Privacy Policy

1. Data Controller

1.1. Identity of the data controller

1.2. Data Protection Officer (DPO)

2. Personal Data Collected

2.1. Website browsing

• IP address, browser type and version, operating system
• Pages visited, visit duration, date and time of connection
• Referrer URL, approximate geolocation (country, region)
• Technical, analytical and personalisation cookies (see section 11)

2.2. Account creation

• Surname, first name (or legal name), professional email address, telephone, postal address, job title
• Company name, business sector, number of locations, addresses of locations

2.3. Use of the platform

• GMB data: name, address, category, opening hours, telephone, website, photos, customer reviews, replies, performance statistics
• Generated content: AI-generated review replies, retouched photos, scheduled publications, reports, collection campaigns
• Usage data: connection logs, actions performed, preferences, frequency of use
• Imported contacts: name, email, telephone of recipients of SMS/Email/WhatsApp campaigns
• OAuth tokens: access tokens for third-party platforms, stored encrypted (AES/Fernet), never accessible in plain text

2.4. Billing and payment

Banking details are collected at sign-up and processed exclusively by Stripe (PCI-DSS Level 1 certified), which runs a zero-amount authorization to check the payment method. We never store your full banking data. We retain only the last 4 digits of the card, the expiry date and the card type.

2.5. Unified messaging (Messenger, Instagram, WhatsApp Business)

GMB Club allows its customers to manage, through a unified interface, conversations received via Facebook Messenger, Instagram Direct Messages and WhatsApp Business. In this capacity, GMB Club acts as a technical intermediary between the Meta platforms and its business customers, who remain responsible for data processing vis-à-vis their own end customers.

When an end user writes to one of our customers through these channels, we process:

• The textual content of the messages exchanged (incoming and outgoing)
• Attachments sent (photos, videos, audio, documents, GPS location)
• The public name, profile picture and account identifier on the Meta platform
• Conversation metadata (timestamps, read statuses, reply window)

Messages are processed to enable our customers to reply, to generate suggested replies via artificial intelligence (Mistral AI), and to automatically qualify the type of request (information, quote, complaint, customer service).

2.6. WordPress integration (GMB Club Connect plugin)

When a user installs the GMB Club Connect plugin on their WordPress site, we receive and store:

• The WordPress site URL and its name
• The WordPress user identifier used as the author of published articles
• Categories, tags and the list of authors of the WordPress blog (periodic synchronisation to enable selection during article creation)
• The license key generated by GMB Club, or — for the manual method — a WordPress application password (encrypted at rest, never exposed to the browser)

No WordPress data is shared with third parties outside the technical sub-processors listed in section 4.2 (hosting, OpenAI/Anthropic for article generation).

2.7. Wix integration (direct OAuth connection)

When a user connects their Wix site to GMB Club via OAuth (Settings > Website connection), we receive and store:

• The unique Wix instance identifier (instance_id, generated by Wix)
• The Wix site URL and its name
• The Wix Member identifier used as the author of published articles
• Categories, tags and the list of members of the Wix blog (periodic synchronisation to enable selection during article creation)
• OAuth Client Credentials access tokens issued by Wix (encrypted at rest, never exposed to the browser)

No Wix data is shared with third parties outside the technical sub-processors listed in section 4.2 (hosting, OpenAI/Anthropic for article generation).

2.8. Built-in live support chat

GMB Club offers its authenticated users a built-in live support chat, available only after signing in. This is a proprietary system. Replies are written and sent by a member of the GMB Club team. To help them, an AI (Mistral AI, hosted in the EU) may suggest a draft based on the conversation; nothing is sent without human approval.

When you open a conversation with our support, we process:

• Your Firebase identifier, email address and display name (already collected for authentication)
• The textual content of messages exchanged with our team
• The technical context at the moment of the exchange: active sphere and bubble, subscription plan, URL of the page where the chat was opened, browser user-agent, interface language
• If you enable support notifications (Web Push): the notification endpoint issued by your operating system (Apple, Google or Mozilla), an opaque identifier, and the encryption keys required to deliver messages

This data is used to answer your support requests, monitor service quality (response time) and keep a contextual history to make follow-up conversations smoother. It is not used for marketing and is not shared with any third party, except Mistral AI, as a processor, for the draft suggestions described above. You may permanently delete your conversation at any time from the chat widget (« Delete » button at the bottom of the window).

2.9. AI Assistant ("AI Agent")

GMB Club offers a conversational assistant ("AI Agent") that the user addresses in plain language, by keyboard or by voice. At the user's request, the assistant can read their account data (reviews, posts, statistics, articles, SEO, contacts) and perform actions, always after explicit confirmation for any sensitive action. Conversation history is kept for 30 days.

Voice messages (dictation): when the user dictates a request to the AI Agent, the audio recording is transmitted to Mistral AI for transcription, then is not kept — only the transcribed text is.

3. Purposes and Legal Bases for Processing

4. Data Recipients

4.1. Authorised personnel

Your data is accessible internally only to team members strictly authorised in the context of their duties (support, billing, development).

4.2. Sub-processors and technical providers

4.3. Legal authorities

We may transmit data to the competent authorities in the event of a judicial request or legal obligation.

5. Access to Google APIs (Google Business Profile, YouTube)

GMB Club accesses certain data from your Google account, only with your explicit authorisation via OAuth, in order to provide the features you enable: managing your Google Business Profile listings, and publishing videos and Shorts to your YouTube channel on your behalf (scope youtube.upload).

GMB Club's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We only use this data for the user-visible features you have enabled, we do not sell it and we do not transfer it to third parties for advertising purposes.

You can revoke this access at any time from within the application (by disconnecting the relevant network) or from your Google account security settings.

