Business Profile Manager Privacy Policy

This policy describes how m23n (“we,” “us”) handles information when you use Business Profile Manager (listed as “Business Profile for Google”), our iOS app for managing Google Business Profile locations: business information and opening hours, customer reviews and replies, posts, offers and events, photos and performance insights. Business Profile Manager is an independent product and is not affiliated with, endorsed by or sponsored by Google LLC. By using the app you acknowledge the then-current version of this policy.

Your data stays yours: Business Profile Manager reads your Business Profile data directly from Google’s Business Profile APIs on your device and shows it to you. We do not operate a server that stores your locations, reviews or posts, and we never sell or share your business data with advertisers.

1. Who we are

For privacy requests and questions, contact us at support@m23n.com.

2. Categories of information

The list below describes categories of information that may be involved depending on which features you use. Not all categories apply to every user; the app also offers a demo mode with sample data that involves none of your Google data.

2.1 Sign in with Apple

You may create your app identity with Sign in with Apple. Apple provides a stable user identifier and, on first sign-in, optionally your name and e-mail address (or a private relay address if you choose “Hide My Email”). These values are stored only in the iOS Keychain on your device and are used to greet you and to keep your settings together. They are not sent to our servers.

2.2 Google account & Business Profile data

To show your locations, the app asks you to sign in with Google using OAuth 2.0 and requests the following scopes:

• “See, edit, create and delete your Google Business Profile listings” (https://www.googleapis.com/auth/business.manage) – to read the Business Profile accounts and locations you manage, their business information, reviews, posts, photos and performance reports, and to write the changes you make in the app.
• Basic profile (openid, email, profile) – your name, e-mail address and profile picture, used only to label the connected account in the app.

With your consent the app retrieves from the Google Business Profile APIs: the Business Profile accounts and location groups you can access; each location’s business information (name, address or service area, phone number, website, categories, attributes, regular and special opening hours, description, verification status); customer reviews (the reviewer’s public display name and profile picture, star rating, comment, date and any reply you have posted); your posts, offers and events; photos and logos on the profile; and performance metrics (views, searches, calls, direction requests, website clicks and similar counts). This data is fetched over HTTPS directly from Google to your device, kept in memory and in the app’s local cache, and displayed to you. When you edit business information, reply to or delete a reply on a review, create or delete a post, or upload or delete a photo, the change is written back to your Business Profile through the same APIs and becomes visible on Google Search and Maps as it normally would.

Reviews contain information about your customers. The app processes that information only on your device, only to display reviews to you and to let you reply; it is never copied to any server we operate.

OAuth access and refresh tokens are stored in the iOS Keychain on your device and are never transmitted to us. You can revoke the app’s access at any time from the app’s settings (signing out of a Google account also revokes the token with Google) or from your Google Account’s third-party access page.

Limited Use disclosure: Business Profile Manager’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data obtained through these scopes is:

• used only to provide and improve the user-facing features described in this policy (viewing and managing your Business Profile locations, reviews, posts, photos and insights);
• not transferred to third parties, except as necessary to provide those features, to comply with applicable law, or with your explicit consent;
• not used or transferred for serving advertisements, including retargeting, personalised or interest-based advertising;
• not sold, and not provided to data brokers or information resellers;
• not used to determine credit-worthiness or for lending purposes, and not used to build databases or profiles about you or your customers;
• not used to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models. We do not use any Google API, including Google Workspace APIs, for that purpose, and we do not transfer Google user data to third parties for that purpose;
• not read by humans, except with your explicit permission for support, where necessary for security purposes (such as investigating abuse), to comply with applicable law, or where the data has been aggregated and anonymised for internal operations.

2.3 AI-drafted replies

The app can suggest a reply to a review. On devices that support Apple’s on-device language models, the review text, your business name and the tone you choose are processed entirely on your device by Apple Intelligence; nothing is sent to us or to any cloud AI service. On other devices the app uses built-in templates. A suggested reply is only published to Google when you tap publish, and you can edit it first.

2.4 Photos you upload

If you add a photo to a location or a post from your photo library or camera, the image is compressed on your device and uploaded directly to Google through the Business Profile API as part of your profile. We never receive or store the image. Photos on a Business Profile are public, as Google displays them on Search and Maps.

