Privacy Policy

What we collect

• Account information: name, email address, and a bcrypt-hashed password for anyone who signs up or is invited to a team.
• Google Business Profile access: when you or your client click “Connect with Google”, you grant access directly through Google's own OAuth consent screen — we never see or store your Google password. We receive an access token and a refresh token, which are encrypted (AES-256-GCM) before being stored, and are used only to read and write the specific Business Profile data (posts, reviews, Q&A, business info, photos, performance insights) that the connected account grants access to.
• Business Profile data itself: we cache a copy of what the API returns (location details, reviews, questions, post history, performance metrics) so the dashboard doesn't need to re-fetch everything on every page load.
• Billing information: if you subscribe to a paid plan, payment is handled entirely by our payment processor (PhonePe) on their own hosted checkout page — we never see or store your card, UPI, or bank details. We store only the subscription status, plan, and payment amount/date for your account.
• Usage/activity log: for agency accounts with multiple staff, we keep a log of who took which action (e.g. “published a post”, “replied to a review”) for accountability within your own team.

Optional AI features

If AI-drafted posts, review replies, or Q&A answers are enabled on your account, relevant business information (business name, address, phone, website, review text, question text) is processed to generate draft content — by default, on our own self-hosted AI model running on our own server, so this data does not leave our infrastructure or get sent to a third-party AI provider. This is used solely to produce suggestions for your review or, if you've enabled autopilot, direct publishing on your behalf. We instruct the AI to only use facts you've provided and never fabricate claims about your business.

How we use your data

Solely to provide the service: authenticating you, connecting to and managing the Google Business Profile(s) you've authorized, generating AI drafts when enabled, processing subscription billing, and showing your team's activity history. We do not sell your data, and we do not use your Business Profile content to train AI models.

Data retention & deletion

We retain your data for as long as your account is active. You can revoke our access to your Google account at any time from your own Google Account permissions page — this immediately invalidates the tokens we hold. To request deletion of your account and all associated data, contact us using the email below.

Cookies

We use a single session cookie to keep you signed in. It's required for the app to function and isn't used for advertising or cross-site tracking.

Contact

Questions about this policy or a data deletion request: support@dhatas.com