Access by permission.
Google data is accessed only for the features you authorize. A website visit or inquiry is not Google authorization.
PRIVACY & YOUR INFORMATION
Privacy policy.
Clear information. Meaningful choices. This policy explains how MapNPS handles personal information when you visit our website, contact us, or use Google-connected features.
No sale. No ad targeting.
Your inquiry details and Google user data are not sold or used to target advertising.
Your connection. Your choice.
You can revoke Google access and use our contact form to request access, correction or deletion.
1. Who we are and what this policy covers
MapNPS is an independent, developer-led service focused on local reputation and customer feedback for consumer-facing businesses. The application name is MapNPS. MapNPS is responsible for the information it handles as described in this policy.
This policy covers the public website, business inquiries and Google-connected features made available through MapNPS. The Google-specific sections apply when you choose to use an available Google sign-in or Business Profile feature and grant the relevant permissions. Simply browsing the website or submitting its inquiry form does not connect your Google Account, create an account or authorize access to Google data.
This policy does not govern Google's own services, third-party websites, or a merchant's independent handling of its customers' information. Google and those other organizations have their own privacy policies. MapNPS is not affiliated with or endorsed by Google.
2. Information we collect
Information you provide
The inquiry form collects your name, email address, business name and description of your needs. You may also provide your business type and a website or Google Maps link. We retain the submission's consent record, submission identifier and creation time to process the inquiry and avoid duplicate submissions. Follow-up correspondence or a privacy request may contain additional details you choose to share.
Technical and usage information
Our hosting, content-delivery and security providers may process IP addresses, requested pages, access times, browser and device information, referring pages, error logs and approximate location derived from an IP address. This supports delivery, security and site usage analysis. Basic form protection also uses temporary checks to identify automated or repeated submissions.
Information from authorized Google features
When you authorize a Google-connected feature, MapNPS can receive the identity, business or review data described in the next section. The information available depends on the permissions you grant, your Google Account's access and the feature you use.
The feedback example
The interactive NPS example on our homepage runs in your browser. The score you select is not submitted to MapNPS, saved in our database or added to your inquiry.
The free QR code tool
The review link and optional business name you enter in our free QR code tool are processed in your browser. They are not sent to our server or an external QR generation service, saved by the application or added to analytics events. The downloaded code encodes your link directly; MapNPS does not track its scans. Opening or scanning the destination link sends you to that provider, whose privacy practices apply. Normal website delivery logs and platform-provided page analytics remain separate from the tool's local processing.
3. Google data and permissions
Google authorization is handled through Google's authentication and consent process. We do not ask you to provide your Google password to MapNPS or enter it in our contact form. Signing in and granting access to Business Profile information are distinct permissions; we request only the access needed for the feature you choose.
Google sign-in
For Google sign-in, the permitted data categories are your Google Account identifier and basic profile information provided by Google, such as your name, email address, email-verification status and profile image where available. These identify and authenticate you and associate the authorized connection with the correct user.
Google Business Profile
For authorized Business Profile features, the permitted categories are business account and location identifiers; business names, addresses, contact details and other profile information returned by the relevant API; and review information such as ratings, review text, publicly provided reviewer names or images, review timestamps and existing owner replies. Access is restricted to businesses you own or are authorized to manage and the information needed for the selected feature.
Authorization records and tokens
A Google connection may require access tokens, refresh tokens, permission records and identifiers to authenticate permitted API requests. These credentials must be treated as confidential service credentials, not public profile information. They are used only to maintain the connection you authorized and must be removed when access is no longer needed.
These features do not require access to your Gmail messages, Google Drive files, contacts or calendars, and MapNPS does not request those permissions for the uses described here. If a future feature needs another data category or purpose, we will update the disclosure and obtain the required authorization before accessing that additional data.
4. How we use information
Inquiry information is used to review your needs, respond using the contact details you supplied, discuss a possible service engagement and manage related correspondence. Technical information is used to deliver and protect the website, investigate errors and understand general website usage. Submitting an inquiry does not subscribe you to marketing emails, take a payment or trigger an automated confirmation email.
Google sign-in information is used for authentication and linking the correct user to an authorized Google connection. Business Profile information is used to identify your permitted business locations and provide the reputation and review features you choose, such as displaying authorized business and review information. It is not used to obtain access to unrelated businesses or create prospect lists.
We do not publish review replies, modify listings or take other actions on your behalf unless the corresponding feature is available and you have given specific, prior authorization for that action. Granting a broad Google permission is not treated as blanket approval for every possible change. We do not buy reviews, reward reviewers or selectively solicit positive reviews.
Where a legal basis is required, processing may rely on your consent for an optional Google connection; steps you ask us to take before a service agreement; our legitimate interests in responding to inquiries and operating a secure website, balanced against your rights; or a legal obligation. You can withdraw consent for optional processing without making earlier lawful processing unlawful. Withholding or withdrawing required access may prevent the related Google feature from working.
5. Google API data and Limited Use
The use and transfer by MapNPS of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Google user data is used only to provide or improve appropriate, user-facing features that are visible in the application and that you have authorized. These restrictions also apply to data derived from Google API information where required by Google's policies.
We do not sell Google user data or transfer it to data brokers or information resellers. We do not use or transfer it for advertising, retargeting, personalized advertising, creditworthiness assessments or lending decisions. Under this policy, Google user data is not shared with external AI providers or used to train general-purpose AI or machine-learning models.
Transfers of Google user data are limited to providing the authorized, visible features with your consent; necessary security purposes; compliance with applicable law; or a change in ownership or sale of relevant assets after obtaining your explicit prior consent. Service providers, contractors and any successor must observe the applicable restrictions.
