Privacy Policy

This Privacy Policy explains how 3local Ltd collects, uses, stores, and shares personal data when you use GBPly and related services.

3local Ltd is registered in England and Wales under company number 16598862. Our registered office is 232 Stamford Street Central, Ashton-Under-Lyne, United Kingdom, OL6 7NQ. For the purposes of UK data protection law, we are the data controller for the personal data described in this policy except where we act on your instructions as a service provider in relation to your own customer data.

If you have privacy questions, you can contact us at support@gbply.net.

We collect account and identity data such as your name, email address, login details, workspace membership, profile settings, and records of sign-in or security events.

If you connect a Google account or Google Business Profile, we may collect and process connected account identifiers, granted permissions, profile details, locations, business descriptions, categories, opening hours, attributes, posts, reviews, replies, media, performance insights, search keyword data, and related metadata required to provide the Service.

We collect content and operational data you create or upload in the Service, including draft and published posts, images, profile edits, review response drafts, review request campaign data, scheduled emails, scheduled SMS messages, support requests, feature requests, bug reports, and related notes or attachments.

We also collect billing and transaction data such as subscription details, plan information, customer billing identifiers, transaction references, invoices, usage records, SMS credit purchases, and customer portal interactions. Full payment card details are handled by our payment providers rather than stored directly by us.

We collect technical, device, and usage information needed to operate and secure the Service, such as IP address, browser type, approximate device details, session information, page or feature usage, audit trails, API logs, error data, and security-related activity records.

Where you contact support or submit a bug report, we may collect the information you provide about the issue, including page URLs, browser information, screen resolution, screenshots, expected behaviour, and reproduction steps.

We use personal data to create and manage accounts, authenticate users, maintain workspaces, provide connected Google Business Profile features, create and schedule content, generate AI-assisted suggestions, support review management, process support enquiries, and provide the functionality you request.

We use data to process subscriptions, SMS credit purchases, invoices, and customer portal requests; to detect and prevent fraud, misuse, unauthorised access, and abuse; to monitor performance and reliability; to troubleshoot incidents; and to improve the Service and user experience.

We may also use contact and account information to send service messages, transactional emails, security notices, billing notices, workspace invitations, product updates related to your account, and responses to support requests.

We process personal data where necessary for the performance of a contract with you, including creating accounts, providing subscriptions, syncing connected data, managing workspaces, sending operational communications, and delivering paid features.

We process certain data to comply with legal obligations, including accounting, tax, fraud prevention, law enforcement cooperation, and regulatory record-keeping where applicable.

We also process data where necessary for our legitimate interests, including securing the Service, investigating misuse, improving functionality, keeping audit trails, handling support, and defending legal claims, provided those interests are not overridden by your rights and interests.

Where consent is required by law for particular communications or data uses, we will rely on consent and you may withdraw that consent at any time, though this does not affect prior lawful processing.

We share personal data with service providers and subprocessors where necessary to run the Service. These may include Google for account connection and business profile functionality, Paddle for subscriptions, one-off purchases, invoicing and billing support, AI model providers for content and response generation, Resend and Mailgun for email delivery, and Twilio for SMS delivery. Support tickets are handled within our own platform.

Where you consent to optional cookies, our website also uses Google (Google Analytics 4 and Google Tag Manager) for usage analytics and LinkedIn (the LinkedIn Insight Tag) for advertising audiences, retargeting, conversion measurement and aggregate advertising insights. These run only with your consent and are described in section 11.

We may also share data with hosting, infrastructure, analytics, security, legal, and professional advisers where reasonably necessary for service delivery, compliance, protection of rights, or corporate administration.

We do not sell your personal data. We may disclose information where required by law, court order, regulatory request, to enforce our terms, to investigate suspected misuse, or in connection with a business reorganisation, sale, or acquisition.

If you connect Google services, we access and use relevant Google account and Google Business Profile data only to provide the features you enable, such as listing management, profile sync, insights, posts, media, and review-related workflows.

