Privacy Policy

1. Data we collect

• Account data — name, email, organisation, and authentication details. Sign-in is handled by our authentication provider (Clerk); we do not store your password.
• Billing data — a payment method is required to activate an account. Card details are collected and stored by our payment processor (Stripe); we do not see or store full card numbers. We hold billing metadata such as your Stripe customer id, plan, invoices and payment status.
• Usage and technical data — API request metadata (endpoints, counts, timestamps, key identifiers, approximate origin), and standard logs (IP address, user agent) used for metering, security and abuse prevention.
• Website data — limited cookies/analytics as described in section 7.

Search queries you send to the API are processed to return results and may be logged in aggregate/operational form for billing, debugging and abuse prevention. Do not send personal data in queries that you are not authorised to process.

2. How we use data

• to provide, operate and secure the Service;
• to meter usage, calculate charges and take payment;
• to prevent, detect and investigate fraud, abuse and security incidents;
• to communicate with you about your account, service changes and legal notices;
• to improve and develop the Service; and
• to comply with our legal obligations.

3. Legal bases (UK GDPR)

We rely on: performance of a contract (to provide the Service and take payment); legitimate interests (security, abuse prevention, product improvement, and running our business — balanced against your rights); legal obligation (accounting, tax, responding to lawful requests); and consent (for non-essential cookies and any optional marketing), which you may withdraw at any time.

4. Sharing and processors

We do not sell personal data. We share it with service providers who process it on our behalf under contract, including:

• Clerk — authentication and account management;
• Stripe — payment processing and card storage;
• Amazon Web Services (AWS) — hosting, storage and metering infrastructure;
• Netlify — website hosting;

We may also disclose data where required by law, to enforce our terms, or in connection with a corporate transaction.

5. International transfers

We host primarily in the UK/EU. Where personal data is transferred outside the UK (for example to a processor), we rely on an appropriate safeguard such as UK adequacy regulations or the International Data Transfer Agreement / Addendum.

6. Retention

We keep personal data only as long as needed for the purposes above — for the life of your account and then as required for billing, tax and legal record-keeping (typically up to [6/7] years for financial records), after which it is deleted or anonymised.

7. Cookies

We use essential cookies needed to run the site and dashboard. Any non-essential (analytics/preference) cookies are used only with your consent, which you can manage or withdraw. See our Cookie Policy for details.

8. Your rights

Subject to conditions, you have rights to access, rectify, erase, restrict, and port your personal data, and to object to certain processing. To exercise them, contact privacyteam@goggleplaces.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. Security

We use appropriate technical and organisational measures — including encryption in transit, access controls, hashed (never plaintext) API keys, and edge authentication — to protect personal data. No system is perfectly secure; you are responsible for safeguarding your account credentials and keys.

10. Children

The Service is intended for businesses and developers and is not directed to children.

11. Changes

We may update this Policy from time to time. We will change the "last updated" date and, for material changes, notify you where appropriate. Continued use after changes take effect indicates acceptance.

12. Contact

Privacy questions or requests: privacyteam@goggleplaces.com.