01Who we are
Seovale is an online reputation management service available at seovale.com. It is operated by [To be provided: Registered legal name of the company that operates Seovale], registered at [To be provided: Registered office address] under registration number [To be provided: Company / corporate registration number] (“Seovale”, “we”, “us”).
This policy explains what personal data we handle when you visit our website, create an account, connect third-party services such as Google Business Profile, and use the product. It also explains the choices and rights you have.
Two roles, depending on the data
- For your account, billing and usage data, we decide how the data is used, and act as a controller (or “business” / “data fiduciary”, depending on the law that applies).
- For the data you bring into your workspace — reviews, business listings, customer feedback, reports — we process it on your behalf and on your instructions, acting as a processor (or “service provider”). Your organisation remains responsible for having a lawful basis to monitor and respond to that content.
02Information we collect
We collect only what is needed to run the features you use. Specifically:
Account information
Your name, work email address, job title (optional) and workspace membership and role. Your password is handled by our authentication provider, which stores only a one-way cryptographic hash. We never see or store your password in readable form.
Google OAuth information
When you connect a Google service, Google asks you to sign in and approve access on Google's own page. We never ask for, receive or store your Google password. After you approve, Google gives us an access token, a refresh token, the list of permissions (scopes) you granted, and the email address of the Google account used, so you can see which account is connected.
Google Business Profile data
For the Business Profile accounts and locations you are authorized to manage and choose to connect, we retrieve: account and location names, location city and country, and the reviews for those locations. We do not create, edit or delete Business Profile listings.
Reviews and review-related information
For each review: the reviewer's public display name as shown by the platform, the star rating, the review text, the date, and any existing owner reply. We do not store reviewers' profile photos, email addresses or contact details. We also keep replies you write, who in your team sent them and when.
Business and location information
Business name, industry, website, locations, reply tone and signature, alert preferences, competitor names you add, and the configuration of connected platforms.
Scan and report information
When you run a website or reputation scan, we collect publicly available information about the domain or business you enter (for example page content, technical signals and public listing data), the findings produced, and the evidence behind each finding. Reports you generate are stored in your workspace.
Information used for AI processing
When you ask for an AI-drafted reply, analysis or report, the relevant review text, business settings and scan evidence are sent to an AI model provider to produce the result. See AI and automated processing.
Technical, device and log information
IP address, browser type, device information, pages requested and timestamps, as recorded by our hosting and authentication providers for security and reliability. Inside the product we keep an activity log (for example, who published a reply or ran a scan) and an integration log (which service was called, when, and whether it succeeded). These logs record operation names and status codes; they do not record passwords, OAuth tokens or API keys.
Communications
Messages you send us, including privacy and support requests, and our replies.
04How we use information
- To create and secure your account and workspace, and to authenticate you.
- To show your reviews, ratings, alerts, reputation score and reports for the businesses you manage.
- To draft replies, analyses and reports with AI when you ask for them.
- To publish a review reply to a platform — only when you press Publish.
- To prepare review-removal and policy-report cases you choose to pursue.
- To run scans you request and keep the evidence behind each finding.
- To provide support, respond to requests and send service messages.
- To detect, investigate and prevent abuse, fraud and security incidents.
- To manage subscriptions and licences, and to meet legal, tax and accounting obligations.
05Legal bases for processing
Where the GDPR, UK GDPR or a similar law applies, we rely on:
- Contract — to provide the service you signed up for (account, workspace, connected platforms, reports).
- Consent — for connecting Google and other third-party accounts; you give it on the provider's consent screen and can withdraw it at any time by disconnecting.
- Legitimate interests — to keep the service secure, prevent abuse and improve reliability, balanced against your rights. For reviewer data within workspaces, our customers rely on their own legitimate interest in monitoring and responding to public feedback about their business.
- Legal obligation — to keep records required by law and respond to lawful requests.
Under India's Digital Personal Data Protection Act, 2023, we process personal data on the basis of your consent or for legitimate uses permitted by that Act, as applicable.
06How we use data from Google
Seovale's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
What that means in practice
- You choose to connect. Google access starts only when an owner or admin of your workspace clicks Connect and approves it on Google's consent screen. We explain what we will access before sending you there.
