Security
Security at Locationes
Locationes connects to the Google accounts that already hold your Business Profiles. This page describes what we process, which Google permissions we request, how long data stays, and how to reach us about privacy or security. It is written to be read on its own.
Data we process
We process the data needed to run the product: location names, addresses, categories, hours, profile fields, reviews and replies, report figures, and the account details of the people you invite. We do not ask for Gmail, Drive, Calendar or personal Google account access.
We also process the contact details you submit through this website. Those records are used to answer the enquiry and are not sold or rented.
Google API scopes
| Scope | What it allows | Why we need it |
|---|---|---|
https://www.googleapis.com/auth/business.manage |
Read and write Google Business Profile data for the locations you grant | Import locations, read reviews, publish replies and profile edits, and read performance reports |
We request no other Google API scopes. Access is granted by the Google account owner and can be revoked in the Google account permissions screen at any time. Locationes cannot read a profile that was not granted to it.
Data retention
| Data | Retention |
|---|---|
| Reviews and replies | Kept while the workspace is active; the archive preserves reviews Google later removes |
| Profile data and reports | Kept while the workspace is active and for the export window after cancellation |
| Contact-form leads | Kept for up to 24 months after the last reply, unless you ask us to delete them earlier |
| Application logs | Kept for a short operational window, then deleted or aggregated |
When an account closes, export what you need before the paid period ends. Review history, reports and the deleted-review archive are exportable. Write to [email protected] if you want the account and its data deleted.
Access control
Access is role-based and scoped to the locations a person is allowed to see. A regional manager can be limited to their region; head office can see the group; agency users can be limited to client accounts. Two-step verification is available for accounts that can change live profile data. We recommend enabling it for every administrator.
Target: a quarterly review of who still needs administrator access. This is an operating target, not a certification.
Encryption
Traffic between your browser and Locationes uses HTTPS/TLS. Data stored by our hosting and database providers is encrypted at rest under their platform controls. Application secrets are kept in environment configuration, not in the repository or the browser.
Sub-processors
| Provider | Purpose | Status |
|---|---|---|
| Cloudflare | CDN, WAF and delivery of the marketing site | In use |
| Strapi hosting provider | CMS and lead storage | Published when the contract is signed |
| E-mail provider | Transactional e-mail and contact-form notifications | Published when the contract is signed |
We will publish the final legal names and regions here when the production contracts are signed. We do not claim ISO 27001, SOC 2 or any other certification on this page.
Incident response
If we detect a security incident affecting personal data, we contain it, assess the affected records and notify the people and authorities required by applicable law. Where GDPR applies, our target is to notify the competent supervisory authority within 72 hours of becoming aware of a reportable breach. We will not describe an incident as harmless before the assessment is complete.
Your rights (GDPR and KVKK)
You can ask for access to your personal data, correction of inaccurate records, deletion where we no longer need it, portability of data you provided, and restriction or objection to certain processing. You can withdraw consent for optional communications at any time.
For privacy requests, write to [email protected] from the address associated with the account. We may need to verify that you are authorised to act for the account. If you are in Türkiye, you can also exercise your rights under KVKK through the same address.
What we do not claim
We do not hold an ISO 27001 or SOC 2 certificate, and this page is not a substitute for a security questionnaire or a data processing agreement. Enterprise customers can request the current DPA and a written answer to a security review.
FAQ
Do you have SOC 2 or ISO 27001?
No. We do not claim either certification. We can describe our current controls in writing and will publish certificates here if we obtain them.
Which Google permissions do you request?
Only business.manage, which covers the Business Profile locations you grant. We do not request Gmail, Drive, Calendar or personal account access.
Can we delete our data?
Yes. Export the workspace before the paid period ends, then write to [email protected] to request deletion. Some records may be retained where law requires it, and we will explain that in the response.
Is two-step verification required?
It is available for every account that can change live profile data, and we recommend it for administrators. We do not currently enforce it for read-only users.
Where are sub-processors located?
The final hosting and e-mail providers are being contracted. We will publish their legal names and processing regions here before launch; until then, ask us for the current draft list.