The short version: we collect what we need to run your local SEO dashboard, we use your Google Business Profile data only to provide the features you turn on, we never sell your data or use it for advertising, and you can disconnect Google or ask us to delete your data at any time.
1. Who we are and what this covers
NearPinn is a product of WAWCD LLC, 91 Donegall Avenue, Belfast, Northern Ireland, BT12 6LS, United Kingdom (“NearPinn,” “we,” “us,” “our”). We provide a local SEO platform for Google Business Profile (“GBP”) at nearpinn.com and app.nearpinn.com (the “Service”). This Privacy Policy explains what personal information we collect when you visit our website, create a workspace, connect a Google account, and use the dashboard, and how we use, share, and protect it.
For your account, billing, and website-visit data, NearPinn is the controller. For the data inside your workspace that relates to other people — for example your customers' reviews or your teammates' details — you (our customer) decide why it is processed and NearPinn acts as your processor, handling it only to provide the Service to you (see Section 10).
2. Information we collect
Information you give us
- Account details — name, email address, password (stored only as a one-way hash), workspace name, language preference, and two-factor authentication settings. If you sign in with Google, we receive your name, email address, and profile picture from Google.
- Billing details — your plan, subscription status, invoices, and billing contact. Card details are entered directly into Stripe's secure form; we never see or store full card numbers.
- Workspace content — business listings and their details, posts and images, review replies, AI agent settings (tone, language, instructions), automations, keywords, service areas, competitor lists, report recipients, and anything else you create or upload.
- Team and client information — names and email addresses of people you invite to your workspace.
- Communications — messages you send to support, questions you ask the in-app AI assistant, and feedback you share.
- Affiliate details — if you join our affiliate program, your referral code and the information needed to calculate and pay commissions.
Information we receive from Google when you connect a profile
When you connect a Google account, we receive the GBP accounts and locations you manage and their business information (name, address, phone, hours, categories, attributes, photos), posts, customer reviews (including reviewer display names and review text), and performance metrics (searches, views, calls, direction requests, website clicks, and search keywords). Section 3 explains exactly how we handle Google user data.
Information we collect from public and third-party sources
- Local search results — public business listings and ranking positions from Google Maps / Places for the keywords and locations you track, including competitor businesses that appear in those results.
- SEO data — public backlink data for websites you analyze, and page speed / technical audit results for websites you submit.
Information collected automatically
- Activity logs — actions taken in your workspace (for example “post published” or “member invited”), with the time, IP address, and browser user agent. We use these for security, troubleshooting, and the activity history shown to workspace admins.
- Technical data — server logs such as IP address, request time, and error details, which our hosting infrastructure records automatically.
We do not use third-party analytics, advertising pixels, or tracking cookies on the dashboard.
3. How we handle Google user data
We request only the Google OAuth permissions needed for the features we provide:
| Permission | Why we need it |
|---|---|
Basic profile and emailuserinfo.email, userinfo.profile | Sign you in with Google and identify which Google account is connected. |
Manage your business listingsbusiness.manage (and its legacy alias plus.business.manage) | Read and update your GBP locations, publish and manage posts, read reviews and publish replies, and read performance insights — only for the locations you choose to manage in NearPinn. |
- NearPinn's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- We use Google user data only to provide and improve the user-facing features of NearPinn that you use. We do not sell it, use it for advertising, or use it to build user profiles for any unrelated purpose.
- We do not use Google user data to train general-purpose AI or machine-learning models, and our AI providers are not permitted to train on it (see Section 5).
- Humans at NearPinn do not read your Google data unless you ask us to (for example, for support), it is needed for security or abuse investigations, or the law requires it.
- Google access and refresh tokens are encrypted at rest with AES-256-GCM.
- You can disconnect a Google account at any time in the dashboard, which deletes the stored tokens, or revoke access from your Google Account permissions page.
Rank-grid and keyword features use the Google Maps Platform. By using them you also agree to the Google Maps / Google Earth Additional Terms of Service and the Google Privacy Policy.
4. How we use your information
| Purpose | Legal basis (EU / UK) |
|---|---|
| Provide the Service: sync listings, publish posts, reply to reviews, run rank grids, keyword, backlink and website audits, and generate reports | Performance of our contract with you |
| Run the automations and AI agents you set up (scheduled posts, automatic review replies) | Performance of contract |
| Create accounts, authenticate you, and manage workspaces and invitations | Performance of contract |
| Process subscriptions, trials, credit purchases, and affiliate commissions | Performance of contract; legal obligation (tax and accounting) |
| Send service emails: verification and sign-in codes, invitations, trial reminders, payment notices, post and reply notifications, monthly reports | Performance of contract |
| Keep the Service secure, prevent fraud and abuse, and debug problems | Legitimate interests |
| Improve and develop features, using aggregated or de-identified data | Legitimate interests |
| Send product news or offers (you can unsubscribe at any time) | Consent or legitimate interests, as local law requires |
| Comply with law, respond to lawful requests, and enforce our Terms | Legal obligation; legitimate interests |
5. AI features
NearPinn uses third-party AI models to write post copy, generate post images, draft review replies, detect review language, and answer questions in the in-app assistant. When you use these features, we send the AI provider only what is needed for the task — for example the review text and reviewer display name, your business name and category, and your AI agent's tone and instructions.
- Text features use Anthropic (Claude). Image generation uses Google (Gemini).
- We use these providers through their commercial APIs, under terms that do not allow them to use your inputs or outputs to train their models.
- AI output is generated automatically and may be inaccurate. You choose whether drafts are reviewed before publishing or published automatically by an automation.
- Your in-app assistant conversation history is stored in your own browser, not on our servers.
8. How long we keep information
- Account and workspace data — for as long as your account or workspace is active, and then deleted within 30 days of a verified deletion request.
- Google tokens — until you disconnect the Google account or your workspace is deleted.
- Content you delete — posts, listings, automations, scans, and other items you delete in the dashboard are removed from our active systems. Copies in backups are overwritten in the normal backup cycle.
- One-time codes — sign-in and verification codes expire after 10 minutes and are purged automatically.
- Billing records — kept as long as tax and accounting laws require, even after an account is deleted.
- Activity and security logs — kept while your workspace is active so you have a complete audit history, and deleted along with the workspace.
9. Security
- All traffic to NearPinn is encrypted in transit with HTTPS/TLS.
- Passwords are hashed with bcrypt and are never stored in plain text.
- Google OAuth tokens and uploaded images are encrypted at rest with AES-256-GCM.
- Database row-level security keeps each workspace's data isolated from other workspaces.
- Optional two-factor authentication (authenticator app or email code), with lockouts after repeated failed attempts.
- Sign-in tokens are revoked on logout, and production access is limited to authorized staff.
No system is perfectly secure. If we become aware of a breach that affects your personal information, we will notify you and the relevant authorities as required by law.
10. Your customers' and teammates' data
Reviews, reviewer names, and other information about your customers come from your Google Business Profile, and team member details come from you. You are responsible for having a lawful basis to process this information through NearPinn and for giving any notices your local law requires. We process it only to provide the Service to you. If a reviewer or teammate contacts us about their data, we will refer them to you and help you respond.
11. International data transfers
We are based in the United Kingdom, and our providers may process information in other countries, including the United States. When personal information leaves the UK or the European Economic Area, we rely on recognised safeguards, such as UK adequacy regulations (including the UK–US Data Bridge), the UK International Data Transfer Agreement or Addendum, and the European Commission's Standard Contractual Clauses.
12. Your rights and choices
Depending on where you live (including under the GDPR, UK GDPR, and US state privacy laws such as the CCPA/CPRA), you may have the right to:
- access the personal information we hold about you and receive a copy of it;
- correct inaccurate information;
- delete your information;
- restrict or object to certain processing, including direct marketing;
- receive your data in a portable format; and
- withdraw consent where we rely on it.
You can update most account details in the dashboard settings, disconnect Google at any time, and unsubscribe from marketing emails with the link in each email. To make any other request, including deleting your account or workspace or exporting your data, email [email protected] with “Privacy request” in the subject line. We will verify your identity and respond within one month. We will not discriminate against you for exercising your rights.
If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or to the data-protection authority where you live or work.
13. Children
NearPinn is a business tool and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.
14. Changes to this policy
We may update this Policy as the Service changes. We will update the “Last updated” date above and, for material changes, notify workspace owners by email or in the dashboard at least 14 days before the changes take effect.
15. Contact us
The controller of your personal information is WAWCD LLC, 91 Donegall Avenue, Belfast, Northern Ireland, BT12 6LS, United Kingdom.
For privacy questions, data requests, or general support, email [email protected].
See also our Terms of Service.