Privacy notice

Itemised notice of the personal data GBP Local Ranker processes, the purpose of each use, and how to withdraw consent or raise a grievance under the DPDP Act, 2023.

Last updated: September 27, 2026

1. Notice under the DPDP Act

This notice is given by GBP Local Ranker, doing business as GBP Local Ranker, the Data Fiduciary for the website and software at https://gbplocalranker.com (the "Service"). It stands on its own. You do not need another page to understand what personal data we ask for, why, and how you can say no.

It is written for the Digital Personal Data Protection Act, 2023 (22 of 2023) and the Digital Personal Data Protection Rules, 2025. Personal data means data about an individual who is identifiable. We do not sell personal data.

Read this notice at https://gbplocalranker.com/privacy. Exercise your rights or raise a grievance at https://gbplocalranker.com/data-rights, or email privacy@gbplocalranker.com. Vedvyas Verma, Grievance Officer, answers questions about this processing. Phone: +91 8837396279 (Mon–Sat, 9:00 AM – 6:00 PM IST).

2. Itemised personal data

Information you provide directly

Account details: name, email address, password (stored hashed), company name, and account type (business user).
Billing information: payment method details processed by our payment provider (we do not store full card numbers).
Business profile data: Google Business Profile location names, addresses, phone numbers, categories, hours, photos, and review content you authorize us to sync.
Support communications: messages, attachments, and feedback you send to our support team.
Published content: landing pages, QR designs, and audit reports you create within the platform.

Information collected automatically

Usage data: pages visited, features used, session duration, and interaction events (e.g., QR downloads, audit runs).
Device & browser data: IP address, browser type, operating system, and device identifiers.
Log data: timestamps, error reports, and API request metadata for security and performance monitoring.
Local storage: session tokens, preferences, and cached GMB data stored in your browser for offline access and faster load times.

Information from third parties

Google OAuth: when you connect Google, we receive profile information (name, email, profile photo) and OAuth tokens to access Google Business Profile APIs on your behalf.
Netlify (optional): if you enable one-click publishing, deployment metadata and site URLs may be stored.
Payment processors: transaction confirmations and subscription status.

3. Specified purposes

Each item below is a separate purpose. A consent for one purpose is not a consent for another. Where you voluntarily give data for a purpose and do not tell us otherwise, we may process it for that purpose. Analytics and optional messages need their own clear yes.

Account and Service: name, email, Google profile, and business-profile data you connect, so we can sign you in, sync Google Business Profile, manage reviews, audits, QR codes, reports, and websites you publish.
Security and fraud prevention: device, log, and account data to detect abuse and keep the Service available.
Billing: payment status and invoices so we can charge the plan you choose and handle refunds. Card numbers are handled by the payment provider, not stored by us as full card numbers.
Messages you start: contact, seminar, guide, and checklist forms, only to reply or send the item you asked for.
Optional product updates: only if you tick a separate box for tips or updates. You can withdraw that consent without closing your account.
Analytics: page and feature usage, only if you Accept analytics on the one-time notice. Essential cookies do not depend on that choice.
Legal: records we must keep under tax or other law, and responses to a lawful request.

4. Consent and how to withdraw it

Where we rely on consent, it is free, specific, informed, unconditional, and unambiguous, shown by a clear action such as an unticked checkbox or the “Allow analytics” button. We do not use a pre-ticked box. Continuing to browse is not consent for analytics.

Withdraw consent by emailing privacy@gbplocalranker.com or using https://gbplocalranker.com/data-rights — the same request path as giving a data-rights instruction. Disconnect Google in your account settings or in your Google Account. Withdrawal stops future processing for that purpose. It does not undo processing that was already lawful, and it does not require you to delete data the law tells us to keep.

5. Sharing and Data Processors

We do not sell your personal information. We may share information only in the following circumstances:

Service providers: trusted vendors who assist with hosting, analytics, email delivery, payment processing, and customer support — bound by confidentiality agreements.
Google APIs: data is transmitted to Google when you authorize GMB sync, posting, or profile updates, governed by Google's API Services User Data Policy.
Legal requirements: when required by law, court order, or government request, or to protect our rights, users, or the public.
Business transfers: in connection with a merger, acquisition, or sale of assets, with notice to affected users.
With your consent: when you explicitly authorize sharing (e.g., agency team members accessing client data within your account).

