Business Profile Manager Privacy Policy

Last updated: October 28, 2026. This policy is for general information and is not legal advice. Have your counsel review it before you rely on it commercially.

This policy describes how m23n (“we,” “us”; listed on Google Play as M23N) handles information when you use Business Profile Manager (listed as “Business Profile for Google”), our app for iOS (Apple App Store) and Android (Google Play, package com.furkanboran.businessprofileforgoogle) for managing Google Business Profile locations: business information and opening hours, customer reviews and replies, posts, offers and events, photos and performance insights. Business Profile Manager is an independent product and is not affiliated with, endorsed by or sponsored by Google LLC. By using the app you acknowledge the then-current version of this policy. Unless a section says otherwise, it applies to both the iOS and the Android app.

Your data stays yours: Business Profile Manager reads your Business Profile data directly from Google’s Business Profile APIs on your device and shows it to you. We do not operate a server that stores your reviews, posts or business information, and we never sell or share your business data with advertisers. The only exceptions are the post photos and the iOS review-alert registration described in sections 2.4 and 2.9.

You can delete your data at any time from the app (Settings → Delete account & data) or by e-mail. See Delete your Business Profile Manager account & data.

1. Who we are

Business Profile Manager is developed by m23n (M23N). For privacy requests and questions, contact us at support@businessprofile.app.

2. Categories of information

The list below describes categories of information that may be involved depending on which features you use. Not all categories apply to every user; the app also offers a demo mode with sample data that involves none of your Google data. The app has no separate app account or password: the only sign-in is with your Google account.

2.1 Google sign-in & Business Profile data

To show your locations, the app asks you to sign in with Google using OAuth 2.0 and requests the following scopes:

• “See, edit, create and delete your Google Business Profile listings” (https://www.googleapis.com/auth/business.manage) – to read the Business Profile accounts and locations you manage, their business information, reviews, posts, photos and performance reports, and to write the changes you make in the app.
• Basic profile (openid, email, profile) – your name, e-mail address and profile picture, used to label the connected account in the app and to sign in to Firebase for photo hosting (section 2.4).

With your consent the app retrieves from the Google Business Profile APIs: the Business Profile accounts and location groups you can access; each location’s business information (name, address or service area, phone number, website, categories, attributes, regular and special opening hours, description, verification status); customer reviews (the reviewer’s public display name and profile picture, star rating, comment, date and any reply you have posted); your posts, offers and events; photos and logos on the profile; and performance metrics (views, searches, calls, direction requests, website clicks and similar counts). This data is fetched over HTTPS directly from Google to your device, kept in memory and in the app’s local cache, and displayed to you. When you edit business information, reply to or delete a reply on a review, create or delete a post, or upload or delete a photo, the change is written back to your Business Profile through the same APIs and becomes visible on Google Search and Maps as it normally would.

Reviews contain information about your customers. The app processes that information only on your device, only to display reviews to you and to let you reply; it is never copied to any server we operate.

Tokens on iOS: OAuth access and refresh tokens are stored in the iOS Keychain on your device and are never transmitted to us. Tokens on Android: the app uses Google Play services authorization (Google Identity Services); Google Play services issues short-lived access tokens on request and the app does not store OAuth tokens itself. The list of connected accounts (Google account id, e-mail address, name and profile picture URL) is kept in the app’s private storage on the device. On both platforms you can revoke the app’s access at any time from the app’s settings (signing out of a Google account also revokes access with Google) or from your Google Account’s third-party access page.

Limited Use disclosure: Business Profile Manager’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data obtained through these scopes is:

• used only to provide and improve the user-facing features described in this policy (viewing and managing your Business Profile locations, reviews, posts, photos and insights);
• not transferred to third parties, except as necessary to provide those features (for example hosting a post photo so Google can fetch it), to comply with applicable law, or with your explicit consent;
• not used or transferred for serving advertisements, including retargeting, personalised or interest-based advertising;
• not sold, and not provided to data brokers or information resellers;
• not used to determine credit-worthiness or for lending purposes, and not used to build databases or profiles about you or your customers;
• not used to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models. We do not use any Google API, including Google Workspace APIs, for that purpose, and we do not transfer Google user data to third parties for that purpose;
• not read by humans, except with your explicit permission for support, where necessary for security purposes (such as investigating abuse), to comply with applicable law, or where the data has been aggregated and anonymised for internal operations.

