Privacy Policy

GReviewPilot is a reputation management platform operated by Brightwave Digital Products LLP, Pune, Maharashtra, India. In this policy, “we” and “us” mean Brightwave Digital Products LLP, and “you” means the business or individual using GReviewPilot.

For data you bring into GReviewPilot about your own customers, you are the data controller and we act as your processor. For your own account and billing data, we are the controller.

• Account details — name, email address, password (stored only as a salted hash), and workspace membership.
• Business details — business name, locations, addresses, phone numbers, opening hours, and categories.
• Content you create — review replies, posts, websites built in the site builder, and uploaded media.
• Support correspondence — messages you send us.

When you connect your Google Business Profile, you grant GReviewPilot access through Google OAuth. We request these scopes and nothing else:

• openid, email, profile — to identify which Google account is connected and show it back to you in the dashboard.
• https://www.googleapis.com/auth/business.manage — to read the Business Profiles you manage and to act on them on your behalf.

Using that access, we read and store:

• Your Google account identity — email address, and the Business Profile account name and identifier.
• Your locations — title, store code, address, phone number, website, categories, and Google Place ID.
• Your reviews — star rating, review text, review timestamp, and the reviewer’s public display name and profile photo URL as published by Google.

We use this data solely to provide the features you asked for: displaying your reviews and locations, drafting and publishing replies, generating analytics, and running review campaigns. We do not use Google user data for advertising, and we do not sell it.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:

• We use Google user data only to provide and improve features that are visible to you inside GReviewPilot.
• We do not transfer or sell Google user data to third parties for advertising, market research, or any unrelated purpose.
• We do not allow humans to read your Google user data, except where you have given us explicit permission (for example, when you ask support to investigate a specific problem), where it is necessary for security or to comply with applicable law, or where the data has been aggregated and de-identified.

To provide sentiment analysis, reply drafting, insights, and website generation, we send relevant content — including review text — to Google’s Generative Language (Gemini) API for processing. We send only what the feature needs, and we do not send your account credentials or OAuth tokens.

AI output is a draft. Replies are not published to Google until you approve them, and you remain responsible for the content you publish.

• OAuth tokens are encrypted at rest using AES-256-GCM with a key held outside the database. They are decrypted only in memory, only when a request to Google needs them, and are never written to logs or returned by our API.
• Transport is encrypted — all traffic to GReviewPilot and to Google runs over HTTPS/TLS.
• Access is scoped per workspace — every query is restricted to your workspace, and team members only see the locations assigned to them.
• Operational logs record which Google endpoints were called and whether they succeeded. They record request metadata, not access tokens or review content, and are deleted on a rolling 14-day window.

No system is perfectly secure. We work to protect your data but cannot guarantee absolute security.

We do not sell your data. We share it only with service providers who process it on our behalf, under contract, and only as needed to run the product:

• Google — Business Profile APIs, Places API, and the Gemini API, as described above.
• Hosting and database infrastructure — to run the application and store your data.
• Email delivery — to send transactional email such as verification, invitations, and password resets.

We may also disclose data where required by law, or to protect our rights, safety, or property.

• Disconnecting Google — use Integrations → Google → Disconnect. We revoke the token with Google immediately and delete the stored connection, including the encrypted access and refresh tokens.
• Revoking from Google’s side — you can remove GReviewPilot at any time from your Google account permissions. Our access stops at once.
• Account deletion — follow our data deletion instructions, or email contact.greviewpilot@gmail.com. We delete your workspace and its data within 30 days, except where we must retain records to comply with law.
• Operational data — API request logs are kept 14 days; synchronisation history is kept 90 days.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict processing, and to withdraw consent. Indian users have rights under the Digital Personal Data Protection Act, 2023. To exercise any of these, contact us at contact.greviewpilot@gmail.com. We respond within 30 days.

GReviewPilot is a business tool and is not directed at children under 18. We do not knowingly collect their personal data.

We will update this page when our practices change and revise the “last updated” date. If a change materially affects how we handle your data, we will notify you by email or in the dashboard before it takes effect.

Brightwave Digital Products LLP
Pune, Maharashtra, India
Email: contact.greviewpilot@gmail.com

See also our Terms & Conditions, Cookie Policy, and Data Deletion instructions.