Privacy Policy

1. Information We Collect

• Account information: name, email address, and password (hashed) for administrators who log in to the Service.
• Business content: pages, services, articles, media, form submissions, and other content that a business enters into the Service to publish on its own website.
• Google Business Profile data: when an administrator connects a Google Business Profile account (see Section 3), we receive OAuth access and refresh tokens, the connected account and location identifiers, and review data (reviewer name, profile photo, star rating, review text, and any business reply) returned by Google's Business Profile APIs.
• Technical data: IP address, browser user agent, and access timestamps, collected automatically for security and diagnostic logging.

2. How We Use Information

• To operate, maintain, and secure the Service and administrator accounts.
• To publish the content a business enters into the Service on that business's own public website.
• To retrieve and display a business's Google reviews on that business's own public website, as configured by that business's administrator.
• To diagnose errors, prevent abuse, and enforce reasonable rate limits.

3. Google User Data

When an administrator chooses to connect a Google Business Profile, the Service requests the https://www.googleapis.com/auth/business.manage OAuth scope solely to read that business's account/location list and its reviews. We do not request or use this access for any other purpose, and we do not sell, rent, or share Google user data with third parties.

• OAuth tokens are stored encrypted and are only ever used server-side to call Google's Business Profile APIs on behalf of the connecting business.
• Review data fetched from Google is stored so it can be displayed on the connected business's own website, and is refreshed periodically to stay current.
• An administrator can revoke this access at any time from within the Service ("Disconnect"), which deletes the stored tokens. Access can also be revoked directly from the Google Account's third-party access settings.
• Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Sharing of Information

We do not sell personal information. We share information only with infrastructure and service providers that operate the Service on our behalf (such as hosting and email delivery), and with Google's APIs strictly as described in Section 3, or as required by law.

5. Data Security

We use reasonable technical and organizational measures to protect information against unauthorized access, alteration, or loss, including encrypted storage of OAuth credentials and access controls on administrator accounts.

6. Data Retention

We retain account and content data for as long as an administrator's account or website is active on the Service. Connected Google OAuth tokens and synced review data are retained until the connection is disconnected or the associated website is removed.

7. Cookies

The administrative dashboard uses a session cookie required to keep administrators signed in. We do not use advertising or cross-site tracking cookies within the dashboard itself.

8. Your Rights

You may request access to, correction of, or deletion of your personal information by contacting us using the details below.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

10. Contact Us

Questions about this Privacy Policy can be sent to privacy@media77.in.