2.2 AI-drafted replies

The app can suggest a reply to a review. On iOS, on devices that support Apple’s on-device language models (Apple Foundation Models), the review text, your business name and the tone you choose are processed entirely on your device; on other devices the app uses built-in templates. On Android, suggestions are generated on the device from built-in templates only. On both platforms nothing is sent to us or to any cloud AI service, and a suggested reply is only published to Google when you tap publish; you can edit it first.

2.3 Location photos

If you add a photo to a location from your photo library or camera, the image is compressed on your device and uploaded directly to Google through the Business Profile API as part of your profile. Photos on a Business Profile are public, as Google displays them on Search and Maps.

2.4 Post photos (Firebase)

Google’s Local Posts API only accepts a post image as a public web link. When you attach a photo to a post, the app therefore uploads the compressed image to a Google Cloud Storage bucket operated by us through Google Firebase, under a random file name in a folder tied to your Firebase user id, and passes the public link to Google, which copies the image into your post. These images are publicly readable by anyone who has the link, just as the published post is public. To make sure only you can write to your folder, the app signs in to Firebase Authentication with the same Google account you connected (no separate login screen). Firebase Authentication receives your Google account id, e-mail address, name and profile picture URL from that sign-in and keeps a Firebase user record. Firebase is used for nothing else; the Firebase Analytics SDK is not included.

2.5 Scheduled posts

If you schedule a post for later, its text, settings and any attached image are stored in the app’s private storage on your device until the scheduled time, when the app publishes it to Google (on iOS using Background App Refresh, on Android using WorkManager background work, when the app is not open). Scheduled posts are deleted from the device once published or when you remove them.

2.6 Anonymous identifier

On first launch the app generates a random identifier (a UUID) and stores it on the device (in the iOS Keychain, or in the app’s private storage on Android). It is used as your user id for analytics. It is not derived from your Apple ID, Google account, advertising identifier or hardware serial number. On iOS, because it lives in the Keychain, it may survive reinstalling the app. Deleting your account and data in the app replaces it with a new identifier.

2.7 Analytics

We use Mixpanel to understand how the app is used. It collects app events (for example which screens are opened, whether a reply was published or a purchase completed), coarse device and app information (model, OS version, app version, language, country derived from IP address by Mixpanel) and the anonymous identifier above. Analytics events may include counts and categories (for example how many locations you manage, a review’s star rating or the tone you chose) but never business names, addresses, review text, customer names or any other content from your Business Profile. Analytics data is processed by Mixpanel in the United States. We do not use the advertising identifier (IDFA on iOS, Advertising ID on Android) and do not track you across other companies’ apps or websites.

2.8 Purchases & subscriptions

Business Profile Manager offers auto-renewing subscriptions billed through the Apple App Store (iOS) or Google Play (Android); without a subscription the app shows demo data only. Payments are processed by Apple or Google under their policies; we never receive your payment card details. Subscription status is managed by RevenueCat, which receives the store’s purchase receipt or token, the products you bought, purchase and renewal dates, a random app user id generated by RevenueCat and basic device information (such as platform, OS and app version, and country/currency from the store), so the app can tell which plan is active. RevenueCat does not receive your Google Business Profile data.

2.9 Notifications

If you allow notifications, the app can alert you about new reviews and published scheduled posts.

• iOS: to deliver real-time review alerts, the app turns on review notifications for your Business Profile accounts at Google (Google then informs our backend through Google Cloud Pub/Sub when a new review arrives) and registers your device with our notification relay at gbp.m23n.com. The registration contains your Apple Push Notification service (APNs) device token, your device language and the ids, account ids and names of the locations you manage, and is used only to send you review alerts through Apple’s push service. The registration is removed when you delete your account and data in the app. The app also checks for new reviews on the device with Background App Refresh and may show local notifications.
• Android: there is no push backend. The app checks your locations for new reviews on the device in the background (WorkManager, about once an hour when a network is available) and shows local notifications. No push token or location list is sent to us.

