Privacy Policy

1. Information we collect

Business account holders

• Your email address and password when you create an account. Passwords are handled by our authentication provider and are never stored in plain text.
• Business details you enter, such as business name, category, branches, logo URL, brand theme and the custom questions you ask customers.
• If you connect Google Business Profile, the data described in section 3.

Customers who leave feedback

• The star rating, tags, optional written message and answers to the business’s questions that you choose to submit.
• The review draft generated from your feedback, and whether you chose to continue to Google to post a review.
• A one-way hash of your IP address, used only to prevent spam and abuse. We do not store your IP address itself.

We do not ask customers for their name, email address or phone number. Any review you post on Google is posted by you, from your own Google account, and is governed by Google’s terms.

2. How we use information

• To provide the service: show feedback and analytics to the business, generate review drafts, and display and manage Google reviews.
• To keep accounts secure, including sign-in, multi-factor authentication for administrators, and abuse prevention.
• To provide support and respond to your requests.

We do not sell personal information and we do not use it for advertising.

3. Google user data

If a business owner chooses to connect Google Business Profile, BD Clarity asks Google for permission using the business.manage scope. With that permission, BD Clarity:

• Lists the Business Profile accounts and locations you can manage, so you can choose which location to connect.
• Reads the reviews on the locations you connect, including reviewer display names, ratings, review text and existing replies, so you can see and track them in your dashboard.
• Publishes a reply to a review only when you write or approve that reply and choose to publish it.

The access tokens Google issues are encrypted (AES-256-GCM) before they are stored and are only used on our servers. They are never sent to your browser.

BD Clarity’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is used only to provide the review-management features described above to the business that connected it.
• Google user data is not sold, not used for advertising, and not transferred to anyone except as needed to provide those features, to comply with the law, or as part of a merger or acquisition with notice to you.
• Google user data is not sent to AI models and is not used to train AI or machine-learning models.
• People do not read Google user data unless you ask us to for support, it is needed for security or to comply with the law, or it has been aggregated and anonymised.

You can disconnect a location at any time from Dashboard → Settings → Google, after which BD Clarity stops using that connection. You can also remove BD Clarity’s access entirely from your Google Account permissions.

4. AI-generated review drafts

When a customer leaves feedback, the rating, tags and message they submitted may be sent to Anthropic, our AI provider, to write a natural-sounding review draft. The customer can edit the draft and decides whether to post it. Google user data is never part of this.

5. Service providers

We use these providers to run BD Clarity. They process data only on our behalf:

• Supabase — database and account authentication.
• Cloudflare — website hosting and network security.
• Anthropic — AI review drafts from customer feedback (section 4).
• Google — Business Profile and Places APIs, when a business uses those features.

We may also disclose information if required by law or to protect the rights and safety of our users.

6. Cookies

BD Clarity uses only cookies that are needed for the service to work: keeping you signed in and protecting the Google connection flow against forgery. We do not use analytics or advertising cookies.

7. Security

Data is sent over HTTPS, access to each business’s data is restricted to its owner by database access rules, and Google tokens are encrypted as described above. No system is perfectly secure, but we work to protect your information. Read more on our Security page.

8. Keeping and deleting data

We keep account and business data while your account is active. To delete your account, your business’s data, or the Google data stored for a connected location, email us at the address below and we will delete it, unless we must keep something to comply with the law.

9. Your choices

You can view and update your business details in the dashboard, disconnect Google at any time, and ask us for a copy of your data, a correction, or deletion by contacting us.

10. Children

BD Clarity is intended for businesses and is not directed at children under 13.

11. Changes to this policy

We will post any changes on this page and update the date at the top. If a change materially affects how we use Google user data, we will tell connected businesses before it takes effect.

12. Contact us

Questions or requests about privacy: hello@banaodigital.com.