6. Google and third-party API data

GBP Local Ranker uses Google OAuth and Google Business Profile APIs. When you connect your Google account, we request only the scopes necessary to provide our features. Your Google user data is used solely to deliver the Service and is not used for advertising or sold to third parties.

You may revoke our access at any time via your Google Account security settings or by disconnecting Google in Settings → Integrations within the platform. Upon disconnection, we delete stored OAuth tokens within 30 days, though cached business data may remain until you delete your account.

GBP Local Ranker's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Cookies

Essential cookies and local storage keep you signed in, remember a preference you set, and protect the Service. They are not used to build an advertising profile. Analytics cookies load only after you allow them. An affiliate referral cookie may be stored when you open a referral link, so the introducer can be credited if you later create an account — that is the purpose of the link you followed.

On a first visit, Accept turns analytics on and Reject leaves only essential cookies. That question is not shown again. To withdraw an acceptance later, use the data-rights page or email the Grievance Officer. Blocking essential cookies in your browser can stop sign-in.

Essential cookies: required for authentication and core functionality.
Analytics cookies: help us understand how users interact with the platform (e.g., page views, feature adoption).
Preference cookies: store theme, language, and dashboard settings.

8. Retention and erasure

We erase personal data when you withdraw consent or the specified purpose is no longer served, unless the law requires us to keep it. Traffic data and processing logs are kept for at least one year where the Rules require that, then erased unless another law needs a longer period. Specific periods we apply:

Account data: retained until account deletion, plus up to 90 days for backup recovery.
Google OAuth tokens: deleted within 30 days of disconnection.
Audit reports & analytics: retained per your plan limits; you may delete individual reports at any time.
Billing records: retained for 7 years for tax and legal compliance.
Support tickets: retained for 3 years after resolution.

9. Security and personal data breaches

We protect personal data with reasonable security safeguards: encryption in transit, protection of credentials, access control, logs that can show unauthorised access, backups, and contracts that require processors to use reasonable safeguards.

If we become aware of a personal data breach, we will tell each affected person without delay, in plain language, what happened, the likely consequences for them, what we are doing, what they can do, and who to contact. We will also inform the Data Protection Board of India as the Rules require, including a fuller report within 72 hours of becoming aware, unless the Board allows more time.

10. Rights of the Data Principal

You may ask us to access, correct, complete, update, or erase your personal data, to withdraw consent, to nominate another person, and to raise a grievance. The means, and the identifier we need (your account email), are published at https://gbplocalranker.com/data-rights.

Access a summary of your personal data and the processing.
Correction and completion of inaccurate or incomplete data.
Erasure when consent is withdrawn or the purpose is over, subject to legal retention.
Nomination of another individual.
Grievance redressal. We respond within 90 days.
If you are in the EU or UK, you may also have GDPR rights such as portability and restriction. Email the same contact and we will handle the request under the law that applies.

Email privacy@gbplocalranker.com or use the form at https://gbplocalranker.com/data-rights. If our response does not resolve the grievance, you may complain to the Data Protection Board of India after using this process.

11. Children

The Service is for adults. A child is a person under 18. We do not knowingly process a child’s personal data. We do not track or behaviourally monitor children or show them targeted advertising. If we learn that we have personal data of a child without verifiable parental consent, we will delete it. Email the Grievance Officer if you believe this has happened.

12. Transfers outside India

Personal data may be processed in India and in other countries where our processors operate, including where a cloud or email provider hosts data. A transfer outside India is made only as the Act and the Rules allow, and subject to any restriction the Central Government specifies for a foreign State or a person under that State’s control. We do not treat “using the website” as a separate consent to an unrestricted transfer.

13. Changes to this notice

If we change what personal data we process or why, we will update this page and the date above. A material new purpose needs a fresh specific consent. We do not treat continued use of the Service, by itself, as consent for a new purpose.

14. Grievance contact

Vedvyas Verma, Grievance Officer

GBP Local Ranker

176 B, Abhay Khand 1, Nyay Khand I, Indirapuram, Ghaziabad, Uttar Pradesh 201014, India

Email: privacy@gbplocalranker.com

Phone: +91 8837396279 (Mon–Sat, 9:00 AM – 6:00 PM IST)

Rights and grievances: https://gbplocalranker.com/data-rights