Privacy Policy

Account registration and billing

We process email, name, business name, city, business category, account preferences and support correspondence. Passwords are received for authentication and stored as password hashes. Billing information can include legal name, address, tax details, plan, payment status and invoice records. Payment providers process payment credentials under their own notices.

Google OAuth and Business Profile access

Google sign-in requests basic OpenID, email and profile permissions. Connecting Business Profiles separately requests business.manage, a management-capable permission, not merely read-only access. Neither flow requests Gmail mailbox-reading permission. You choose the account and must have the required owner or manager authority. Google approval, verification, API availability and quotas determine which actions work. Saved authorization alone does not establish successful synchronization.

For a Business Profile connection, Adgrowly receives Google access tokens and, when issued, refresh tokens. These credentials are stored encrypted in the server-side Secret Vault to make authorized Google API requests and renew access while the connection remains enabled. They are separate from the Adgrowly login tokens held in your browser. Disconnection disables local credential use and starts permission revocation as described below.

Google data and its purposes

Authorized features can read Google account and location identifiers, business names, store codes, addresses, coordinates, phone numbers, websites, categories, verification state and profile metadata. Reviews can include reviewer display names, ratings, comments, timestamps and published replies. Posts and media can include text, images, links, publication status and related identifiers.

We use this information to display and maintain profiles, manage reviews, prepare content, carry out authorized publication, show performance and produce reports. Aggregate performance can include Search and Maps views, website clicks, directions and phone-button clicks; a phone-button click is not proof of an answered call. Local rank estimates have measurement limitations and do not guarantee Google placement.

Before accessing additional Google user data or using it for a new purpose beyond the original disclosures, we will explain the change, update the relevant privacy disclosures and obtain the required consent before that access or use begins.

AI-generated responses, posts and images

When AI features are requested or enabled, relevant business data, reviewer names, ratings, review comments and content instructions can be sent to configured AI providers. Supported text providers include OpenAI, Anthropic and Google Gemini, including configured fallbacks. Image-generation adapters support OpenAI, Google Gemini and Replicate. Supported adapters are not a claim that every provider is currently active.

Drafts can be reviewed and edited. If you explicitly enable automatic positive-review replies or scheduled publishing, content can be published within those settings without individual approval of every item. You can disable automation. AI output can be incorrect, unsuitable, biased or infringing and requires appropriate review.

Provider retention, training practices and processing locations depend on actual accounts, settings and agreements. We do not claim universal zero retention or no model training without verified controls. Do not submit unnecessary sensitive information in prompts. Provider-specific processing arrangements require confirmation before general availability.

Media, hosting and other processors

We process uploaded files, image prompts and generated outputs for media and publishing features. Storage adapters support S3-compatible services, Cloudflare R2, Google Cloud Storage and Bunny Storage. Image uploads use quarantine and image validation. Finalized media may have public CDN URLs and become public when published; do not upload confidential material for this workflow. Adapter support does not establish production region, data residency or security certification.

Hosting, storage, transactional email, payment and configured AI providers process data needed for the requested service. Google and enabled social integrations receive authorized actions and published content. Where enabled, opt-in WhatsApp review requests use the platform’s configured Meta provider and recipient information for that purpose. Authorized agency administrators may access their customers’ workspaces according to permissions. Their separate seller or data-controller responsibilities are not replaced by this notice.

Browser storage, analytics and security

Browser storage holds authentication tokens, language and selected-location preferences, saved drafts and temporary authorization-check values. Cookie-free first-party website measurement uses per-page identifiers, IP-derived hashes, public path, referrer hostname, country information, device category and timestamps, honoring supported Do Not Track and Global Privacy Control signals. Hashed identifiers are not necessarily anonymous.

Optional configured Google analytics and advertising tags require the corresponding browser preference. Security, audit and operational logs can contain IP addresses, user agents, account identifiers, actions and diagnostic information. These support service operation, support and abuse prevention. The Cookie Policy explains device controls.

Retention, disconnection and deletion

Retention depends on record purpose, legal duties, service settings and provider requirements. Google disconnect disables local credential use and related automation and requests permission revocation. A failed revocation may require retry or manual removal in Google settings. Disconnect does not automatically erase local business records, reviews, reports, exports or already published content.

Google’s policies restrict temporary caching of API content. The current product does not establish automatic deletion of every Google-derived record, report, export or backup within one universal period. Comprehensive retention controls remain a release-readiness requirement. This notice does not claim that gap is resolved or promise immediate backup erasure.

Request deletion through the contact below. Authority must be verified and the scope assessed, including financial, legal and security retention needs. We explain completed actions, retained categories and operational limitations. Local deletion, integration revocation and removal from Google itself are different actions; see the Data Deletion Policy.

Privacy rights and choices

You can review settings, stop optional tracking, disable automation, disconnect integrations and request access, correction or deletion. Additional rights such as objection, restriction, portability and complaints to a regulator depend on the applicable law and your location. Requests are assessed under those rules; no invented response deadline or waiver of statutory rights is made.

Google policies and independent service

Adgrowly is independent; no Google partnership, certification or endorsement is claimed. Google Business Profile itself is free. Adgrowly fees are for its own software and management features. Google’s terms and data rules continue to apply. The final legal notice and actual data controls must be reviewed together against these requirements.

• Google API Services User Data Policy
• Google Business Profile API policies
• Google: Working with a third party
• Manage Google third-party connections

Contact

For privacy, deletion, billing or service questions, contact Nexadly Technologies Private Limited at nexadly@gmail.com. Do not send passwords, card details or access tokens. Registered address and jurisdiction await company confirmation.

Company website · Contact Adgrowly