Privacy policy

Who is responsible for your data

The data controller is:

Because we are established in Sweden, the EU General Data Protection Regulation applies to everything below, wherever you are.

What we collect

When you run a free check. The business you search for, and the public information attached to its Google Business Profile: name, address, categories, hours, photos, review counts and review text. This is public information that we read on your behalf. We keep the result so you can come back to it.

When you ask for a report. Your email address, so we can send it. We do not sell it, and we do not pass it to anyone for their own marketing.

When you connect a Google account. Only if you choose to. We store an access token so we can make the changes you approve. We never see or store your Google password, and you can disconnect at any time.

When you simply visit. Standard server logs and basic, aggregate usage measurement. We do not build advertising profiles and we do not sell traffic data.

Why we are allowed to

For the audit, the report and anything you connect, the legal basis is performance of a contract: you asked us to do a thing and we are doing it. For security logs and aggregate usage, it is legitimate interest in keeping the service working and safe. Where we rely on consent, such as marketing email, you can withdraw it at any time and we will stop.

Who else processes it

We use a small number of providers to run the service. They act on our instructions and only for these purposes:

• Google (Places & Business Profile APIs). Looking up the business you search for, and reading its public profile.
• DataForSEO. Checking where a business ranks on the map for local searches.
• Anthropic. Generating the suggested profile text and review replies.
• Supabase. Database and authentication hosting, in the EU.
• Vercel. Website and application hosting.
• Resend. Sending the emails you ask for, such as an audit report.

Some of these operate outside the EU. Where that happens, transfers rely on the European Commission's standard contractual clauses.

How long we keep it

Audit results are kept while your account is active, so you can compare over time. If you never created an account, a one-off audit is removed after 12 months. Ask us to delete it sooner and we will. Server logs are kept for a short period for security and then dropped.

Your rights

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to stop a particular use, or ask for it in a portable format. Write to privacy@localbuddie.com and we will respond within 30 days. If you think we have handled this badly you can complain to your national data protection authority. In Sweden that is Integritetsskyddsmyndigheten (IMY).

Cookies

We use the cookies needed to keep you signed in and to keep the service secure. We do not use advertising cookies, so there is no consent banner to click past.

Children

This is a tool for businesses. It is not directed at children and we do not knowingly collect their data.

Changes

If we change how any of this works we will update the date at the top of this page, and tell account holders directly when the change is significant.

Contact

Privacy questions: privacy@localbuddie.com. Anything else: get in touch.