Privacy Policy
Last updated: 5 August 2026
This policy explains what GBP Autopilot collects, why, and what we do with it. It is written to be read, not to be skimmed past.
Who we are
GBP Autopilot is operated by Bansal Minerals, Foundry Nagar, Agra, Uttar Pradesh, India. For any question about this policy or your data, contact bansal181995@gmail.com.
What we collect
- Your Google account identity — name, email address, profile picture and Google account ID, so we can create and secure your account.
- Your Business Profile data — the locations you manage, their public details, your reviews and their replies, your posts and photos, and your performance metrics.
- Information you enter — the services, tone and facts you give us about your business so the agent can write accurately.
- Operational records — a log of every action taken on your profile, so you can audit what was published and when.
How we use Google user data
We request the business.manage permission. We use it solely to provide the features you can see in the product:
- Read your locations, reviews, posts and metrics to display them and to generate relevant content.
- Publish review replies and posts — only ones you approved, or only in the categories you explicitly switched on.
We do not sell your data, use it for advertising, use it to train machine-learning models, or transfer it to third parties except the limited processors described below. GBP Autopilot's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Content generation
To draft replies and posts, the text of the relevant review and the business facts you provided are sent to a large language model provider for processing. Only what is needed to write that specific piece of text is sent. Your Google credentials are never sent. Generated text is stored for your review and is not published until the rules you configured allow it.
How your credentials are protected
- The token that lets us access your profile is encrypted at rest and is never written to logs.
- Short-lived access tokens are held in memory only and never stored.
- All traffic to this service is over HTTPS.
- Your session cookie is signed and marked HttpOnly and Secure.
Retention and deletion
We keep your data for as long as your account is connected. You can revoke our access at any time at myaccount.google.com/permissions, which immediately stops all access.
To have your stored data deleted, email bansal181995@gmail.com. We will delete your account, your stored tokens and all associated business data within 30 days and confirm when it is done.
Who else touches your data
- Google — the source of the Business Profile data.
- Our language model provider — receives review text and business facts to generate copy, as described above.
- Our hosting provider — runs the server this service operates on.
We use no advertising networks and no third-party analytics.
Children
This is a tool for businesses and is not directed at anyone under 18.
Changes
If this policy changes materially, we will update the date above and notify connected accounts by email.