You can turn notifications off in your device’s system settings at any time.

2.10 Support communications

If you contact us by e-mail, we receive the content of your message and the address you use. We use this information only to respond to you.

3. How we use information

• Show your Business Profile accounts, locations, reviews, posts, photos and insights
• Apply the edits, replies, posts and photo changes you make in the app
• Host post photos so Google can attach them to your posts
• Check your locations and notify you about new reviews and scheduled posts
• Validate your subscription
• Measure usage and improve the product
• Comply with law and respond to lawful requests

4. Sharing, transfer & disclosure

Your Business Profile data is exchanged between your device and Google. The parties that process information from the app on our behalf or under their own terms are:

• Google LLC – the Business Profile APIs and OAuth endpoints that the app talks to on your behalf, under your own Google terms; Firebase Authentication and Google Cloud Storage (hosting of post photos, servers in the United States); Google Cloud Pub/Sub for iOS review alerts; and, on Android, Google Play services sign-in and Google Play billing.
• Apple Inc. – on iOS: App Store purchases, push notification delivery (APNs) and on-device AI processing, under Apple’s policies.
• RevenueCat, Inc. – subscription status for App Store and Google Play purchases.
• Mixpanel, Inc. – usage analytics keyed by the anonymous identifier, never containing your Business Profile content.
• Our hosting provider – runs the iOS notification relay ( gbp.m23n.com), which stores only the push registration described in section 2.9.
• Authorities – only where required by applicable law or a valid legal request.

We do not sell your information and do not share it with advertisers, data brokers or any other third party. If m23n is ever involved in a merger or acquisition, Google user data will continue to be handled in accordance with this policy and the Limited Use requirements, and you will be notified before any change takes effect.

5. Retention & deletion

Google user data (Business Profile data and your basic profile) is held on your device, in memory and in the app’s local cache, and is removed when you sign out of the Google account, delete your account and data in the app, or delete the app. Signing out revokes the app’s access at Google (and on iOS deletes the tokens from the Keychain); you can also revoke access from your Google Account’s third-party access page at any time, after which the app can no longer retrieve any data. Scheduled posts live only on your device and are removed when you delete them, your account and data, or the app. Post photos and the Firebase user record are kept while you use the app so that your published posts keep their images; we delete them on request (see below). iOS push registrations are deleted when you delete your account and data in the app, or when the device token stops being valid. Analytics data is retained by Mixpanel according to our project settings (no longer than five years) and is not linked to your name or Google account. Subscription records are kept by Apple, Google and RevenueCat as required for billing, tax and legal purposes.

In the app, Settings → Delete account & data revokes your Google access, signs out of Firebase, resets your RevenueCat and Mixpanel identity and wipes all data stored by the app on the device. To also have your Firebase user record, post photos and analytics history deleted, or to exercise access, correction or deletion rights without the app, contact support@businessprofile.app from the e-mail address of your Google account and quote the anonymous identifier shown in the app’s settings if you can. We respond within 30 days. Full details are on the account deletion page.

6. Security

All traffic between the app and Google, Firebase, RevenueCat, Mixpanel and our notification relay uses HTTPS (TLS). On iOS, OAuth tokens are stored in the iOS Keychain, which is encrypted by the operating system and protected by your device passcode or biometrics, and Google sign-in uses the system web authentication session with PKCE. On Android, sign-in and token handling are performed by Google Play services. The app never sees your Google password. Writes to the post photo bucket are restricted by Firebase security rules to the signed-in owner, image files and a size limit. Because Google user data such as reviews is not copied to any server we operate, there is no server-side database of your reviews or business information to be breached. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Children

Business Profile Manager is a business tool and is not directed to children under 16. Do not use the app in a way that violates applicable child-privacy laws.

8. Changes

We may update this policy as Business Profile Manager evolves. We will post the current version on this page and may provide additional notice for material changes (for example in the app).

9. Related policies

Account deletion: Delete your account & data. This policy also covers this website (businessprofile.app), which does not use cookies or analytics. Terms for this app: Business Profile Manager Terms of Service.