Privacy Policy

1. Introduction

GMBSync ("we", "our", or "us"), a product by CodeWays, provides a software-as-a-service platform that enables businesses to synchronize, display, and respond to Google Business Profile customer reviews and publish local updates.

We are committed to respecting your privacy and protecting the data of our users and their end customers. This Privacy Policy details the types of information we collect, how it is used and protected, and your rights regarding your data.

2. Google API Services & Limited Use Policy

When you link your Google Account with GMBSync:

• OAuth Access: We request access to view and manage your Google Business Profile locations, reviews, and posts via official Google OAuth 2.0.
• No Credential Storing: We never see or store your Google account password. All access is governed through secure, revocable OAuth tokens.
• Limited Scope: We only access data strictly necessary to synchronize public review comments, star ratings, reviewer names, review timestamps, and publish owner responses you approve.
• Zero Sale of Data: We never sell, lease, or monetize your Google account data or customer review information to data brokers or third parties.

3. Information We Collect

We collect the following categories of information:

• Account & Contact Information: Business email address, business name, and user profile information provided during passwordless OTP sign-in.
• Google Business Profile Metadata: Business location names, Google Place IDs, verified reviews, star ratings, reviewer display names, and owner responses.
• Billing & Payment Information: Payment processing is handled exclusively through Stripe. GMBSync does not store complete credit card numbers or banking credentials.
• Widget & Technical Telemetry: Anonymized HTTP request logs, referrers, and widget render counts on Cloudflare edge servers to monitor performance and uptime.

4. How We Use Your Information

We use collected data solely for the following business purposes:

• To synchronize your Google Business Profile reviews automatically into your private dashboard.
• To generate and serve lightweight, zero-bloat web review widgets on your connected websites.
• To power CodeWays AI Studio review reply suggestions, draft generation, and automated responses based on rules you configure.
• To dispatch transactional system alerts, OTP verification codes, and security notices.
• To ensure the stability, speed, and security of our edge infrastructure.

5. Data Storage, Security & Cloudflare Edge Protection

All application data is hosted on enterprise-grade Cloudflare infrastructure with Cloudflare D1 relational storage. We implement strict security measures including:

• Encryption of all data in transit using TLS 1.3 and HTTPS protocols.
• Encryption of stored database records at rest.
• Tokenized, signed JSON Web Token (JWT) sessions with cryptographic signature validation.
• Zero hardcoded keys and strict automated DDoS and bot mitigation.

6. Data Retention & Account Deletion Rights

You retain complete ownership of your data. You may at any time:

• Revoke Google Access: You can disconnect your Google account inside your GMBSync dashboard or directly through the Google Security Settings page at any time.
• Request Complete Deletion: You can request full purging of your account, synced reviews, widgets, and logs by emailing privacy@gmbsync.com. Account deletions are completed within 48 business hours.

7. Third-Party Service Providers

We partner with trusted third-party providers to deliver our services:

• Google LLC: For Google Business Profile OAuth synchronization and Places API data.
• Cloudflare, Inc.: For DNS, Workers, D1 database storage, edge caching, and security protection.
• Stripe, Inc.: For secure subscription billing and payment processing.

8. Contact Us

If you have any questions about this Privacy Policy or our data handling practices, please contact our Data Protection Team at: