Privacy Policy

Data we collect

• Account data — name, email, and hashed password for you and teammates you invite.
• Workspace & location data — the business locations, listings, posts, and settings you create or import.
• Google Business Profile data — when you connect Google, we import your locations, reviews (including reviewer display names and text), questions, and performance metrics so you can manage them in Nearwise.
• Usage & security data — IP address, user-agent, and timestamps for sessions, used to secure your account.

Google user data — limited use

Nearwise's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Business Profile data only to provide and improve the features you connect it for (managing listings, reviews, posts, and reporting). We do not sell it, use it for advertising, or transfer it except to sub-processors that provide the service, for legal reasons, or with your consent.

Access tokens

Google OAuth access and refresh tokens are encrypted at rest (AES-256-GCM) with a key that is separate from our session-signing secret. Tokens are only decrypted in memory to make API calls you initiate.

Sub-processors

We share data with a small set of providers strictly to operate the service:

• Cloud hosting & database — to run the application and store your data.
• Resend — to deliver transactional email (verification, password reset, invitations).
• OpenRouter — when you use AI-assist features, the relevant text (for example, a review you ask us to draft a reply to) is sent to generate a draft. We minimize what we send (for example, only a first name) and you can avoid these features if you prefer. Do not use AI-assist on data you are not permitted to process this way.

An up-to-date sub-processor list is available on request.

Retention & your rights

We keep your data while your account is active. You can export your workspace data or delete your account and its data from Settings, or by emailing us. Deleting a workspace removes its locations, reviews, posts, metrics, and connected credentials. Depending on your region (including the EU/UK under GDPR), you may have rights to access, correct, export, or erase your personal data; contact us to exercise them.

Changes

We will post updates here and revise the date above. Material changes will be communicated to workspace owners.