Privacy Policy

This policy explains how personal data is handled in connection with BusinessProfileAgent.com (businessprofileagent.com).

We operate several separate online services. This policy applies to the service you are currently using. Where a specific service processes data differently, that difference is described below. Your privacy and the security of your data are important to us: this policy is meant to help you understand how we collect, use and share information in order to operate, improve, develop and protect our services.

1. What data we process, and where it comes from

We process identifiers, location information, commercial information, electronic network activity information, professional information, inferences and other information described below.

Information you provide

If you create an account we process the data needed to provide it: name, e-mail address, authentication data, billing details where a paid plan is involved, and records of how you use the product. You may also give us your name, e-mail address and phone number when you contact us or fill in a form on our websites.

Information you provide when connecting another account

Where a service lets you connect a third-party account (for example a hosting provider, registrar or domain registrar), we collect the identifiers and login information that provider requires — such as a username and password, or a security token. In some cases we also collect a phone number, e-mail address, security questions and answers, or a one-time password (OTP) in order to verify your identity before the connection is made. By providing this information you authorise us to act on your behalf to access, transmit and change data in the connected account. This does not apply to Google accounts. Access to Google Business Profile is granted only through Google's OAuth consent flow — we never request, receive or store your Google password, one-time codes, or security answers.

When you contact us

If you use a contact form or write to us by e-mail, we process the information you provide — typically your name, e-mail address and the content of your message — in order to answer you.

Information we receive from your device

When you visit the website, your browser automatically sends technical data that our hosting provider records in server log files: IP address, date and time of the request, the page requested, referrer URL, browser and operating system version. Depending on the service we may also receive timezone setting and location, device location, hardware model, which features you use and other technical information about the device. This is necessary to deliver the site and to detect and defend against attacks. We also use cookies and similar technologies as described below.

Information we receive from other sources

We may receive identifiers and commercial information about you from partners, service providers and identity verification services, or from the operator of an application through which you reach our services.

Inferences

We may derive inferences from the information we collect — for example your approximate location or the type of business you operate.

Data you ask us to process on your behalf

Where a service analyses websites or data you supply, we process that material solely on your instructions, as a processor. We do not use it for our own purposes. Business customers subject to data protection law can request our Data Processing Agreement, which governs that processing, using the contact details at the end of this policy.

2. How we use your information

We use your information to operate, improve and protect the services we provide, and to develop new ones. The uses described in this section do not apply to Google user data, which is governed exclusively by the "Google account data" section below. Specifically, we use it:

• to operate and maintain our products and services
• to improve, enhance, modify, add to and further develop them
• to personalise your experience and tailor recommendations and offers, including through insights derived from how you use our services
• to market other services, products and experiences, including product recommendations and other non-transactional communications by e-mail, in line with your marketing preferences
• to protect you, our partners, us and others from fraud, malicious activity and other privacy and security concerns
• to provide customer support and answer your enquiries
• to investigate misuse of our services, including unauthorised access and criminal activity
• to comply with our contractual and legal obligations
• for any other purpose we notify to you, with your consent

3. Why we process it, and on what legal basis

Our legitimate interests are operating a secure and functioning website, defending against misuse and attacks, and understanding in aggregate how our services are used.

Where we rely on consent, you may withdraw it at any time with effect for the future. Where we rely on legitimate interest, you may object under Art. 21 GDPR.

4. Cookies and similar technologies

We set only strictly necessary cookies without asking you first. Anything else — analytics, embedded media, marketing — is set only after you consent, and you can change or withdraw that choice at any time through the cookie settings on this site.

5. Reach measurement

We use Plausible Analytics, a cookieless service hosted in the EU. It does not track individuals across sites and does not create user profiles.

6. Service providers

We use external service providers who process personal data on our behalf, under data processing agreements and only on our instructions. They fall into the following categories:

• hosting and content delivery
• database and authentication
• transactional e-mail
• payment processing

This website is hosted by Lovable (application hosting) and Supabase (database), with Cloudflare providing content delivery.

A current list of the specific providers we use is available on request at contact@businessprofileagent.com.

7. How we share your information

The disclosures described in this section do not apply to Google user data, which is governed exclusively by the "Google account data" section below.

Beyond the service providers listed above, we may share your information:

• with the operator of an application you use to reach our services, and as directed by that operator or by you
• with a third-party account you have chosen to connect, in order to establish or maintain that connection
• to enforce a contract with you
• where we believe in good faith that disclosure is needed to comply with applicable law, regulation or legal process, such as a court order or subpoena
• in connection with a change in ownership or control of all or part of our business, such as a merger, acquisition, reorganisation or insolvency
• between and among our current and future parent, affiliate and subsidiary companies and other companies under common control or ownership
• where reasonably appropriate to protect the rights, privacy, safety or property of you, our partners, us and others
• for any other purpose we notify to you, with your consent

We do not sell or rent personal data.

In the preceding 12 months we have disclosed the following categories of personal information for business purposes to the following categories of recipients:

We may collect, use and share information in aggregated, de-identified or anonymised form, which does not identify you personally, for any purpose permitted by applicable law — including developing new services and facilitating research.

8. Transfers outside the EU/EEA and Switzerland

Some of our service providers are established outside the EU/EEA and Switzerland, including in the United States, so information about you may be transferred and stored across international borders. Where the country concerned is not covered by an adequacy decision, the transfer is based on the European Commission's Standard Contractual Clauses, combined with additional safeguards where necessary after assessing the level of protection in that country. You can request details of the safeguards in place, or a copy of the clauses, by writing to contact@businessprofileagent.com.

9. How long we keep it

We keep personal data only as long as it is needed for the purposes it was collected for, as described in this policy, unless a longer retention period is required or permitted by law. In practice:

• server log files are kept only as long as needed for security and troubleshooting, then deleted
• enquiries are kept until the matter is closed
• account data is kept for the duration of the account
• invoices and accounting records are kept for the statutory retention period that applies to us

Even after you stop using one of our services, we may still retain information where the law requires it or where you continue to use another of our services. In that case it is processed only as required by law or in accordance with this policy.

10. Your rights

Under the GDPR — and, where it applies, the Swiss Federal Act on Data Protection — you have the right to:

• access the personal data we hold about you (Art. 15)
• rectification of inaccurate or incomplete data (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability — to receive your data in a structured, commonly used and machine-readable format so you can transfer it to another company where technically feasible (Art. 20)
• object to processing based on legitimate interest (Art. 21)
• withdraw consent at any time, without affecting processing already carried out

If you are a California resident, and subject to the limitations and exceptions in the California Consumer Privacy Act (CCPA), you may also have the right:

• to request more detail about the categories and specific pieces of personal information we have collected about you in the last 12 months, including information disclosed for business purposes
• to request deletion of your personal information
• to opt out of any "sale" of your personal information
• not to be discriminated against for exercising these rights

To exercise any of these rights, write to contact@businessprofileagent.com. We may need additional information to confirm your identity before we can respond. We will respond within one month, or any shorter period required by applicable law. Some information may be exempt from a request — for example where we must keep it to meet our own legal obligations or to establish, exercise or defend legal claims.

You also have the right to lodge a complaint with a data protection supervisory authority. Because our company is registered in Switzerland, the competent authority is the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch). If you are in the EU/EEA, you may also lodge a complaint with the supervisory authority in the country where you live or work (see https://edpb.europa.eu/about-edpb/board/members_en).

11. Is providing data mandatory?

You are not legally obliged to provide personal data. However, some data is necessary to use parts of the service — without an e-mail address we cannot create an account or reply to an enquiry.

12. Automated decision-making

We do not use your personal data for automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

13. Changes to this policy

We update this policy when our services or the law change. The current version is always available on this page, and the date at the top shows when it was last changed.

14. Google account data

When you connect your Google account to Business Profile Agent, we ask for the Google Business Profile management permission (https://www.googleapis.com/auth/business.manage). We use it only to operate the features described in this section. This section takes precedence over any other section of this policy in respect of Google user data.

Access is granted through Google's OAuth consent flow. We never receive, request or store your Google password, and we do not ask for one-time codes or security answers for your Google account.

What we access

• The Google Business Profile accounts and locations that your Google account owns or manages
• Each location's profile information — business name, addresses, phone numbers, website URLs, business hours, categories, attributes, service areas, labels and descriptions
• Your Google account email address, so we can show you which account is connected

How we use it

• To display your locations in the application
• To let you edit those locations centrally, individually or in bulk
• To write changes you approve back to Google Business Profile
• To detect changes made on Google's side and present them to you for review

We do not use Google user data for advertising or personalised recommendations, we do not sell it, and we do not use it to train machine learning models.

How we store it

• Profile data is stored in our database to power the interface and to keep an edit history
• Authorisation tokens are encrypted, stored server-side only, and are never sent to your browser
• Data is hosted by Supabase in the European Union

Who we share it with

We do not share Google user data with third parties, except service providers who process it on our behalf under contract — currently our hosting and database providers. We do not transfer it otherwise, except where required by law.

Retention and deletion

• You can disconnect your Google account at any time in the application. On disconnect we revoke the authorisation with Google and delete the stored tokens.
• You can also revoke access directly at https://myaccount.google.com/permissions
• Profile data we imported is deleted within 30 days of disconnection, or immediately on request
• To request deletion, contact contact@businessprofileagent.com

Limited Use

Business Profile Agent's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

15. Contact

If you have any questions or complaints about this policy, or about our privacy practices generally, the controller responsible for processing your personal data is:

BusinessProfileAgent.com
Steigstrasse 11, 8610 Uster, Switzerland
contact@businessprofileagent.com