Privacy Policy
GlowRank (“GlowRank”, “we”, “us”) is operated by Onzira Labs Pvt Ltd, a company registered in India. This policy explains what data we collect, why, how long we keep it, and the rights you have over it. It applies to the GlowRank web application and API.
1. Who is the data controller
Onzira Labs Pvt Ltd is the controller for account and billing data. For business-profile data you connect to GlowRank, you are the controller and we act as your processor, acting on your instructions.
Contact: privacy@onzira.com
2. Data we collect
| Category | Examples | Why |
|---|---|---|
| Account | Name, work email, hashed password, organisation name, role | Authenticate you and scope your data to your organisation |
| Billing | Plan, subscription status, invoices, tax ID, payment reference IDs | Charge for the service and issue compliant invoices |
| Business profile | Location name, address, phone, hours, categories, photos count, reviews, posts, performance metrics | Deliver the product features you subscribed to |
| Usage | Feature counts (scans, reports, AI generations), timestamps | Enforce plan limits and show you your usage |
| Technical | IP address, browser type, error traces | Security, rate limiting, debugging |
We do not collect or store full card numbers. Payments are processed by Razorpay; card data goes directly to the payment processor and never touches our servers.
3. Google user data
If you connect a Google account, GlowRank requests the scope https://www.googleapis.com/auth/business.manage. With your explicit consent we access:
- Your Business Profile account and location list — to show your locations in GlowRank.
- Location details (name, address, phone, website, hours, categories) — to display them and flag incomplete fields.
- Reviews — to show them in your inbox and, only after you approve a reply, publish that reply.
- Posts — to publish content you have scheduled.
- Performance metrics (impressions, calls, direction requests, website clicks) — to produce your reports.
Limited Use disclosure
GlowRank’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We use Google user data only to provide and improve the GlowRank features described above.
- We do not transfer Google user data to third parties except as necessary to provide the service (see §5), to comply with law, or as part of a merger where the acquirer honours this policy.
- We do not use Google user data for advertising, and we do not sell it.
- We do not allow humans to read Google user data, except: (a) with your explicit consent for a support request you raise; (b) where required by law; (c) where the data is aggregated and anonymised for internal operations such as capacity planning.
- We do not use Google user data to train generalised AI/ML models. Where an AI feature drafts a reply, only the specific review text you selected is sent to our AI provider for that request, and the provider is contractually barred from training on it.
Nothing is published to your Google profile without your explicit approval in the product.You can disconnect Google at any time from Settings; this revokes our access token and deletes the stored credential immediately.
4. Legal bases (UK/EU)
- Contract — account, billing and core product data.
- Consent — connecting your Google account; marketing email.
- Legitimate interests — security, fraud prevention, service improvement.
- Legal obligation — tax and accounting records.
5. Sub-processors
| Provider | Purpose | Region |
|---|---|---|
| Supabase (PostgreSQL) | Primary database | Mumbai, India |
| Vercel | Application hosting | Global edge |
| Razorpay | Payment processing | India |
| Anthropic | AI drafting (reply/post/report generation) | United States |
| DataForSEO | Search ranking data | United States / EU |
An up-to-date list is available on request. We will give notice before adding a sub-processor that materially changes this list.
6. International transfers
Data is primarily stored in India. Where a sub-processor is outside your region, transfers rely on Standard Contractual Clauses or an equivalent safeguard.
7. Retention
- Account and product data: for as long as your account is active.
- After you request deletion: permanently erased within 30 days (a grace window during which you can cancel the request).
- Google OAuth tokens: erased immediately on disconnect.
- Invoices and tax records: retained for 8 years as required by Indian law.
8. Security
- All traffic over TLS 1.2+.
- Passwords hashed with bcrypt; we can never read them.
- Google refresh tokens encrypted at rest with AES-256-GCM.
- Every record is scoped to your organisation and access is checked server-side on every request.
- Administrative actions by our staff are recorded in an immutable audit log.
9. Your rights
Under India’s DPDP Act, the UK/EU GDPR and comparable laws you may access, correct, export, or delete your data, and object to or restrict processing. GlowRank provides self-service tools for the two most common rights:
- Export — Settings → Export my data returns a complete machine-readable copy.
- Deletion — Settings → Request deletion starts the 30-day erasure process.
For anything else, email privacy@onzira.com; we respond within 30 days. You also have the right to complain to your local supervisory authority.
10. Children
GlowRank is a business tool and is not directed at anyone under 18.
11. Changes
We will post any change here and update the date above. Material changes will be emailed to account owners at least 14 days before they take effect.