Privacy Policy
Effective date: October 12, 2026 · Last updated: October 12, 2026
This Privacy Policy explains how My Profile Pilot (“My Profile Pilot”, “we”, “us”), a software product of My Barista Trainer, collects, uses, stores, shares and protects information when you use the website at https://myprofilepilot.com, the My Profile Pilot web app (app.html), the My Profile Pilot WordPress plugin, and the embed script (embed.js) (together, the “Service”).
Google API Services User Data Policy & Limited Use Disclosure
My Profile Pilot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell, rent, share, or use your Google Business Profile data for advertising, AI model training, or any purpose other than executing the profile optimizations, scheduled posts, media uploads, and review responses explicitly initiated by you.
In addition, in accordance with the Limited Use requirements:
- We only use Google user data to provide and improve the user-facing features described in this policy and on our homepage.
- We do not transfer Google user data to third parties except as necessary to provide those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you.
- We do not use or transfer Google user data for serving advertisements, including retargeting, personalized or interest-based advertising.
- We do not use Google user data to develop, improve or train generalized or non-personalized artificial-intelligence or machine-learning models.
- No human at My Profile Pilot reads your Google user data unless you give us explicit permission for specific messages (for example, a support request), it is necessary for security purposes such as investigating abuse, or it is required by law.
1. Google user data we access and why
When you click “Sign in with Google”, you are asked to grant one OAuth permission (scope): https://www.googleapis.com/auth/business.manage — “See, edit, create and delete your Google business listings”. We do not request access to your Gmail, Drive, contacts, calendar or basic profile. Through this permission we access only the following, for the Business Profile locations you select:
- Business Profile account and location list (account names, location names and addresses) — so you can choose which business to manage.
- Location details (business name, categories, description, phone numbers, website link, address, hours, special hours, more hours, service area, attributes, Maps link and Place ID) — to calculate your Profile Health Score, show you what to fix, apply the fixes you click, and keep the LocalBusiness schema and hours on your own website in sync.
- Reviews (reviewer display name and photo, star rating, review text, date and any existing reply) — to show unanswered reviews and post the replies you approve.
- Media and local posts you create through the Service — to upload the photos in your drip queue and publish the “What’s new” updates you scheduled.
We write to your Business Profile only (a) when you click an action button such as “Apply fix” or “Post reply”, or (b) when a photo you placed in your own drip queue reaches the publishing date you chose. You can remove queued photos or disconnect at any time.
2. Other information we collect
- Billing information. Payments are processed by Stripe, Inc. We receive your name, email, billing country/postal code, plan and payment status. We never see or store full card numbers.
- Support communications. If you email [email protected], we keep the messages and any details you choose to share so we can help you.
- Technical logs. Our hosting provider records standard server logs (IP address, user agent, requested URL, time and status code) for security and reliability. Logs are retained for up to 30 days and do not include your Google data.
- Photos you upload. Photos are resized and compressed in your browser. On WordPress they are stored in your own Media Library; in the web app they are stored in your browser (IndexedDB) until published. They pass through our bridge only at the moment they are uploaded to Google, and are not retained by us.
3. Where your data is stored and how it is protected
- No central database of Google data. Our OAuth bridge is stateless. It holds our Google OAuth client credentials and forwards requests you initiate to Google’s official APIs over HTTPS. It does not store your Business Profile data, reviews or photos.
- Tokens. Your Google refresh token is encrypted on our server with AES-256-GCM (“sealed”) and handed back to your own WordPress site or browser; the sealed token is useless without our server key. WordPress sites add a second layer of encryption using the site’s own secret keys. Short-lived access tokens are kept only in server memory and expire within an hour.
- WordPress plugin. Your dashboard settings, profile snapshot, drip queue and review drafts are stored in your own WordPress database, under your control.
- Web app. Settings and queued photos are stored in your browser’s localStorage and IndexedDB on your device.
- Security. All traffic uses TLS (HTTPS). Access to production infrastructure is limited to authorized personnel using multi-factor authentication.
4. How we share information
We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising. We share information only with:
- Google LLC — to carry out the Business Profile actions you request.
- Service providers acting on our behalf under confidentiality obligations: DigitalOcean (hosting), Stripe (payments) and our email provider (support). They may not use your information for their own purposes.
- Legal and safety — when required by law, subpoena or to protect the rights, property or safety of our users or others.
- Business transfers — in a merger, acquisition or asset sale, with notice to you and subject to this policy and the Limited Use requirements.
5. Retention and deletion
- Disconnect Google: click “Disconnect” in the dashboard. This revokes the token with Google and deletes the sealed token from your site or browser. You can also remove access at any time at myaccount.google.com/permissions.
- WordPress: deleting the plugin removes all of its settings, cached profile data and tokens from your database (photos you uploaded stay in your Media Library unless you delete them).
- Web app: “Disconnect” and clearing your browser’s site data for myprofilepilot.com removes everything stored locally.
- Billing and support records are retained as long as your account is active and afterwards only as long as required for tax, accounting and legal purposes (typically 7 years for invoices).
- Deletion requests: email [email protected] and we will delete any personal information we hold about you within 30 days, except where we are legally required to keep it.
6. Cookies
We do not use advertising or cross-site tracking cookies. See our Cookie Policy for details about the strictly necessary storage the Service uses.
7. Your rights
Depending on where you live (for example, the EU/UK under the GDPR, or California under the CCPA/CPRA), you may have the right to access, correct, delete or port your personal information, to object to or restrict certain processing, and to withdraw consent. We do not sell or share personal information as those terms are defined under California law. To exercise any right, email [email protected]. We will not discriminate against you for exercising your rights. Where the GDPR applies, our legal bases are performance of a contract (providing the Service), your consent (connecting Google) and our legitimate interests (security and service improvement).
8. Children
The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children.
9. International transfers
We are based in the United States and our infrastructure is hosted in the United States. If you use the Service from outside the U.S., your information will be transferred to and processed in the U.S. with appropriate safeguards.
10. Changes to this policy
We will post any changes on this page and update the “Last updated” date. If changes are material, we will notify customers by email or in the dashboard before they take effect. We will never use Google user data in a new way without first asking for your consent.
11. Contact
My Profile Pilot, a software product of My Barista Trainer
Email: [email protected]
Website: https://myprofilepilot.com