up.
- "Have our team take it" form: your name, email, phone and business, which go to our team. We use them only to answer that request, and we don't send you marketing emails.
Data about other people
- Reviewers: their public name and what they wrote.
- People who manage a profile on Google: their name or email as Google shows it.
- People you invite or add as contacts: name, email, title and phone.
- Nearby businesses in rank maps: the public names and addresses of businesses that show up in Google Maps.
- What AI assistants said about your business, from AI visibility checks.
3. How we use it
- To provide the Service: show your profiles and reviews, score them, draft changes, posts and replies, make the changes you approve or turned on, build reports and send alerts.
- To run your account: sign-in, team access, billing and the emails you need (approvals, reports, receipts).
- To keep the Service safe: preventing abuse, enforcing limits, fixing problems.
- To improve the app, using usage data and statistics that don't identify you.
- To meet legal obligations, such as tax records.
- We don't sell personal information, and we don't share it for targeted advertising.
4. Google user data
This section covers information we get from Google's APIs when you connect a Google account ("Google user data"). The free name check doesn't use your Google account or Google's APIs; it uses public listing data from a third-party provider, LocalSEO Data (section 8).
4.1 What we ask for. One Business Profile permission (https://www.googleapis.com/auth/business.manage), plus your Google account's email and basic profile so we know which login you connected. Google doesn't offer a narrower permission for these features. For the profiles you choose, we use it to:
- read and update profile details and attributes (such as name, address, phone, hours, categories, services and description);
- read photos, and add and delete photos;
- read posts, and publish posts;
- read reviews, and post, edit and delete review replies;
- read performance numbers and the search terms customers used;
- read verification status;
- read who manages the profile;
- receive Google's notices about changes to your profiles, such as a new review.
Only for profiles our team manages for you (Terms section 18), we also use it to:
- accept the invitation you send for our team to manage the profile;
- add or remove a manager when you ask us to.
Signing in to GBP Tools with Google is separate from this permission. If you choose it, we receive your Google email, name and profile picture, and use them only to create and secure your login. It gives us no access to your Business Profile.
4.2 Why.
- Profile details and attributes: to show and score your profiles and, when you approve it or turned it on, update them on Google.
- Photos: to show and check them, and to add or delete photos when you approve it.
- Posts: to show what is live and publish the posts you approve or turned on.
- Reviews and replies: to show reviews, alert you, draft replies, and post, edit or delete the replies you approve or turned on.
- Performance data and search terms: for your reports, and to choose the searches your rank maps and AI visibility checks track (section 4.3).
- Verification status: to warn you about unverified or suspended profiles and hold profile changes to them.
- Who manages the profile: to show you who has access.
- Google's change notices: so alerts about new reviews and changes arrive on time.
- Accepting invitations and adding or removing managers (managed accounts only): to get the access you gave our team, and to change who manages the profile when you ask.
- Account email and name: to show which Google login is connected and avoid connecting the wrong one.
4.3 Limited Use. GBP Tools' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In practice:
- We use Google user data only to provide and improve the features you see in GBP Tools.
- We share it only: with the service providers in section 8 that help provide the features you use, which you agree to when you connect Google and use those features; to keep the Service secure, for example to investigate abuse; to comply with the law; or, if our business is sold or merged, only with your explicit consent, given before it moves.
- To draft review replies, posts and profile text and to check photos, we send the Google user data that draft needs (for example a review's text, the reviewer's public name and your profile details) to our AI providers, Anthropic and OpenAI. They process it only to return the result to us for you. Under their API terms they don't train their models on it, and they may keep it for a short period to detect abuse.
- To make post images, we send Bannerbear or Ideogram the post's text and image instructions built from your business type, services and location. Post text can include your business name and details from your profile. We send it so they can return the image to us for you.
- For rank maps and AI visibility checks, we send LocalSEO Data (a company related to us) or Local Falcon the public details of your locations (name, address, category, coordinates and Google place ID) and the searches to check. Some of those searches come from the search terms Google reports customers used to find you. For AI visibility checks, LocalSEO Data asks ChatGPT, Gemini, Claude, Perplexity and Google's AI answers those questions; they receive only the question, which names your business, its category and city, and the search. LocalSEO Data, which has the same owners as GMB Gorilla, and Local Falcon use what we send only to return results to us for you, and don't keep or reuse it.
- We don't use Google user data, or anything derived from it, to create, train or improve AI or machine-learning models, ours or anyone else's. Settings learned from your own edits, such as your brand voice, are used only for your account.
- We may combine Google user data into statistics that don't identify you, your business or anyone else. We use them only to run and improve GBP Tools' features, and we don't share them outside GBP Tools, including with LocalSEO Data.
- We don't use or share it for advertising, and we don't sell it.
- We never show one customer's Google Business Profile data to another customer. Competitor comparisons use public data only.
- No Google user data, such as reviews, reviewer names or your Google login email, goes to our analytics provider (section 7).
- Our staff read Google user data only under the staff access rule in section 5.
4.4 Your control. Disconnect Google any time in Settings, or remove our access at https://myaccount.google.com/permissions.
- If you disconnect in Settings, we stop reading and changing your profiles, and revoke and delete our access tokens. If the same Google login is still connected to another account you have with us, we keep that login connected for that account.
- If you remove our access in your Google account, we stop using it, and delete the stored access tokens within 30 days after Google refuses them or after your plan ends.
- Either way, we delete the content we copied from Google within 30 days after the connection ends (section 6). For a managed account, the managed rule in section 6 applies instead.
- If our team was added as a manager or owner of your profile on Google, we remove that role within 7 business days of your request or of your account being deleted.
5. Who on our team can see your data
Our staff (our employees and contractors) see the data in a self-serve account, whether in the app, in our staff tools or in our database, only: (a) with the permission of someone on that account, for specific help they asked for; (b) for security, including investigating abuse or a bug; (c) to comply with the law; or (d) as statistics combined across accounts that don't identify anyone, for internal operations. We log staff access to self-serve accounts in the app. For a managed account, our team also works in your account to do the work you hired us for (Terms section 18).
For managed accounts, our staff view and act on your Google data only to do the work you hired us for (Terms section 18), for security, and as the law requires.
6. How long we keep it
| Data | How long |
|---|---|
| Content from Google (profile details, photos, reviews and reviewer names, replies, posts, performance data, search terms, and the monthly report PDFs made from them) | While Google is connected and your plan is active. Deleted within 30 days after your Google connection ends or your plan ends, whichever comes first. |
| Content from Google in an account that never started a plan (free profile check only) | Deleted within 30 days after your last free profile check, or within 30 days after you disconnect Google if that comes first. |
| A single business's account that never started a plan | Deleted 12 months after anyone last signed in to it. We email the account owner 30 days before. |
| Reviews Google removed | The review text and reviewer name are deleted 30 days after Google removes the review. We keep the counts. |
| Your account, account settings, business details you entered, and approval history (without content from Google) | Until your account is deleted. An agency account is deleted when you ask us. A single business's account is deleted 12 months after its plan ends, and we email the account owner 30 days before. If you ask us to delete it, we do so within 30 days (section 10). Content from Google follows the first row either way. |
| Records of what you agreed to (section 2) | Kept while your login exists. |
| Google access tokens | Deleted when you disconnect in Settings or your account is deleted. If you remove our access in your Google account, deleted within 30 days after Google refuses them or after your plan ends. If someone connects through a share request but picks no profiles within 7 days, we disconnect that login. |
| Rank map lists of nearby businesses | Full lists for 90 days. After that we keep the list only for the latest scan of each search in each month (used in your monthly report), until your account is deleted. |
| Free name check results | 30 days |
| "Have our team take it" requests | 90 days in the app; our team may keep the email it sends us |
| Share requests (the person asked, the profiles shared) | Until 12 months after the request ends |
| Usage events | Up to 13 months, in our database and in PostHog. |
| Records of our staff opening your account (section 5) | 24 months, also after your account is deleted. |
| Email delivery records | 13 months in our database. Resend keeps its delivery logs for its own short period. |
| Rate-limit counters (scrambled internet address) | Deleted within 4 days |
| "Stop emailing me" and unsubscribe records | Kept, so we keep honouring them |
| Billing records | As long as tax and accounting law requires, by Stripe and by us |
| Backups | Kept for up to 30 days, then overwritten. |
| Service-provider logs | Until they expire on the provider's schedule. |
For managed accounts, instead of the rows above for content from Google, your account and access tokens: we keep your account, history and content from Google while you're a client, and delete them within 30 days after you ask once the service ends.
