Privacy Policy

1. Data Controller

1.1. Identity of the data controller

1.2. Data Protection Officer (DPO)

2. Personal Data Collected

2.1. Website browsing

• IP address, browser type and version, operating system
• Pages visited, visit duration, date and time of connection
• Referrer URL, approximate geolocation (country, region)
• Technical, analytical and personalisation cookies (see section 11)

2.2. Account creation

• Surname, first name (or legal name), professional email address, telephone, postal address, job title
• Company name, business sector, number of locations, addresses of locations

2.3. Use of the platform

• GMB data: name, address, category, opening hours, telephone, website, photos, customer reviews, replies, performance statistics
• Generated content: AI-generated review replies, retouched photos, scheduled publications, reports, collection campaigns
• Usage data: connection logs, actions performed, preferences, frequency of use
• Imported contacts: name, email, telephone of recipients of SMS/Email/WhatsApp campaigns
• OAuth tokens: access tokens for third-party platforms, stored encrypted (AES/Fernet), never accessible in plain text

2.4. Billing and payment

Banking details are collected and processed exclusively by Stripe (PCI-DSS Level 1 certified). We never store your full banking data. We retain only the last 4 digits of the card, the expiry date and the card type.

2.5. Unified messaging (Messenger, Instagram, WhatsApp Business)

GMB Club allows its customers to manage, through a unified interface, conversations received via Facebook Messenger, Instagram Direct Messages and WhatsApp Business. In this capacity, GMB Club acts as a technical intermediary between the Meta platforms and its business customers, who remain responsible for data processing vis-à-vis their own end customers.

When an end user writes to one of our customers through these channels, we process:

• The textual content of the messages exchanged (incoming and outgoing)
• Attachments sent (photos, videos, audio, documents, GPS location)
• The public name, profile picture and account identifier on the Meta platform
• Conversation metadata (timestamps, read statuses, reply window)

Messages are processed to enable our customers to reply, to generate suggested replies via artificial intelligence (Mistral AI), and to automatically qualify the type of request (information, quote, complaint, customer service).

2.6. WordPress integration (GMB Club Connect plugin)

When a user installs the GMB Club Connect plugin on their WordPress site, we receive and store:

• The WordPress site URL and its name
• The WordPress user identifier used as the author of published articles
• Categories, tags and the list of authors of the WordPress blog (periodic synchronisation to enable selection during article creation)
• The license key generated by GMB Club, or — for the manual method — a WordPress application password (encrypted at rest, never exposed to the browser)

No WordPress data is shared with third parties outside the technical sub-processors listed in section 4.2 (hosting, OpenAI/Anthropic for article generation).

2.7. Wix integration (direct OAuth connection)

When a user connects their Wix site to GMB Club via OAuth (Settings > Website connection), we receive and store:

• The unique Wix instance identifier (instance_id, generated by Wix)
• The Wix site URL and its name
• The Wix Member identifier used as the author of published articles
• Categories, tags and the list of members of the Wix blog (periodic synchronisation to enable selection during article creation)
• OAuth Client Credentials access tokens issued by Wix (encrypted at rest, never exposed to the browser)

No Wix data is shared with third parties outside the technical sub-processors listed in section 4.2 (hosting, OpenAI/Anthropic for article generation).

2.8. Built-in live support chat

GMB Club offers its authenticated users a built-in live support chat, available only after signing in. This is a proprietary system without chatbot or AI: messages are read and answered by a member of the GMB Club internal team.

When you open a conversation with our support, we process:

• Your Firebase identifier, email address and display name (already collected for authentication)
• The textual content of messages exchanged with our team
• The technical context at the moment of the exchange: active sphere and bubble, subscription plan, URL of the page where the chat was opened, browser user-agent, interface language
• If you enable support notifications (Web Push): the notification endpoint issued by your operating system (Apple, Google or Mozilla), an opaque identifier, and the encryption keys required to deliver messages

This data is used to answer your support requests, monitor service quality (response time) and keep a contextual history to make follow-up conversations smoother. It is not used for marketing and is not shared with any third party. You may permanently delete your conversation at any time from the chat widget (« Delete » button at the bottom of the window).

