Privacy Policy

Effective date: October 15, 2026

Application: GMB Management CRM · Operator: Digital Bhaiya · Website: https://gmb.thecastledesign.com

1. Who we are

Digital Bhaiya operates GMB Management CRM (the “Service”), a web application that helps businesses manage Google Business Profile locations, posts, reviews, and related tools. This Privacy Policy explains what information we collect, how we use it, how we share it, and the choices you have.

2. Scope

This policy applies to visitors of https://gmb.thecastledesign.com, users who sign in with Google, agency team members, and end customers who interact with optional public review funnel pages hosted by the Service.

3. Information we collect

3.1 Google account sign-in (OAuth)

When you choose “Sign in with Google”, we use Google OAuth 2.0. Depending on the scopes you approve, we may receive and store:

  • Your Google account identifier (subject ID);
  • Name and email address;
  • Profile picture URL (if provided by Google);
  • OAuth access and refresh tokens needed to maintain your session and call Google APIs on your behalf.

We request the following Google OAuth scopes (or subsets required for features you use):

  • openid
  • email
  • profile
  • https://www.googleapis.com/auth/business.manage

3.2 Google Business Profile data

After you authorize Business Profile access, we may access, cache, and store data from Google Business Profile APIs, including for example:

  • Business and location names, addresses, categories, hours, and attributes;
  • Location identifiers used to publish posts or read reviews;
  • Posts you create or schedule through the Service;
  • Reviews, ratings, reviewer display names, review text, and reply status;
  • Media or links attached to posts, when you provide them.

3.3 Data you enter in the Service

  • Client or agency labels, team assignments, subscription selections;
  • Review reply templates, scheduled post content, and configuration settings;
  • Support messages or notes you submit to administrators.

3.4 Review funnel (public pages)

If you enable a review funnel, visitors may submit star ratings and optional written feedback. We store that feedback so the business can respond privately. We do not require funnel visitors to sign in with Google.

3.5 Payment information

Subscriptions may be processed by third-party payment providers (for example Razorpay). We receive payment status and transaction references; we do not store full payment card numbers on our servers.

3.6 Technical and usage data

  • IP address, browser type, device type, and timestamps in server logs;
  • Security and error logs to diagnose failures and prevent abuse;
  • Activity records when administrators enable platform activity logging (e.g. sign-in, client assignment).

4. How we use information

We use the information described above to:

  • Authenticate you and maintain your account session;
  • Connect to Google APIs to sync and manage your Business Profile locations;
  • Publish posts, schedule content, and display reviews in your dashboard;
  • Send review replies you configure, including optional automated or AI-assisted replies when enabled;
  • Operate review funnel pages and deliver feedback to the correct business;
  • Process subscriptions, invoices, and renewal reminders;
  • Provide customer support and enforce our Terms of Service;
  • Improve reliability, security, and performance of the Service.

5. Google user data — limited use

GMB Management CRM’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • We use Google user data and Business Profile data only to provide and improve user-facing features of the Service (dashboard, posting, reviews, funnels) and for security, abuse prevention, and compliance.
  • We do not sell Google user data.
  • We do not use Google user data for advertising, retargeting, or building unrelated user profiles.
  • We do not transfer Google user data to third parties except service providers that process data on our behalf to operate the Service (hosting, email, payments), when required by law, or with your explicit direction (for example publishing a post to Google).
  • Human access to Google user data is limited to personnel who need it to support the Service, and only when necessary.

6. How we share information

We may share information in these situations:

  • With Google: When you use the Service to update Business Profiles, post content, or reply to reviews.
  • With service providers: Hosting, database, email, analytics, or payment processors under confidentiality obligations.
  • With your agency: If you are a client user, administrators of your agency may access data needed to manage your account.
  • Legal: When required by law or to protect rights, safety, and integrity of the Service.

7. Data retention

We retain account and Google-sourced data while your account is active and as needed to provide the Service. OAuth tokens are refreshed or removed when you disconnect Google access or your account is deleted. Logs and backups may be retained for a limited period for security and legal compliance. You may request deletion of personal data (see Section 9).

8. Security

We use reasonable administrative, technical, and organizational measures to protect data, including HTTPS, access controls for staff accounts, and secure storage of credentials. No method of transmission or storage is completely secure.

9. Your choices and rights

  • Revoke Google access: You can remove the Service’s access at any time via your Google Account → Security → Third-party access, or at Google Account permissions.
  • Access, correction, deletion: Contact us to request access to, correction of, or deletion of personal data we hold, subject to legal and operational requirements.
  • Opt out of optional AI replies: Disable AI-assisted features in settings or contact your administrator if enabled on your account.

10. Children

The Service is intended for businesses and is not directed to children under 13. We do not knowingly collect personal information from children.

11. International users

Data may be processed on servers located in jurisdictions where we or our hosting providers operate. By using the Service, you consent to transfer and processing in those locations, subject to applicable law.

12. Contact us

For privacy questions, data requests, or complaints about this policy, contact: digitalbhaiya.in@gmail.com.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised policy at https://gmb.thecastledesign.com/privacy and update the effective date above. Continued use of the Service after changes constitutes acceptance.