You can disconnect a Google account within the Service or revoke our access through your Google account permissions. Disconnecting or revoking access may stop some features from functioning and may prevent new sync activity.

We do not use data obtained from Google Workspace APIs to develop, improve, or train generalised AI or machine learning models. Any use of Google-connected data is limited to providing and supporting the user-facing functionality of this Service.

Where you use AI-assisted features, relevant prompts, business context, draft content, review text, and related instructions may be processed through our AI providers in order to generate suggestions, summaries, or responses within the Service.

AI outputs can contain mistakes or unsuitable recommendations, so users remain responsible for reviewing all generated output before it is used, published, or sent. We do not treat AI outputs as legal, regulatory, or professional advice.

If you use messaging features, we process recipient contact details, message content, scheduling data, delivery status, transaction or provider identifiers, and related logs in order to send, monitor, and troubleshoot communications.

Support enquiries, feature requests, bug reports, and ticket history may include personal data, business details, attachments, screenshots, and correspondence records so we can respond, investigate, and improve the Service.

This section applies where you upload or submit contact details of your own customers — for example a list of recent customers to invite to leave a Google review by email or SMS. In relation to that data we act as a processor on your instructions: you decide who is contacted and why, and we process the data only to provide the Service to you. If you are an agency, the same applies to contact data belonging to your clients' customers.

How it is stored: uploaded recipient details become scheduled or sent message records (recipient address, message content, scheduling data, delivery status and related logs) attached to the workspace and the business profile you sent them from. Access is limited to members of that workspace with a role that permits it, and to a small number of our staff where required to operate or support the Service.

How it is protected: data is encrypted in transit using TLS and encrypted at rest by our hosting platform. Access is controlled by per-workspace authorisation rules enforced at the database level, and two-factor authentication is available and can be enforced for all members of a workspace.

How it is used: solely to queue, send, deliver and log the review request campaigns you set up, to handle unsubscribes and suppression, and to troubleshoot delivery problems. We do not sell recipient data, share it for anyone else's marketing, enrich or append it from other sources, combine it with the data of other customers, or use it to train AI models. Delivery is carried out by the email and SMS providers named in section 6, acting on our instructions, or by your own email or SMS connector if you have configured one.

Retention and deletion: recipient data is retained until you request its deletion, or until the workspace or account it belongs to is deleted. In addition, if you remove a business profile from GBPly, the scheduled and sent review request records for that profile — including recipient email addresses and phone numbers and the related unsubscribe records — are deleted with it. You can also ask us to delete the recipient data for a specific campaign or profile at any time by emailing support@gbply.net, and we will confirm once it has been done.

We do not currently apply a fixed maximum retention period to this data; it exists only while it is needed to run and account for your campaigns, and is removed on any of the deletion triggers above.

We use cookies and similar technologies, including browser storage and session storage. They fall into three groups: strictly necessary, analytics, and advertising. Only the strictly necessary group is set without asking you. The other two are set only if you allow them in our cookie banner, which appears on your first visit and can be re-opened at any time from the "Cookie preferences" link in the site footer.

Strictly necessary: used to keep users signed in, maintain session security, remember workspace or interface state, support core application functionality such as sign-in and checkout, and help detect misuse or service issues. These are required for the Service to work and are not covered by the banner choices. Scripts needed to deliver a feature you are actively using — for example payments, support, or embedded review widgets — also sit in this group.

Analytics: we use Google Analytics 4, loaded together with Google Tag Manager, to understand aggregate site and product usage. Analytics storage is denied by default and is only enabled if you choose "Analytics only" or "Accept all".

Advertising and marketing: we operate the LinkedIn Insight Tag (LinkedIn Partner ID 9652922), deployed through Google Tag Manager. We use it for website audience building, retargeting of visitors on LinkedIn, conversion measurement for our LinkedIn advertising, and aggregate advertising and engagement insights. It is loaded only after you choose "Accept all", and remains completely blocked before you make a choice, after "Reject all", and after "Analytics only".

