Trust & Security

GBPly is a product of 3local Ltd, a company registered in England and Wales under company number 16598862. Our registered office is 232 Stamford Street Central, Ashton-Under-Lyne, United Kingdom, OL6 7NQ.

You can verify our company details independently on the UK register: Companies House record for 3local Ltd.

GBPly is an independent product. It is not affiliated with, endorsed by, or certified by Google. Our authoritative website is gbply.net and our published contact address is support@gbply.net.

GBPly connects to your Google Business Profile using Google's official OAuth flow. You sign in with Google directly; we never see, ask for, or store your Google password.

By default, we request only two scopes:

• business.manage — to read and update the Business Profiles you choose to manage: business information, posts, photos, reviews and replies, and performance data.
• userinfo.email — to identify which Google account is connected, so you can safely link and separate multiple accounts.

If you choose to connect your own mailbox so client emails come from your address, that is a separate, optional sign-in you start from Workspace Settings:

• gmail.send — permission to send email on your behalf, used only for the emails you schedule or trigger in GBPly, such as review requests, client reminders and activity summaries. It does not allow reading, searching or deleting anything in your mailbox. The equivalent Microsoft 365 permission (Mail.Send) is used if you connect an Outlook mailbox instead.

This mailbox connection is optional, is not needed for day-to-day use, and can be removed at any time from Workspace Settings.

We do not request access to Google Drive, Google Ads, Search Console, or Google Analytics. You can disconnect a Google account from GBPly at any time, and you can also revoke access from your Google account security settings. When you delete your GBPly account, we revoke the tokens we hold with Google.

Google OAuth access and refresh tokens are encrypted with AES-256-GCM before they are stored, using a key held as a server-side secret that is never exposed to the browser. Tokens are decrypted only inside our server-side functions at the moment an API call to Google is made.

Third-party integration credentials you supply yourself — for example SMS provider keys, email provider credentials, or a text-to-speech API key — are stored the same way, in a dedicated secrets table that is not readable from the browser and is not returned to ordinary workspace members.

All traffic to GBPly and to our backend is served over HTTPS/TLS. Our database and file storage are hosted on Supabase infrastructure, which provides encryption at rest and managed backups.

Data in GBPly is scoped to a workspace. Business profiles, posts, reviews, reports, scans, credits and integration settings all belong to a workspace, and access is enforced in the database itself using row-level security policies — not only in the interface. A member of one workspace cannot read another workspace's data even by calling our API directly.

Within a workspace, members hold roles that determine what they can see and change. Roles are stored separately from user profiles and checked server-side on every request, so permissions cannot be escalated from the browser.

Client portals are separate again: a portal link exposes only the single business profile it was issued for, and only the sections the agency has chosen to enable.

Every GBPly account can enable app-based two-factor authentication (TOTP) using an authenticator app such as Google Authenticator, Authy or 1Password. You will find it under My Account.

Workspace owners can additionally require two-factor authentication for their workspace. When that setting is on, members who have not enrolled are prompted to do so and the requirement is verified server-side before workspace data is returned — so it cannot be bypassed by manipulating the browser.

Export. From My Account you can request a machine-readable (JSON) export of your account data. It is generated by a background job and delivered as a time-limited download link.

Deletion. You can request account deletion yourself from My Account. The request enters a queue and is executed automatically after 30 days, which gives you a window to cancel if it was made in error. On execution we cancel any active subscription, revoke the Google tokens we hold, and delete or irreversibly anonymise your personal data.

Retention. Retention periods, the lawful bases we rely on, and international transfer arrangements are set out in full in our Privacy Policy.

This covers contact details you upload or submit for review request campaigns — customer email addresses and mobile numbers, and the messages sent to them.

• Our role. We process this data on your instructions, only to provide the Service to you. You decide who is contacted and why.
• Storage. Uploaded recipients become scheduled or sent message records attached to the workspace and business profile they were sent from.
• Encryption. TLS in transit; encrypted at rest by our hosting platform.
• Access control. Limited to members of that workspace with a permitting role, enforced by per-workspace authorisation rules at the database level. Two-factor authentication is available and can be enforced workspace-wide.
• No secondary use. Never sold, shared for anyone else's marketing, enriched from other sources, combined with other customers' data, or used to train AI models.
• Delivery subprocessors. The email and SMS providers listed below, acting on our instructions — or your own email/SMS connector if you have configured one.
• Retention. Retained until you request deletion, or until the workspace or account is deleted. No fixed maximum period is applied.
• Deletion triggers. (1) a request to support@gbply.net, which we confirm once completed; (2) removing the business profile from GBPly, which deletes that profile's scheduled and sent review request records and its unsubscribe records; (3) deletion of the workspace or account.

Payments are processed by Paddle acting as merchant of record. Card details are entered on Paddle's own checkout and are never transmitted to or stored by GBPly. We receive only the subscription state and non-sensitive customer details needed to provision your plan.

Our refund window, cancellation process and billing terms are set out in the Terms of Service.

GBPly uses large language models to draft posts, review replies, question-and-answer content and profile recommendations. What is sent to the model is the context needed for that specific task — for example the business name, category, services, the review text being replied to, and your own instructions. AI generation is always initiated by an action you take.

Google-connected business data is not used to train generalised AI models. AI output is a draft: you review and approve it before anything is published to Google.

The main categories of subprocessor we rely on are:

• Supabase — application database, authentication, file storage and server-side functions
• Google — Business Profile APIs and Maps services, for the profiles you connect
• Paddle — payments and billing as merchant of record
• Large language model providers — AI drafting and summarisation
• Email and SMS delivery providers — notifications, reports and review requests

If you need a data processing agreement or a named, dated subprocessor list for your own compliance records, email support@gbply.net and we will provide one.

We operate a published vulnerability disclosure policy with defined scope, response targets and safe-harbour protection for good-faith research. Report issues to support@gbply.net with the subject Security Disclosure.

Full details: the Security Policy, our researcher acknowledgments, and our machine-readable security.txt (RFC 9116).

GBPly does not operate its own data centres. The platforms that store, serve and bill for your data are independently audited, and you can verify each of them on the provider's own public compliance page:

These are the providers' certifications, not certifications of 3local Ltd. The controls we are responsible for in our own application layer — token encryption, workspace isolation, role checks and two-factor authentication — are described in the sections above.

Certification is a point in time; the more useful question is what happens in between. Four things run continuously on GBPly.

Automated platform monitoring. Our platform runs scheduled automated reviews of our application code and of the real error signals coming from live traffic, and raises findings to us for triage and fix. Separate regular security scans cover database access rules, database schema and third-party dependency vulnerabilities. We use this as part of our security monitoring and incident response.

Database access-rule enforcement. Every customer-facing table is protected by row-level access rules evaluated by the database itself, so a query can only ever return rows belonging to the signed-in user's workspace. Internal rate-limit and background-job tables carry no access rules at all by design, which means they are reachable only by trusted server-side code and never by a browser.

Our own audit trail. Sign-in history, changes to staff roles and changes to connected Google Business Profiles are recorded and reviewable, and staff actions taken on a customer account are logged rather than silent.

Abuse and account monitoring. Automated signals flag linked accounts and unusual account behaviour for a human to review. This is monitor-only: no account is restricted or closed automatically on the strength of a signal.