Privacy Policy
Last Updated: October 8, 2026 • Version 1.2
Our Core Privacy Commitment
GMB SaaS (gmb.vickstricks.site) is committed to absolute privacy and tenant security. We do not sell your personal data or your Google Business Profile data to third parties. All Google OAuth refresh tokens are cryptographically encrypted at rest using military-grade AES-256-GCM.
01.Introduction & Service Overview
This Privacy Policy explains how GMB SaaS (“we”, “our”, or “the Platform”), hosted at gmb.vickstricks.site, collects, processes, stores, and protects information when you create an account, connect your Google Business Profile, and use our multi-tenant SaaS tools for location management and review auto-replies.
By accessing or using our services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy.
02.Information We Collect
We collect only the information necessary to provide and secure our software services:
- User full name and email address
- Bcrypt-hashed account password
- Organization workspace name and unique slug
- Role assignment (e.g. Org Member, Org Admin)
- Google Account ID & profile identifier
- Business location name, storefront address, and IDs
- Public customer reviews (reviewer name, stars, review text)
- Owner responses and review reply timestamps
03.How We Use Your Data
Your data is used strictly for the following operational purposes:
04.Google API Services User Data Policy Compliance
GMB SaaS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specific Google OAuth Scope Requested:
https://www.googleapis.com/auth/business.manageThis scope is used solely to view your business profile accounts, read customer reviews, and publish authorized replies to those reviews. We do not request access to personal Gmail, Google Drive, Contacts, or any unrelated Google services.
- We do not transfer or disclose Google user data to untrusted third parties.
- We do not use Google user data for advertising, marketing, or retargeting purposes.
- We do not use customer reviews or profile data to train generalized AI or machine learning models.
05.Security & Cryptographic Standards (AES-256-GCM)
We implement enterprise-grade security protocols to protect sensitive tokens and records:
AES-256-GCM Token Encryption at Rest
Google OAuth refresh tokens are encrypted at rest using Galois/Counter Mode (GCM) with unique Initialization Vectors (IV) and 128-bit authentication tags before being written to our database.
Strict Multi-Tenant Isolation
Every database query enforces organization scoping (orgId). Users from Organization A cannot view, query, or modify locations belonging to Organization B.
Encrypted Transport & JWT Bearer Sessions
All browser communication is enforced over HTTPS (TLS 1.3). API sessions are validated with cryptographically signed JSON Web Tokens (JWT).
06.Data Retention & Revoking Google Access
You maintain complete control over your Google Business Profile connection:
You can click “Disconnect” at any time in your dashboard settings. This immediately erases your encrypted OAuth refresh token from our database and marks the connection as inactive.
You may also revoke GMB SaaS's permissions directly from your Google Account settings at myaccount.google.com/permissions.
07.Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please reach out to our privacy and security team: