Privacy policy

SynGMB is a service of Synectus, operated by Synectus Private Limited, a company in India (CIN U62090GJ2025PTC158996). Our postal address is 315 Radhe Square, Nr. Reliance Circle, Kudasan, Gandhinagar, Gujarat 382421, India. In this policy, "we" means that company. Contact us about privacy at info@synectus.com.

SynGMB is used by agencies and businesses to manage Google Business Profiles. Two roles matter. For the account details of the people who use SynGMB, we decide how the data is used. For the business content an agency puts in SynGMB about its clients (locations, reviews, replies, posts), the agency decides why and how it is used, and we process it on the agency's instructions. If you wrote a review or are a customer of one of those businesses, the business or its agency is the first place to ask about your data. You can also write to us.

SynGMB is not affiliated with or endorsed by Google. "Google" and "Google Business Profile" are trademarks of Google LLC.

• Account details: your name, email address, a password stored only as a salted hash, and your two-factor secret and backup codes (stored so we can check your codes).
• Sign-in and security records: sessions with the IP address and browser details they were opened from, failed sign-in counts, and an audit log of who changed what and when.
• Google connection: the email of the Google account you connect and a refresh token that lets SynGMB act for that account. The token is stored encrypted.
• Google Business Profile data we read or write through Google's APIs: locations and their profile details (name, address, phone, hours, categories, description, attributes, photos), reviews (the reviewer's display name and profile photo link, star rating, text, time), replies, local posts, customer photos, notifications about new reviews, and performance numbers such as views, calls and search terms.
• Content you create in SynGMB: unsent replies and posts, scheduled posts, notes, assignments, templates, reports, rank tracking settings and results, and files you upload.
• Invitations: the email address and role of people you invite. The invitation link is stored only as a hash.
• Devices for alerts: if you turn on alerts on a device, the address and keys your browser gives us for push messages, and the browser name.
• Counters for review request links (how many times a link or QR code was opened, by day and source). We do not record who opened it.
• Error records for monitoring the service. Secrets, email addresses and ids are removed from them before they are stored.

We do not sell personal data. We do not use advertising or analytics trackers.

• To run SynGMB: sign you in, show and edit your Google Business Profiles, and prepare, approve and publish replies and posts.
• To keep it safe: detect abuse, require two-factor sign-in, keep the audit log, and investigate problems.
• To contact you: verification, invitation, password reset and notification emails about your account and work.
• To meet legal duties and to defend or enforce our rights.

SynGMB asks you to connect a Google account. It requests three permissions: openid and your email address (to know which account you connected), and the Business Profile scope (https://www.googleapis.com/auth/business.manage). Nothing else.

What we do with Google user data:

• Access: we read your locations, profile details, reviews, replies, posts, customer photos, notifications and performance numbers.
• Use: only to provide the features you see in SynGMB. We show locations and reviews, show performance numbers, and build reports.
• Actions on your behalf: we publish replies, posts, photos and profile changes to Google only when a person on your team asks for them, or when your account has a setting you turned on that approves or publishes replies to high star ratings automatically. Replies to 1 to 3 star reviews always need a person.
• Storage: we keep a copy in our database so the features work. Refresh tokens are encrypted. See "How long we keep it".
• Sharing: only with the service providers listed below, as needed to run SynGMB. No AI service receives Google user data from us, because SynGMB does not call one.
• Deletion: see "How long we keep it" and "Your choices and rights".

Limited use

SynGMB's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain words:

• We use Google user data only to provide or improve the features of SynGMB that you can see.
• We do not use Google user data for advertising, including retargeting or interest-based ads.
• We do not sell Google user data or give it to data brokers or information resellers.
• We do not use Google user data to judge credit or lending, or to train general AI or machine learning models.
• We do not let people read Google user data except: with your consent for a specific request (for example support work you ask for), where needed for security such as investigating abuse, where needed to comply with law, or when the data is aggregated and anonymised for internal operations.
• We pass Google user data on only to the providers below to run SynGMB, to comply with law, or in a merger or sale with your prior consent.
• If you connect an AI agent to SynGMB through the MCP interface, that is your choice. The agent sees only what your own account can see and acts with the permissions of the token you created. What the agent's provider does with that data is governed by your agreement with them, not by this policy.

You can disconnect a Google account in SynGMB. We then ask Google to revoke our access and delete the stored token. You can also remove SynGMB's access at any time at https://myaccount.google.com/permissions. Removing access at Google stops us reading new data. Data already copied into SynGMB stays until the client is deleted (see below), so ask us or delete the client if you want it removed.

We use these providers to run SynGMB. Each receives only what it needs.