2.5 Scheduled posts

If you schedule a post for later, its text, settings and any attached image are stored in the app’s private storage on your device until the scheduled time, when the app publishes it to Google (using Background App Refresh when the app is not open). Scheduled posts are deleted from the device once published or when you remove them.

2.6 Anonymous identifier

On first launch the app generates a random identifier (a UUID) and stores it in the iOS Keychain. It is used as your user id for analytics. It is not derived from your Apple ID, Google account, advertising identifier or hardware serial number. Because it lives in the Keychain, it may survive reinstalling the app.

2.7 Analytics

We use Mixpanel to understand how the app is used. It collects app events (for example which screens are opened, whether a reply was published or a purchase completed), coarse device and app information (model, OS version, app version, language, country derived from IP address by Mixpanel) and the anonymous identifier above. Analytics events may include counts and categories (for example how many locations you manage, a review’s star rating or the tone you chose) but never business names, addresses, review text, customer names or any other content from your Business Profile. Analytics data is processed by Mixpanel in the United States. We do not use the advertising identifier (IDFA) and do not track you across other companies’ apps or websites.

2.8 Purchases & subscriptions

Business Profile Manager offers a free tier and a Pro auto-renewing subscription billed through the Apple App Store. Purchases are processed by Apple under its policies; the app checks your entitlement on the device using Apple’s StoreKit. We do not receive your payment card details, and no purchase information is sent to our servers.

2.9 Notifications

If you allow notifications, the app schedules local notifications on your device, for example when new reviews are found during a background check or when a scheduled post is published. No push token is sent to our servers. You can turn notifications off in iOS Settings at any time.

2.10 Support communications

If you contact us by e-mail, we receive the content of your message and the address you use. We use this information only to respond to you.

3. How we use information

• Show your Business Profile accounts, locations, reviews, posts, photos and insights
• Apply the edits, replies, posts and photo changes you make in the app
• Check your locations in the background and notify you about new reviews and scheduled posts
• Validate your subscription
• Measure usage and improve the product
• Comply with law and respond to lawful requests

4. Sharing, transfer & disclosure

Your Business Profile data is exchanged only between your device and Google; we do not operate a server that receives it. The only parties that process information from the app are:

• Google LLC – the Business Profile APIs and OAuth endpoints that the app talks to on your behalf, under your own Google terms.
• Mixpanel, Inc. – usage analytics keyed by the anonymous identifier, never containing your Business Profile content.
• Apple – Sign in with Apple, App Store purchases and on-device AI processing, under Apple’s policies.
• Authorities – only where required by applicable law or a valid legal request.

We do not sell your information and do not share it with advertisers, data brokers or any other third party. If m23n is ever involved in a merger or acquisition, Google user data will continue to be handled in accordance with this policy and the Limited Use requirements, and you will be notified before any change takes effect.

5. Retention & deletion

Google user data (Business Profile data and your basic profile) is held on your device only, in memory and in the app’s local cache, and is removed when you sign out of the Google account or delete the app. OAuth tokens are deleted from the Keychain and revoked at Google when you sign out; you can also revoke access from your Google Account’s third-party access page at any time, after which the app can no longer retrieve any data. Scheduled posts and Sign in with Apple details live only on your device and are removed when you delete them or the app. Analytics data is retained by Mixpanel according to our project settings and is not linked to your name or Google account. To exercise access, correction or deletion rights for any of the above, contact support@m23n.com and quote the anonymous identifier shown in the app’s settings if asked. We respond within 30 days.

6. Security

All traffic between the app and Google uses HTTPS (TLS). OAuth tokens and identities are stored in the iOS Keychain, which is encrypted by the operating system and protected by your device passcode or biometrics. Google sign-in uses the system web authentication session with PKCE; the app never sees your Google password. Because Google user data is not copied to any server we operate, there is no server-side database of your locations or reviews to be breached. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Children

Business Profile Manager is a business tool and is not directed to children under 16. Do not use the app in a way that violates applicable child-privacy laws.

8. Changes

We may update this policy as Business Profile Manager evolves. We will post the current version on this page and may provide additional notice for material changes (for example in the app).

9. Related policies

Our website and WristChat (Slack) are covered by a separate policy: Privacy Policy (WristChat & m23n.com). Terms for this app: Business Profile Manager Terms of Service.