Human access to Google user data is restricted. It is permitted only with your affirmative agreement to view specific information, when necessary for security or legal compliance, or for permitted internal operations involving aggregated information where Google's policies and applicable law allow it. This does not override stricter Business Profile content-storage restrictions. Ordinary support access is not blanket permission to read all of your Google data.
7. Data protection
We apply reasonable safeguards appropriate to the information and the service. The website uses HTTPS for public transmission, stores inquiries in a private server-side database, validates submissions and limits public access to data. Do not include passwords, payment information or confidential customer records in a form submission.
Our requirements for Google-connected features include HTTPS/TLS transmission, encrypted server-side storage of retained Google user data and tokens, access restricted to authorized systems and people with a legitimate need, and removal of credentials when access is no longer required. Tokens must not be placed in public pages, browser storage, analytics events or publicly accessible logs. These requirements apply to any deployment that handles that data.
No internet service or storage system can guarantee absolute security. If an incident affects personal information, we will assess it and provide any notifications required by applicable law. We do not claim that this policy is a security certification or that it guarantees an application verification result.
8. Storage and international processing
Information submitted through this website is stored in a Manus-managed database. Hosting, storage and supporting service providers may process information outside your country, including in the United States. Google processes authentication and API requests according to its own infrastructure and privacy terms.
Where international-transfer rules apply, the relevant processing must use an appropriate lawful transfer basis or safeguards. We do not represent that all data stays in a particular country or that a specific certification or transfer mechanism applies to every provider. Contact us if you need information about the processing relevant to your service.
9. How long information is retained
Inquiry details and correspondence are kept for as long as reasonably needed to review and respond to your request, manage an ongoing relationship or meet legitimate legal and security needs. The period depends on the inquiry's status, whether a service relationship continues and any applicable obligations. Information that no longer has a legitimate purpose should be removed; there is no universal retention period for every type of information.
Google identity and connection information may be retained only while needed for an active, authorized connection or the relevant account function. Access and refresh tokens must be revoked and deleted when that access is no longer needed. Google's own retention of information in your Google Account is separate from retention by MapNPS.
Google Business Profile API content is not retained as a permanent, independent data warehouse. Where Google's policy permits limited caching for project performance, cached content must be stored securely for no more than 30 calendar days and must not be manipulated or aggregated in ways prohibited by that policy. It cannot be kept to bypass Google's usage monitoring or used outside the permitted project. This cache limit is distinct from retention of inquiry or account administration records.
Where a provider maintains restricted backup copies, deletion from those copies may follow its normal backup lifecycle. Copies awaiting removal must remain protected and must not be restored for ordinary use after deletion, except where necessary and lawful for recovery or security.
10. Disconnecting Google and requesting deletion
You can review or revoke Google's authorization using your Google Account's linked-app settings. See Google's instructions for managing linked apps. Revoking access stops future requests that depend on that permission, but does not itself remove information already held by MapNPS.
To end a connection, request deletion or close the related service relationship, use our contact form and identify the request as a privacy or Google-disconnection request. Use the email associated with your inquiry or connection and identify the relevant business. Do not send your Google password, access tokens or identity documents through the form.
Requests are reviewed and verified manually. We may ask for proportionate information to confirm your identity and authority over the business. Our service standard is to stop unnecessary access and remove associated credentials when the connection is ended, provide Business Profile disassociation within seven business days of a valid termination notice, and aim to resolve verified data-deletion requests within 30 calendar days, subject to applicable legal requirements and narrowly justified retention.
Deleting MapNPS-held data does not delete your Google Account, business listing or reviews published on Google. Where information must be retained for a lawful reason, we will explain the relevant limitation and restrict its use. These are service-handling standards, not a claim that the website has an automated deletion button or scheduled purge system.
12. Your privacy rights and choices
Depending on your location and applicable law, you may have rights to access your personal information, obtain a copy, correct inaccuracies, request deletion, restrict or object to certain processing, receive eligible information in a portable format, and withdraw consent. You may also have the right to complain to the data-protection authority responsible for your location.
You can exercise applicable rights through the contact form below. We may verify your identity and clarify the scope of your request before responding. We will handle requests within applicable legal time limits and explain any lawful exception. You do not need to authorize Google access or purchase a service to make a privacy request.
Withdrawing optional Google authorization may disable the corresponding feature. It does not require deletion of unrelated records we must lawfully retain. We do not sell personal information or share it for cross-context behavioral advertising, and we do not penalize you for exercising applicable privacy rights.
13. Children and sensitive information
MapNPS is intended for adult business owners and authorized representatives, not children. We do not knowingly collect personal information from children under 13, or below a higher age where applicable law requires it. If you believe a child has provided information, contact us so we can review and remove it where appropriate.
Although aesthetic and cosmetic clinics are among our target businesses, the website is not a patient portal and does not request medical records, treatment information or health histories. Do not submit patient details, payment credentials, government identifiers or confidential customer datasets. Google-connected features are limited to authorized identity, business and review information as described above.
14. Changes to this policy
We may update this policy to reflect changes in the service, our practices or legal requirements. The date at the top identifies the current version. Material changes will be communicated through an appropriate notice. If a change involves new Google data or a new purpose for existing Google data, we will update the relevant disclosures and obtain the required consent before that access or use begins.
Separate service terms may govern a commercial engagement. Nothing in those terms authorizes undisclosed use of Google user data or overrides the applicable Google API restrictions in this policy.
15. Contact MapNPS about privacy
Use the website's contact form for questions about this policy, data access or correction, Google disconnection, account closure or deletion. Include "Privacy request" in your message, the email associated with your inquiry or connection, and a brief description of what you need. The request will be used to verify and handle your privacy concern, not to enroll you in marketing.
Make a privacy request