- Only the permissions the feature needs. For Google Business Profile we request the
business.managepermission (needed to read reviews and post the replies you write), plus your basic sign-in identity and email address. Other Google services — Search Console, Analytics, Ads, Gmail, YouTube — are requested separately and only if you connect them. - Only your authorized businesses. We access only the Business Profile accounts and locations the connecting Google account is permitted to manage.
- Used only to provide the features you see. Google data is used to show your reviews, calculate your scores, raise alerts, draft replies you review, and build your reports. It is not used for unrelated purposes.
- Never sold, never used for advertising. We do not sell Google user data, transfer it to advertising platforms or data brokers, use it for personalised advertising, or use it to determine creditworthiness.
- Not used to train generalised AI models. Google user data is not used to develop, improve or train generalised or foundation AI or machine-learning models.
- Limited human access. Our staff do not read your Google data unless you ask us to (for example, in a support request), it is necessary for security or to comply with the law, or it has been aggregated and anonymised for internal operations.
- No action without you. We do not post review replies, create or edit listings, or take any other action on your Business Profile automatically. Every reply is published only when a person in your workspace presses Publish.
How tokens are protected
OAuth tokens are stored only on our servers, encrypted with AES-256-GCM, and readable only by server-side code acting for your workspace. They are never sent to your browser, placed in a URL, or written to logs. The sign-in handshake uses a one-time state value and PKCE, and expires after 10 minutes if not completed.
07AI and automated processing
Seovale uses AI models to draft review replies, summarise feedback, classify reviews against platform policies, explain scan findings and write reports. Requests are routed through an AI gateway to model providers who process the content to return the result.
- AI output is assistive. A person in your workspace reviews and decides what to do with every draft, report or recommendation. Nothing is published to a review platform without a person pressing Publish.
- AI output can be wrong or incomplete, and is not legal advice.
- We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Priority labels, sentiment and scores are aids for your team, not decisions about individuals.
- We send only the content needed for the task you requested.
09International data transfers
Seovale is a global service. Your data is hosted in [To be provided: Countries / regions where data is hosted] and our service providers may process it in other countries, including countries whose data-protection laws differ from yours.
Where we transfer personal data out of the EEA, the UK or another jurisdiction that restricts transfers, we rely on an adequacy decision or on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, as applicable. You can ask us for more information about these safeguards.
10Data security
- Encryption in transit (HTTPS) for all traffic, and encryption of OAuth tokens and provider credentials at rest.
- Row-level access controls that keep each workspace's data separate from every other workspace.
- Role checks on sensitive actions — only owners and admins can connect or disconnect Google.
- Secrets kept only on the server; none are included in the website code sent to browsers.
- An activity log of sensitive actions such as publishing replies and changing connections.
No system is completely secure. If we become aware of a personal-data breach that affects you, we will notify you and the relevant authorities where the law requires us to.
11Data retention
| Data | How long |
|---|---|
| Account and workspace data | While your account is active, then deleted on request or when the workspace is closed, except records we must keep by law. |
| Google OAuth tokens | Until you disconnect Google; they are then revoked at Google and deleted from our database immediately. |
| Pending Google sign-in handshakes | Expire after 10 minutes. |
| Google Business Profile content | See Google data retention restrictions. |
| Reviews from other platforms, scans, reports | While the workspace exists, or until you delete them or ask us to. |
| Activity and integration logs | While the workspace exists; removed with it. |
| Billing and tax records | As long as tax and accounting law requires. |
12Google data retention restrictions
Google's Business Profile APIs policies restrict how long Business Profile content may be stored. At the time of writing, they allow storing limited content, securely, for no more than 30 calendar days.
Current status, stated plainly: an automatic process that removes Business Profile content once that period ends is not yet in place. Until it is, synced Google review content stays in your workspace until you ask us to delete it (see Account and data deletion) or the workspace is deleted. You can make that request at any time, whether or not Google is still connected.
When you disconnect Google, access stops immediately and no further Business Profile content is retrieved. Google's policies require that a business can dissociate its Business Profile from services like ours within seven business days; disconnecting in Seovale does this at once.
13Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, export or restrict the use of your personal data, to object to processing, and to withdraw consent at any time (without affecting processing already carried out). You can exercise these rights from Settings → Privacy & data when signed in, or by contacting [To be provided: Privacy contact email address].
We will verify your identity before acting on a request, respond within the time the applicable law requires, and will not discriminate against you for exercising your rights. You may use an authorised agent where the law allows.
EEA and UK (GDPR / UK GDPR)
Rights of access, rectification, erasure, restriction, data portability and objection, including to processing based on legitimate interests. You may lodge a complaint with your local supervisory authority. Our Data Protection Officer: [To be provided: Data Protection Officer name and contact (if one is appointed)]. EU representative: [To be provided: EU representative under GDPR Article 27 (if required)]. UK representative: [To be provided: UK representative under UK GDPR Article 27 (if required)].
California (CCPA / CPRA)
California residents may request to know the categories and specific pieces of personal information we collect, use and disclose; request deletion or correction; and opt out of the sale or sharing of personal information and limit the use of sensitive personal information. The categories we collect are listed in Information we collect and are used for the business purposes in How we use information. In the preceding 12 months we have not sold or shared personal information for cross-context behavioural advertising.
India (DPDP Act, 2023)
Data principals may request a summary of personal data being processed and the processing activities, correction, completion, updating and erasure, nominate another person to exercise these rights in the event of death or incapacity, and use grievance redressal. Grievance contact: [To be provided: India grievance officer / DPDP contact (if required)]. If you are not satisfied with our response, you may approach the Data Protection Board of India.
Everywhere else
We extend the same core rights to all users, subject to applicable law.
14Do not sell or share
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law. Because we do not, there is nothing to opt out of today; if this ever changes we will provide a “Do Not Sell or Share My Personal Information” mechanism and honour Global Privacy Control signals where required.
15Disconnecting Google
You can remove our access to your Google account at any time, in either of two ways:
- In Seovale: Settings → Connected platforms → Disconnect. We revoke the token at Google and delete the stored tokens from our database.
- In your Google account: visit myaccount.google.com/permissions and remove Seovale.
Disconnecting stops all new data retrieval immediately. Review content already synced is handled as described in Google data retention restrictions; to have it removed as well, submit a deletion request.
16Account and data deletion
Signed-in users can request deletion of their account, of Google-derived data, or of the whole workspace from Settings → Privacy & data. Each request receives a reference number and is recorded in your workspace's activity log. You can also email [To be provided: Privacy contact email address] — including if you cannot sign in.
We confirm the request, verify that it comes from someone entitled to make it (for workspace-wide deletion, an owner), and carry it out within the period required by applicable law. Deletion from backups happens as those backups expire. We may keep limited records where the law requires it — for example billing records, or a note that a deletion request was completed.
17If your review appears in Seovale
Businesses use Seovale to monitor and respond to public reviews, so your public display name, rating and review text may be processed on the business's behalf. We do not collect reviewers' contact details or profile photos. If you want to exercise a privacy right over that data, contact the business concerned, or contact us at [To be provided: Privacy contact email address] and we will help route your request.
18Children's privacy
Seovale is a business tool and is not directed at children. You must be at least [To be provided: Minimum age to use the service] (and old enough to enter a binding contract where you live) to use it. We do not knowingly collect personal data from children; if you believe a child has given us personal data, contact [To be provided: Privacy contact email address] and we will delete it.
19Changes to this policy
We will update this policy when our practices or the law change. The “Last updated” date and version at the top show the current version. For material changes we will notify account holders in the product (and by email once email delivery is enabled) before they take effect, and ask for renewed consent where the law requires it.
20Contact us
- Privacy requests: [To be provided: Privacy contact email address], or Settings → Privacy & data when signed in
- General support: [To be provided: General support email address]
- Postal address: [To be provided: Registered legal name of the company that operates Seovale], [To be provided: Registered office address]
- Data Protection Officer: [To be provided: Data Protection Officer name and contact (if one is appointed)]
Read our Terms & Conditions for the rules that govern use of the service.