When it is active, the LinkedIn Insight Tag may receive technical and usage data including your IP address, a timestamp, browser and device metadata, referrer and page URL, general on-page interaction signals, and LinkedIn cookie identifiers where you are a signed-in LinkedIn member. LinkedIn acts as an independent controller for its own processing of that data; what we receive back is aggregated, de-identified reporting about audiences and campaign performance, not the identities of individual visitors. LinkedIn maintains the authoritative list of the cookies it sets, their purposes and their durations, so we do not reproduce it here: see LinkedIn's cookie table at https://www.linkedin.com/legal/l/cookie-table, its Cookie Policy at https://www.linkedin.com/legal/cookie-policy, and its Privacy Policy at https://www.linkedin.com/legal/privacy-policy.

Legal basis and withdrawal: analytics and advertising technologies are activated on the basis of your consent. You can change or withdraw that consent at any time using "Cookie preferences" in the footer. Withdrawing consent stops these technologies from being loaded again; a script already running in the current page stops on your next page load, and you can clear any cookies already stored through your browser settings.

Only the strictly necessary group is needed to operate the Service. Declining analytics or advertising cookies does not restrict, degrade, or disable any GBPly feature, and we will not treat a refusal as a reason to limit your access.

Some of our providers may process personal data outside the UK. Where this occurs, we take reasonable steps to ensure appropriate safeguards are in place, which may include adequacy regulations, standard contractual clauses, or equivalent lawful transfer mechanisms.

Where you have consented to analytics or advertising cookies, Google and LinkedIn may process the resulting data outside the UK and EEA under their own published transfer mechanisms as independent controllers of that processing.

We retain personal data for as long as reasonably necessary for the purposes set out in this policy, including while your account is active, while we provide the Service, for legitimate business operations, and to meet legal, tax, contractual, fraud prevention, dispute, and record-keeping obligations.

Retention periods vary depending on the type of data, the feature involved, whether the data is needed for support or audit purposes, and whether deletion is requested or required. We may retain limited information after closure where reasonably necessary to comply with law, resolve disputes, enforce agreements, or protect the Service. Retention of contact data you upload for review request campaigns is described in section 10.

Account deletion requests: you can request deletion of your account and personal data from your account settings. Requests are queued and carried out automatically 30 days after submission, giving you time to change your mind — you can cancel the request at any point during that period from the same page. Once the request is executed, your login, profiles, connected Google accounts, workspaces you solely own and their content are deleted, active subscriptions are cancelled, and support history and testimonials are anonymised rather than removed where we need to keep a record. In limited cases we may place a request on hold or decline it where we are legally required to retain data (for example for tax, fraud prevention, or an ongoing dispute); if that happens we will tell you why.

Subject to applicable law, you may have the right to request access to personal data we hold about you, ask for correction of inaccurate data, request deletion, request restriction of processing, object to certain processing, and request portability of data provided by you.

Access and portability: you can request a copy of your data directly in the app from your account settings. We prepare a single machine-readable (JSON) file covering your account details, sign-in history, workspaces, connected Google accounts and business profiles, your posts and review replies, client portals, uploaded media records, subscriptions, payments, credit history and support correspondence. For security the request requires your password, files are download-linked for 7 days and then deleted from our servers, and copies are limited to one every 30 days. Files you uploaded (such as images) are listed in the export and can be downloaded individually from the app; data we mirror from Google, such as your reviews, photos and performance statistics, remains available directly from Google. If you need something the export does not include, contact us and we will provide it.

You can exercise your right to erasure directly in the app from your account settings, or by contacting us. You may also have rights in relation to consent-based processing and to complain if you believe your data protection rights have been infringed. We may need to verify your identity before responding to a request and some rights are subject to legal exceptions.

If you have concerns about how we handle personal data, please contact us at support@gbply.net first so we can try to resolve the issue. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection matters.

We may update this Privacy Policy from time to time to reflect legal, technical, operational, or product changes. We will publish the latest version on this page and the updated version will apply from its stated effective date.