7. Cookies and analytics
We use cookies that make the Service work: keeping you signed in, remembering the account you picked, carrying the Google sign-in step safely, remembering your sign-up choices for 7 days, and the free name check's 7-day result cookie.
After you sign in, we use PostHog to understand how the app is used: page views, clicks (with the text on the page hidden) and page load times. We don't record sessions. PostHog stores an analytics cookie and local storage in your browser. It identifies you only by account and user IDs. It gets no names or email addresses, it is set not to keep IP addresses, and it receives no Google user data. We don't run analytics on public pages, on links in our emails that open a page without signing in, or before you sign in.
On our website (gbptools.com, not the app), we use Google Analytics to see how many people visit and where they came from, unless you turn it off in the cookie banner (in the EEA, UK and Switzerland it's off until you accept). It gets no Google Business Profile data and no account information, and its advertising features are off. We use no advertising cookies or trackers.
8. Service providers
These companies process personal information for us, under contract, only to help provide the Service. This table is our list of sub-processors for the Data Processing Addendum; we update it when a provider changes.
| Provider | What for | What they get |
|---|---|---|
| Supabase | Database, sign-in and file storage | Everything we store |
| Vercel | Hosting | All requests to the Service |
| Inngest | Background jobs | Job details such as account and location IDs, business names and report recipients |
| Resend | Sending email | Recipients and email contents |
| Stripe | Payments (Stripe also handles card details under its own privacy policy) | Your email, business or agency name, and billing details |
| Your Business Profile and Google sign-in (section 4); Google Analytics on our website (section 7) | The profile changes, photos, posts and replies we send for you, as section 4 describes | |
| Anthropic | Drafting posts, replies and profile text; checking reviews and photos | Profile details, reviews (text and reviewer names), your website text, notes and instructions you type, drafts, photos |
| OpenAI | Checking drafts against your website; finding search phrasings and services | Website text, draft text, photos, business categories and services, public details of competitors |
| LocalSEO Data (a company related to us) | Rank maps, the free name check, search volumes, AI visibility checks | Public business details (name, address, category, coordinates, Google place ID) and searches to check, including search terms from your Google performance data |
| Local Falcon | Rank maps for some accounts | Public business details (name, address, category, coordinates, Google place ID) and searches to check, including search terms from your Google performance data |
| PostHog | Product analytics (section 7) | Usage events and your account and user IDs |
| Bannerbear, Ideogram | Making post images | Post text and image instructions built from your business type, services and location |
| SPP (our order desk, managed accounts only) | Taking and tracking orders | Client and business contact details, order details |
We also use these public services. We send them only what is listed, never names, email addresses, reviews or Google login details, and they handle it under their own terms:
| Service | What for | What they get |
|---|---|---|
| OpenStreetMap Nominatim, US Census Bureau | Turning addresses into map points | Business addresses |
| DuckDuckGo | Website icons | Your website's domain |
| Unsplash, Pexels | Finding stock photos | Photo search words |
| OpenFreeMap, unpkg | Map tiles and map code, loaded by your browser on map pages | Your IP address and the map area shown |
Anthropic and OpenAI, under their API terms, don't use what we send to train their models, and may keep it for a short period to detect abuse. AI visibility checks send your business's public name, category and city, and searches to check (some from the search terms Google reports), through LocalSEO Data to ChatGPT, Gemini, Claude, Perplexity and Google's AI answers, to see what they say about your business. No reviews, photos, other performance data or Google login details are sent. We don't send your Google access tokens to any provider; they are stored encrypted and used only to talk to Google.
