Privacy Policy

4. Google User Data

STACKS offers an optional connection to Google Business Profile. This section describes how STACKS accesses, uses, stores, and deletes data obtained through Google APIs. It applies in addition to the rest of this policy, and where it is narrower than another section, this section controls.

STACKS' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4.1 What Google user data we access

When a business connects its Google account, STACKS requests a single scope:

https://www.googleapis.com/auth/business.manage

Through that scope STACKS accesses:

• Google Business Profile account and location identifiers for the profiles the business selects
• Location information on those profiles, such as business name, address or service area, phone number, website, hours, categories, and attributes
• Posts created through STACKS and the status Google returns for them
• The email address and display name of the Google account that granted access, used only to label the connection and to tell the business which account is connected

STACKS never receives or stores your Google account password, and never accesses profiles you have not selected.

4.2 Why we access it

• To publish posts to the Google Business Profile locations the business has selected, on behalf of that business
• To read location information so that details held in STACKS and details shown on the Business Profile can be kept consistent
• To report back to the business whether a post succeeded or failed, so errors can be corrected

We use this data for no other purpose. It is used only for the business that granted consent, and only for the locations that business selects.

4.3 We do not transfer it to third parties

We do not sell, rent, or license Google user data, and we do not share it with data brokers or information resellers. We transfer it only where one of the following applies:

• As necessary to provide or improve the Google Business Profile feature itself, which means to the infrastructure providers that host and transmit the data on our behalf under contract, and only for that purpose
• For security purposes, such as investigating abuse or a suspected security incident
• To comply with applicable law
• As part of a merger, acquisition, or sale of assets, and then only after obtaining the explicit prior consent of the business

4.4 We do not use it for advertising

Google user data is never used for advertising of any kind. That includes personalized advertising, retargeting, interest-based advertising, audience building, lookalike audiences, and advertising measurement. It is never passed to any advertising platform or tag, and it is never combined with the marketing and analytics data described in Section 7.

4.5 We do not allow humans to read it

Google user data is processed by automated systems. No STACKS employee or contractor reads it, except in these limited cases:

• With the explicit consent of the business, for example when it asks us to investigate a specific problem with its connection
• For security purposes, such as investigating abuse or a suspected security incident
• To comply with applicable law
• Where the data has been aggregated and anonymized, and is used for internal operations such as capacity planning

We do not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models.

4.6 How we store and protect it

OAuth access and refresh tokens are encrypted at rest, held separately from application data, never written to logs, and never exposed to the browser or to any client-side code. Access to the systems holding them is restricted to the small number of personnel who need it to operate the feature. Location data is cached only to the extent needed to show the connection and its post history.

4.7 How to revoke access, and what we delete

A business can revoke STACKS' access to its Google account at any time, by any of these routes:

• Disconnecting the Google account from the connection settings in STACKS
• Removing STACKS at myaccount.google.com/permissions, which works whether or not STACKS is open
• Emailing yes@stacks.tech and asking us to disconnect the account and delete the data

On revocation, by any route:

• Stored access and refresh tokens are deleted within 24 hours, and STACKS stops making any call to Google on that account immediately
• Cached Google Business Profile data is deleted within 30 days
• Copies held in encrypted backups are removed on the normal backup rotation, which does not exceed 90 days

Posts that were already published to a Google Business Profile remain on that profile, because they are Google-hosted content owned by the business. They can be edited or removed by the business in Google Business Profile directly.

Deletion also happens without a revocation request when a STACKS account is closed, on the same timetable.

A plain-language description of the connection itself, including the authorization steps and what each permission is used for, is documented at stacks.tech/integrations/google-business-profile.