1. Introduction
GMB On Top ("we", "our", "us") is a Google Review automation platform that helps local businesses collect genuine 5-star customer reviews via smart QR standees and AI-powered review drafting. This Privacy Policy explains how we collect, use, store, and protect your personal information.
2. Information We Collect
2.1 Business Owner Information
- Business name, category, and Google Maps review URL
- Owner name, email address, and phone number
- Subscription plan, payment method, and billing information
- Staff member names (for performance attribution)
2.2 Customer Interaction Data
- Star ratings submitted via QR scan
- Anonymous feedback messages (private feedback sent to the business)
- Customer name and contact (only when voluntarily provided in private feedback)
- Selected review tags and optional voice notes
2.3 Technical Data
- IP addresses (for rate limiting and fraud prevention only)
- Browser type and device information
- Cookies for session management and affiliate attribution
3. How We Use Your Information
- To provide and improve our review automation services
- To generate AI-drafted review suggestions for customers
- To route negative feedback privately to business owners
- To send transactional emails (welcome, billing, password reset)
- To prevent abuse, fraud, and enforce rate limits
- To track affiliate referral commissions
4. Data Storage & Security
We implement industry-standard security measures including scrypt password hashing with per-user salts, HMAC-SHA256 signed session cookies, timing-safe comparisons, and encrypted HTTPS transmission. Business data is stored on secured servers with regular automated backups.
5. Third-Party Services
We may use the following third-party services:
- Google Gemini API — For AI-powered review draft generation
- Google Analytics — For website usage analytics (when configured)
- Microsoft Clarity — For user experience analytics (when configured)
- SMTP Email Provider — For transactional email delivery
6. Data Retention
We retain business account data for as long as the account is active. Upon account deletion request, all associated data including scan logs, feedback, and business settings will be permanently removed within 30 days.
7. Your Rights
You have the right to:
- Access your personal data stored on our platform
- Request correction of inaccurate information
- Request deletion of your account and all associated data
- Export your business data in a portable format
- Opt out of non-essential communications
8. Cookies
We use essential cookies for session authentication and affiliate referral tracking (30-day attribution window). We do not use advertising or tracking cookies. Third-party analytics cookies are only loaded when explicitly configured by the platform operator.
9. Children's Privacy
Our services are designed for business owners and are not intended for individuals under the age of 18. We do not knowingly collect personal information from minors.
10. Contact Us
For any privacy-related questions or data requests, please contact us via WhatsApp through the floating button on our website, or email us at the address provided on our platform.