Privacy Policy

Last updated: 20 September 2026

Google Genie ("we", "us") is operated by [Your Company Name]. This policy explains what data we access when a business connects its Google Business Profile ("GBP") to our service, and what we do with it.

What we access

When a business owner or their authorized agency connects a Google Business Profile account through Google's sign-in, we request the business.manage scope, which lets us read and act on:

Business listing details: name, address, phone number, categories, hours
Customer reviews, star ratings, and existing owner replies
Google Business Profile posts
Customer questions and answers (Q&A)
Performance metrics: calls, direction requests, and search/maps impressions

We never access data outside what this scope covers, and never access personal Gmail, Drive, or other Google services.

What we do with it

Display it in a dashboard visible only to the connecting agency's logged-in staff.
Generate text and images with AI: replies, posts, on-image copy, summaries and briefings are written with Anthropic's Claude API, and post images are created with OpenAI's image API from that copy. Only the review/post content and business context needed for that specific reply, post or image is sent, such as the business name, category, recent reviews and posts, never credentials or unrelated account data. Both providers process this solely to return the generated result and do not use API data to train models (per their API terms).
Publish that AI-generated reply or post back to the same Google Business Profile via the Business Profile API, on the schedule and automation settings the connecting agency configured.

We do not sell data, use it for advertising, or share it with any party beyond Google (to operate the listing), Anthropic and OpenAI (to generate text and images).

Retention and revocation

OAuth refresh tokens are stored encrypted at rest and used only to make the API calls described above. Access can be revoked at any time from Google Account → Security → Third-party access, or by asking us to disconnect a location. Revoking access stops all further syncing and automated activity immediately; historical records already generated remain in our database until the connecting agency asks for their deletion.

Security

Refresh tokens are encrypted at rest. Every AI-drafted reply or post is logged — the input given to the AI, the text it generated, and the result of publishing it — before and after each action, so any published content can be traced back to why it was written.

Google API Services User Data Policy

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Contact

Questions about this policy or a data request: contact us