Privacy Policy

WWLocal is operated by WildWeb Digital, Innov8 – Old Fort, Next to Select City Mall, Saket District Centre, New Delhi, India – 110030. You can contact us about privacy at any time at info@wildwebdigital.com or via wildwebdigital.com.

For account and client data, WildWeb Digital is the data controller. For personal data that End Customers submit through a client's review page, the client business is the controller and WildWeb Digital acts as its processor (see section 14).

Account information

Your name, email address and a securely hashed password (we never store your password in readable form). If you sign in with Google, we receive your name, email address and Google account identifier.

Client and business information

Workspace name, timezone, plan and subscription details, team membership and roles, AI reply settings (tone, signature, instructions), target keywords, post content and images you upload, and review page configuration such as logo, brand colour and questions.

Google Business Profile data

When you connect a Google Business Profile, and with your explicit authorisation through Google's OAuth consent screen, we access data from Google's Business Profile APIs, including: the accounts and locations you manage; business information such as name, address, category, phone number, website, opening hours and description; reviews and existing owner replies; local posts; performance insights such as profile views, calls, website clicks, direction requests, messages and bookings; and monthly search keyword impressions.

OAuth tokens

Google issues access and refresh tokens so the Service can act on your behalf. These are stored encrypted on our servers, are only accessible to server-side processes, and are never exposed in your browser.

End Customer submissions

When someone uses a review link, we collect what they choose to enter: typically a first name and answers to the business's questions, a star rating, the review draft text, and any optional private feedback addressed to the business.

Usage and analytics events

Events such as review link scans, form completions, "Copy & Open Google" clicks, and actions taken in the dashboard (for example approving a reply), which we record to provide analytics and an activity log.

Technical data

IP address, browser and device type, and server logs generated when you use the Service, used for security, debugging and abuse prevention.

Cookies and local storage

We use strictly necessary browser storage to keep you signed in and to remember preferences such as your selected workspace. We do not use advertising or cross-site tracking cookies.

We use information only to:

• provide, operate and maintain the Service and your account;
• display your Google Business Profile information, reviews and performance insights in your dashboard;
• generate AI-drafted review replies, post text, keyword suggestions, review summaries and End Customer review drafts;
• schedule and publish replies and posts that you or your configured auto-reply settings authorise;
• send service notifications, such as negative review alerts, approval requests and subscription notices;
• secure the Service, prevent abuse, and enforce our Terms;
• provide support and respond to your requests; and
• comply with legal obligations.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for advertising of any kind.

WWLocal's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• Limited use. Google user data is used only to provide and improve user-facing features of WWLocal that are visible and prominent in the application, such as showing your reviews and insights, drafting and posting replies, and publishing posts.
• No transfer of Google user data to third parties, except as necessary to provide or improve those features (for example to our hosting and AI processing providers acting on our behalf), for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to users.
• No advertising. Google user data is never used or transferred for serving advertisements, including retargeting, personalised or interest-based advertising.
• No AI model training. Google user data is not used to develop, improve or train generalised or non-personalised AI or machine-learning models.
• No human reading of Google user data, except with your affirmative consent for specific messages or records (for example when you ask support to look into an issue), where necessary for security purposes such as investigating abuse, to comply with applicable law, or where data is aggregated and anonymised for internal operations.

Scope requested. WWLocal requests the https://www.googleapis.com/auth/business.manage scope. This allows the Service, on your behalf, to read and manage the Google Business Profile accounts and locations you have access to: viewing business information, reading reviews and posting or updating owner replies, creating and managing local posts, and reading performance and search keyword data. We only use this access to perform the actions described in this policy and that you configure in WWLocal.

To generate drafts, the Service sends relevant text — such as a review's content, rating and reviewer first name, your business name and category, your target keywords and your reply settings, or an End Customer's form answers — to an AI model provider that processes it on our behalf and returns the generated text.

We use AI providers under terms that restrict them to processing data to deliver the service to us, and we configure our use so that submitted content is not used to train their general-purpose models. We send only the information needed for each request and do not send passwords, OAuth tokens or payment information.