6. Data Transfers Outside the European Union

Several sub-processors are located outside the European Union (United States, Singapore). These transfers are framed by:

• Standard Contractual Clauses (SCC) approved by the European Commission
• Data Privacy Framework (DPF) for certified providers
• PCI-DSS Level 1 certification for Stripe

You may obtain a copy of the safeguards in place by contacting our DPO: [email protected]

7. Data Retention Periods

8. Data Security

Technical measures

• Encryption: SSL/TLS for all communications (HTTPS), AES/Fernet encryption of OAuth tokens, encryption of backups
• Authentication: Firebase Auth, SHA256-hashed API keys, 2FA available, principle of least privilege
• Infrastructure: firewall, intrusion detection, automated backups, regular updates, API rate limiting, partitioning per Bulle (business location)
• Payments: no banking data stored on our servers — Stripe PCI-DSS Level 1
• Live support chat: access restricted to a whitelist of agents (3 Firebase identifiers); push VAPID private key stored on disk in mode 600; inbound email webhooks signed with HMAC SHA-256; outgoing emails sent from inbound.gmb-club.com via a self-hosted Postfix server on our VPS; Web Push messages end-to-end encrypted, never readable in clear by transit services (APNs, FCM, Mozilla Push)

Organisational measures

• Mandatory confidentiality and security clauses with all sub-processors
• Procedure for notifying the CNIL within 72 hours in the event of a data breach
• Direct notification of the persons concerned in the event of high risk

9. Your Rights Over Your Personal Data

In accordance with the GDPR, you have the following rights:

10. How to Exercise Your Rights

• By email: [email protected]
• By telephone: +33 6 49 37 62 72
• By post: ABDELMOUMEN ADAM — DPO, 879 Chemin de la Grotte des Fées, 83400 Hyères

Please attach a copy of a valid identity document. Response within 1 month maximum (extendable by 2 months in case of complexity). The exercise of your rights is free of charge.

11. Right to Lodge a Complaint with the CNIL

If you consider that the processing of your data constitutes a breach of the GDPR, you have the right to lodge a complaint with the CNIL.

12. Cookies and Trackers

A cookie is a small text file placed on your device when visiting a website. It enables recognition of your browser and the storage of certain information.

What happens depends on where you are. In the European Union, the EEA, the United Kingdom and Switzerland, a banner is presented on your first visit and no tracker subject to consent is placed before you make your choice; refusing is as easy as accepting, both options appear on the same screen. Elsewhere, including the United States, analytics and advertising tools may run by default and you can opt out at any time; we honor the Global Privacy Control (GPC) browser signal as an opt-out of advertising cookies (see section 16 for California).

Your choice is stored on the gmb-club.com domain and applies to both the website and the app.gmb-club.com application: you only need to answer once.

Manage your preferences

The "Your Privacy Choices" link at the bottom of every page reopens the preferences panel at any time. You can grant or withdraw each purpose separately; withdrawal takes effect immediately.

You can also act from your browser:

• Chrome: chrome://settings/cookies
• Firefox: about:preferences#privacy
• Safari: Preferences → Privacy
• Edge: edge://settings/privacy

Your consent is retained for 13 months maximum, after which the banner will be presented to you again.

13. Minors' Data

Our service is not intended for persons under 18 years of age. We do not knowingly collect personal data relating to minors. If you are a parent or legal guardian and believe that your child has provided us with data, please contact us immediately: [email protected]

14. Policy Amendments

We reserve the right to amend this Policy at any time. In the event of a substantial modification, you will be notified by email, by a notification at the next login and by a banner on the website. Continued use of the service constitutes acceptance.

15. Contact — DPO

16. Your California Privacy Rights (CCPA/CPRA)

This section applies to California residents and supplements the rest of this Policy, under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). Where this section and the rest of the Policy differ, this section prevails for California residents.

16.1. Categories of personal information we collect

We do not collect sensitive personal information as defined by the CPRA, and we do not knowingly collect personal information from consumers under 16.

16.2. How we use it

• Providing and operating the service you or your business signed up for
• Billing and accounting
• Support, security and fraud prevention
• Measuring audience and improving the service
• Measuring our advertising campaigns
• Complying with legal obligations

16.3. Sharing with service providers and third parties

We disclose personal information to service providers acting on our behalf, under contracts that restrict their use of it: Stripe (payments), Google (authentication, Google Business Profile API, Google Analytics and Google Ads measurement), Meta (advertising measurement), PostHog (audience measurement, hosted in the European Union) and Sweego (text message delivery).

We do not sell personal information for money. Advertising measurement cookies (Google Ads, Meta Pixel) may qualify as "sharing" for cross-context behavioral advertising under the CPRA; you can opt out as described in 16.6. We do not sell or share the personal information of consumers under 16.

16.4. Your rights

16.5. How to exercise your rights

Email [email protected] with the subject "California privacy request", or write to the postal address in section 15. We verify requests by matching the information you provide with the information we hold (for account holders, a request from the account's email address is sufficient). An authorized agent may submit a request on your behalf with your written permission. We respond within 45 days, extendable once by 45 days with notice. Exercising your rights is free of charge.

16.6. Do Not Sell or Share My Personal Information

Do Not Sell or Share My Personal Information: this link opens your privacy choices, where you can turn off advertising and analytics cookies. The same panel is available from the "Your Privacy Choices" link at the bottom of every page, and your choice applies to both gmb-club.com and app.gmb-club.com.

We honor the Global Privacy Control (GPC) signal. When your browser sends it, we treat it as a valid request to opt out of the sale or sharing of your personal information, and advertising cookies are not set.

16.7. Retention

We keep personal information for the periods set out in section 7, and no longer than needed for the purposes above or to comply with the law.