2.9. AI Assistant ("AI Agent")

GMB Club offers a conversational assistant ("AI Agent") that the user addresses in plain language, by keyboard or by voice. At the user's request, the assistant can read their account data (reviews, posts, statistics, articles, SEO, contacts) and perform actions, always after explicit confirmation for any sensitive action. Conversation history is kept for 30 days.

Voice messages (dictation): when the user dictates a request to the AI Agent, the audio recording is transmitted to Mistral AI for transcription, then is not kept — only the transcribed text is.

3. Purposes and Legal Bases for Processing

4. Data Recipients

4.1. Authorised personnel

Your data is accessible internally only to team members strictly authorised in the context of their duties (support, billing, development).

4.2. Sub-processors and technical providers

4.3. Legal authorities

We may transmit data to the competent authorities in the event of a judicial request or legal obligation.

5. Access to Google APIs (Google Business Profile, YouTube)

GMB Club accesses certain data from your Google account, only with your explicit authorisation via OAuth, in order to provide the features you enable: managing your Google Business Profile listings, and publishing videos and Shorts to your YouTube channel on your behalf (scope youtube.upload).

GMB Club's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We only use this data for the user-visible features you have enabled, we do not sell it and we do not transfer it to third parties for advertising purposes.

You can revoke this access at any time from within the application (by disconnecting the relevant network) or from your Google account security settings.

6. Data Transfers Outside the European Union

Several sub-processors are located outside the European Union (United States, Singapore). These transfers are framed by:

• Standard Contractual Clauses (SCC) approved by the European Commission
• Data Privacy Framework (DPF) for certified providers
• PCI-DSS Level 1 certification for Stripe

You may obtain a copy of the safeguards in place by contacting our DPO: [email protected]

7. Data Retention Periods

8. Data Security

Technical measures

• Encryption: SSL/TLS for all communications (HTTPS), AES/Fernet encryption of OAuth tokens, encryption of backups
• Authentication: Firebase Auth, SHA256-hashed API keys, 2FA available, principle of least privilege
• Infrastructure: firewall, intrusion detection, automated backups, regular updates, API rate limiting, partitioning per Bulle (business location)
• Payments: no banking data stored on our servers — Stripe PCI-DSS Level 1
• Live support chat: access restricted to a whitelist of agents (3 Firebase identifiers); push VAPID private key stored on disk in mode 600; inbound email webhooks signed with HMAC SHA-256; outgoing emails sent from inbound.gmb-club.com via a self-hosted Postfix server on our VPS; Web Push messages end-to-end encrypted, never readable in clear by transit services (APNs, FCM, Mozilla Push)

Organisational measures

• Mandatory confidentiality and security clauses with all sub-processors
• Procedure for notifying the CNIL within 72 hours in the event of a data breach
• Direct notification of the persons concerned in the event of high risk

9. Your Rights Over Your Personal Data

In accordance with the GDPR, you have the following rights:

10. How to Exercise Your Rights

• By email: [email protected]
• By telephone: +33 6 49 37 62 72
• By post: ABDELMOUMEN ADAM — DPO, 879 Chemin de la Grotte des Fées, 83400 Hyères

Please attach a copy of a valid identity document. Response within 1 month maximum (extendable by 2 months in case of complexity). The exercise of your rights is free of charge.

11. Right to Lodge a Complaint with the CNIL

If you consider that the processing of your data constitutes a breach of the GDPR, you have the right to lodge a complaint with the CNIL.

12. Cookies and Trackers

A cookie is a small text file placed on your device when visiting a website. It enables recognition of your browser and the storage of certain information.

Manage your preferences

• Chrome: chrome://settings/cookies
• Firefox: about:preferences#privacy
• Safari: Preferences → Privacy
• Edge: edge://settings/privacy

Your consent is retained for 13 months maximum, after which a new banner will be presented to you.

13. Minors' Data

Our service is not intended for persons under 18 years of age. We do not knowingly collect personal data relating to minors. If you are a parent or legal guardian and believe that your child has provided us with data, please contact us immediately: [email protected]

14. Policy Amendments

We reserve the right to amend this Policy at any time. In the event of a substantial modification, you will be notified by email, by a notification at the next login and by a banner on the website. Continued use of the service constitutes acceptance.

15. Contact — DPO