AI-generated content can be inaccurate. You remain in control: you can require approval before anything is posted, set delays, edit drafts, or turn AI features off.

We rely on carefully selected providers, bound by contractual confidentiality and data protection obligations, in these categories:

• Cloud hosting and database — to run the application, store data and files, and perform scheduled jobs;
• AI model provider — to generate review replies, posts, summaries and review drafts;
• Email delivery — to send account, invitation, password reset and notification emails.

A current list of named sub-processors is available on request at info@wildwebdigital.com.

• Within your workspace: data in a client workspace is visible to that client's authorised team members according to their role, and to WildWeb Digital super administrators for support and account management.
• With Google: when you or your auto-reply settings publish a reply or post, that content is sent to Google and becomes public on your Business Profile.
• Service providers: as described in section 6.
• Legal requirements: where required by law, regulation, legal process or an enforceable governmental request, or to protect the rights, safety and security of our users, the public or WildWeb Digital.
• Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to this policy, with notice to affected users.

• Account and workspace data is kept while your account or your client's subscription is active, and for up to 30 days after closure to allow data export, after which it is deleted or anonymised unless we must keep it longer by law.
• Google Business Profile data is refreshed regularly while connected. When you remove a profile from WWLocal or close your account, cached Google data for that profile is deleted within 30 days.
• OAuth tokens are deleted as soon as you disconnect the profile or revoke access.
• End Customer submissions and analytics events are kept for as long as the client keeps the review link and workspace, unless the client deletes them sooner.
• Server and security logs are retained for a limited period, typically no longer than 90 days, unless needed to investigate an incident.

You can stop WWLocal from accessing your Google data at any time by removing the profile in WWLocal (Business profiles → Remove), and/or by revoking WWLocal's access in your Google Account at myaccount.google.com/permissions. After revocation, we can no longer read or update your profile, and retained data is deleted as described in section 8.

We protect information with industry-standard measures, including encryption in transit (TLS), encrypted storage of OAuth tokens, strict separation of each client's data enforced at the database level through row-level security, role-based permissions within each workspace, least-privilege access for our staff, and audit logging of key actions. No method of transmission or storage is completely secure, but we work to protect your data and will notify affected users and authorities of a personal data breach where required by law.

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, to withdraw consent, and to complain to a data protection authority. These rights are provided under laws including the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA, Canada's PIPEDA, and India's Digital Personal Data Protection Act, 2023.

To exercise your rights, email info@wildwebdigital.com from the address associated with your account. We will verify your request and respond within 30 days (or sooner where the law requires, such as 45 days under CCPA with a possible extension where permitted). We will not discriminate against you for exercising your rights. If you are an End Customer, please contact the business whose review page you used; we will assist them in responding.

Our service providers may process data in countries other than your own. Where we transfer personal data internationally, we rely on appropriate safeguards such as standard contractual clauses or equivalent mechanisms recognised by applicable law, and require providers to protect the data to the standard described in this policy.

The Service is intended for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children through the dashboard. If you believe a child has provided us information, contact info@wildwebdigital.com and we will delete it.

If you scanned a QR code or opened a review link, the business that created it decides what questions to ask and is the controller of your information; WildWeb Digital processes it on the business's behalf to provide the page. We collect only what you enter (such as your first name, answers, star rating and any optional private note) and basic usage events (for example that the page was opened and the copy button was used).

Your answers are sent to our AI provider to draft review text that you can edit. Nothing is posted to Google by us: you decide whether to copy the text and post it yourself on Google, where Google's own privacy policy applies. Any private note is shared only with the business. To access or delete your information, contact the business directly, or email info@wildwebdigital.com and we will pass your request on.

We may update this policy from time to time. We will post the new version here with a revised "Last updated" date and, for material changes, notify account holders by email or in the app before the changes take effect.

WildWeb Digital, Innov8 – Old Fort, Next to Select City Mall, Saket District Centre, New Delhi, India – 110030
Email: info@wildwebdigital.com
Website: wildwebdigital.com