We may also disclose data if the law requires it, or to an acquirer in a merger or sale, with notice to you. Our servers are in Australia and some providers are in the United States, so your data is transferred outside your country. We use providers that are bound to protect data to a comparable standard.

• Account details: while your account exists. We remove them when you ask us to close the account (see Your choices and rights).
• Client data, including Google Business Profile data: while the client exists in SynGMB. We do not delete it on a schedule. It is deleted when an owner deletes the client, or when you ask us to. Deletion is immediate in the live database.
• Performance history: SynGMB fetches up to the last 18 months, which is how far back Google provides it, and keeps it while the client exists.
• Backups: we keep the newest 14 daily database copies on our servers in Australia and copies on Google Drive for 30 days. Data you delete can therefore remain in backups for up to 30 days and is then removed. We do not restore a deleted client from a backup except to recover from a failure of our own systems.
• Audit log: a security record of who did what and when. It is append-only and chained with hashes so that tampering can be detected, which means it is not erased when a client is deleted. It can contain names and the text of changes made in SynGMB. We do not delete it routinely. We delete it if the whole agency account is closed, unless the law requires us to keep it. Erasing a client adds one record of who erased it and when, with row counts only.
• Error records and background job logs: kept for monitoring. They hold no client content.
• Sign-in sessions: they end after 2 hours without activity and after 12 hours in all. The Google refresh token is deleted when you disconnect the Google account.

You can ask to see, correct, export or delete your personal data, and to withdraw consent. We answer within 30 days. You can also complain to your data protection authority.

• Export: an owner or admin can download everything stored for a client in Settings, Privacy and data. It is a JSON file and never includes secrets. It also includes the audit log rows about the client.
• Delete a client: an owner can permanently delete a client and all its data there, in one step. This removes its locations, reviews, replies, posts, profile history, reports, templates and invitations. It does not delete anything on Google (published posts, replies and profile edits stay on Google), people's accounts, the agency's Google connection, or the audit log.
• Close an account, withdraw consent, or anything else: write to info@synectus.com. If you are a reviewer or customer of a business that uses SynGMB, write to us or to that business.

If the Australian Privacy Act applies to us, we handle personal information in line with the Australian Privacy Principles. You can complain to us first and then to the Office of the Australian Information Commissioner (oaic.gov.au). We do not sell personal data and we do not share it for advertising. We try to follow India's Digital Personal Data Protection Act 2023 as its rules come into force.

• Connections to SynGMB use HTTPS.
• Passwords are stored as salted hashes. Two-factor sign-in is required on every sign-in.
• Google refresh tokens, and the key an agency may add for rank tracking, are encrypted with AES-256-GCM.
• Access to each client's data is limited by role and checked on the server.
• Changes are recorded in a tamper-evident audit log. Failed sign-ins are rate limited and accounts lock after repeated failures.
• The database is not open to the public internet, and backups are kept in access-controlled accounts.

No system is perfectly secure. We apply security measures suited to the data we hold, and we do not claim a security certification. If a breach affects your data, we will tell you and the authorities as the law requires.

We set only cookies that SynGMB needs to work or to remember your choices. We set none for advertising or analytics.

• Session cookie: keeps you signed in. It ends after 2 hours without activity and after 12 hours in all.
• A short sign-in cookie while you complete two-factor sign-in.
• syngmb_theme, syngmb_lang, syngmb_density and syngmb_scope: your theme, language, display density and the client you are viewing. They last one year.
• syngmb_invite: remembers your invitation while you create an account. It lasts one hour.

On the rank tracking page, Google Maps may store its own data in your browser when the street map is shown. That is governed by Google's privacy policy.

SynGMB is not designed to hold patient health information. Please do not put patient details in replies, notes or posts. We are not a HIPAA business associate, we do not sign business associate agreements, and we do not claim to meet any health privacy standard. SynGMB has reply checks for healthcare clients and an approval step. They reduce risk. They do not make it safe to enter patient information.

SynGMB is for businesses and is not directed to children under 18. We do not knowingly collect their data. It is intended for businesses in India, the United States and Australia. It is not directed at people in the European Economic Area or the United Kingdom.

Under India's Information Technology Act and its rules, our Grievance Officer handles complaints about how we handle personal data.

• Grievance Officer, Synectus Private Limited
• Email: info@synectus.com
• Postal address: 315 Radhe Square, Nr. Reliance Circle, Kudasan, Gandhinagar, Gujarat 382421, India

We acknowledge a complaint when we receive it and answer within 30 days.

We will update this page when our practices change and show the date at the top. If we want to use Google user data in a new way, we will tell account owners and ask for consent first. For other material changes we will email account owners. Questions: info@synectus.com, Synectus Private Limited, 315 Radhe Square, Nr. Reliance Circle, Kudasan, Gandhinagar, Gujarat 382421, India.