We may also share information when the law requires it, or to protect people's safety or our rights. If our business is sold or merged, we'll tell you before your information moves. For Google user data, only the sharing in section 4.3 applies, so it moves to a new owner only with your explicit consent, given before it moves.
9. Agencies and their clients
When an agency uses GBP Tools for its clients, the agency decides how its clients' information is used, and we process it for the agency under our Data Processing Addendum. The Addendum also covers the personal information any business puts into the Service, such as its reviewers' names. The Service emails each agency client a daily notice of changes made to their Google profile, on days with changes. If you are an agency's client, ask your agency about your data first; we'll help them answer. If your details appear in a business's profile, for example as a reviewer, and you ask us about them, we'll pass your request to that business and help it answer.
10. Your rights and choices
You can:
- Get a copy of your data: ask us and we'll send you a copy, including the Google data we stored.
- Correct your details in the app or by asking us.
- Delete your account and data: email us from the account owner's address. Deleting cancels your plan and removes your account data, including stored files such as photos, report PDFs and logos, within 30 days, apart from what the law makes us keep. Copies in our backups are overwritten within 30 days after that. Agencies: removing a client in the app deletes that client's data within 7 days; to delete the whole agency account, ask us.
- Choose your emails: on a self-serve account, stop recurring emails with the unsubscribe link in each one. On an account GMB Gorilla manages, members choose their emails in Settings. Approval and report emails that a business or agency sends to its contacts through GBP Tools carry the sender's name and our postal address, 640 Ellicott St, Buffalo, NY 14203, and contain no advertising. To stop them, ask the business or agency that sends them. Emails needed to run your account (sign-in, billing, approvals you asked for) keep coming while the account exists.
- Turn off automatic features at any time in Settings.
Depending on where you live, including California and other US states and Canada, you may have further rights. Email support@gbptools.com from the address on your account. We'll confirm it's you and answer within 30 days. If we need more time, we'll tell you why within those 30 days, and take no longer than the law allows. We won't treat you differently for using your rights, though some features can't work without the data they need. In Canada you can also contact the Office of the Privacy Commissioner of Canada. If you're in Quebec, our privacy contact (section 1) is our person in charge of protecting personal information, and you can also contact the Commission d'accès à l'information du Québec.
11. Where your data is stored
We and our main providers store and process data in the United States. If you're in Canada, your information may be accessed by courts and authorities in the United States under US law.
12. Security
We protect your data with access controls that keep each account's data separate, encryption in transit, encryption of your Google access at rest, and limits against abuse. Photos used in posts and on your profile are stored at public web addresses that aren't listed anywhere, since Google publishes them anyway. No system is perfectly secure. If we confirm a breach affecting your personal information, we'll tell you without undue delay. Where the law requires it, for example when a breach creates a real risk of significant harm, we'll also tell the authorities.
13. Children
The Service is for businesses and isn't meant for anyone under 18. We don't knowingly collect children's information. If you think a child gave us information, email us and we'll delete it.
14. Changes
We'll post changes here and update the date at the top. For changes that reduce your rights or change how we use your data, we'll email account owners and show a notice in the app at least 30 days before they apply, unless the law makes us change sooner. If we change how we use Google user data, we'll ask for your consent in the app before we use it in the new way.
15. Contact
Pitch + Pivot, LLC, 640 Ellicott St, Buffalo, NY 14203. Email support@gbptools.com. Privacy contact: Garrett Smith, Owner (support@gbptools.com).