How We Use Google Business Profile Data

What Google data we access

When a business owner connects their Google Business Profile to ReviewFloAI using Google OAuth, we request permission to:

• Read reviews posted to their business profile (reviewer name, star rating, review text, review date)
• Post replies to those reviews — only when the business owner clicks "Approve and Post" for each individual reply

We do not access Gmail, Calendar, Drive, Contacts, or any other Google service. We only request the minimum permissions required for review management.

What we do with that data

• Display reviews in the owner's ReviewFloAI dashboard. So they can see and respond efficiently.
• Generate AI-drafted reply suggestions. Review text is sent to our AI providers (OpenAI and Anthropic) to produce a suggested response. No personally identifying information beyond what the reviewer chose to make public is included.
• Run quality and safety checks on every draft. Before the owner sees a draft, it's checked for tone, missing apologies, banned phrases, and sensitive content (food safety, legal threats, etc.). Drafts that fail quality checks are regenerated automatically.
• Post the owner's approved reply to Google. Only after explicit owner approval for each individual response.
• Learn the owner's voice. Edits the owner makes to drafts are used to improve future draft suggestions for that owner's account only. Voice learning data is never shared across accounts.

What we do NOT do

• We do not filter, gate, suppress, or hide reviews.
• We do not solicit reviews from the business's customers.
• We do not incentivize customers to leave reviews.
• We do not auto-post replies without owner approval. Every reply requires an explicit click.
• We do not sell, rent, or share Google data with third parties for advertising, marketing, or any commercial purpose.
• We do not use Google data to train general-purpose AI models. Review data is used only to serve the specific business owner whose profile it came from.
• We do not access or store any Google data beyond what is required to operate the Service.

Human-in-the-loop by design

ReviewFloAI is built so that no response can be posted to Google without the business owner clicking an approval button. This isn't a policy — it's how the software is architected. Even in future Auto-Pilot tiers, owners explicitly define which categories of reviews can be auto-posted, and sensitive, 1-star, 2-star, and 3-star reviews are always held for manual approval.

Compliance with Google API Services User Data Policy

ReviewFloAI's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We limit use of Google user data to providing or improving user-facing features that are prominent in the requesting application.
• We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger, acquisition, or sale of assets (with user notice).
• We do not use Google user data to serve advertisements.
• We do not allow humans to read Google user data except with the affected user's explicit consent, for security purposes, to comply with applicable law, or when the data is aggregated and used for internal operations in compliance with applicable privacy policies.

Disconnecting and data deletion

Business owners can disconnect their Google Business Profile from ReviewFloAI at any time from their account settings, or by revoking access directly from their Google Account permissions page.

When an owner disconnects or deletes their ReviewFloAI account, we delete all associated Google data within 30 days. Owners may also request immediate deletion by emailing support@reviewflo.ai.

Data security

Google data in transit is encrypted using TLS 1.2 or higher. At rest, it is stored in encrypted databases on Microsoft Azure infrastructure. OAuth tokens are stored separately from review data and are never exposed to client-side code. Access to production data is restricted to authorized personnel for the purposes of providing support, ensuring security, or complying with law.

Questions

If you have questions about how ReviewFloAI handles Google Business Profile data, email us at support@reviewflo.ai.