Privacy Policy
GBP Optimizer is operated by Matt Lekoutovich. This policy explains what the service collects, what it does with it, and how to get rid of it.
What we collect
- The website URL you enter, and the public page content we fetch from it.
- Public business data about you and nearby competitors, retrieved from the Google Places API.
- Google Business Profile data — only if you choose to connect your Google account. This includes your profile fields (name, categories, description, services, attributes, hours, contact details) and your profile performance and search-keyword reports.
- A Google OAuth refresh token, if you connect your account.
We do not ask for or store payment card details. Payments, when added, are handled by Stripe.
How your Google data is used
Google Business Profile data is used solely to show you the comparison between your current profile and the proposed one, and to write the changes you explicitly approve. It is not used for advertising, not sold, not shared with third parties, and not used to train any machine learning model.
GBP Optimizer's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Where it is stored
- Your Google refresh token is encrypted (AES-GCM) and stored only inside an HttpOnly cookie in your own browser. It is never readable by JavaScript on the page, and we do not keep a copy in a database.
- All Google API calls are made from our server. Your token is never exposed to the browser.
- Website content and profile data are held in memory for the duration of the analysis and are not persisted.
Third parties we send data to
- Anthropic — your website text, your current profile fields, and competitor profile summaries are sent to the Claude API to generate the proposed profile. Anthropic does not train on API inputs.
- Google — Places API and Business Profile API.
- Cloudflare — hosting. Standard request logs.
Revoking access and deleting data
Disconnecting inside the app clears the cookie holding your token and calls Google's revoke endpoint, ending our access immediately. You can also revoke it yourself at myaccount.google.com/permissions. Clearing your browser cookies has the same local effect.
For anything else — including a request to delete data associated with you — email matthew@lekoutovich.com.
Changes
If this policy changes materially, the date above changes with it.