Privacy Policy

Effective date: 21 May 2026 · Last updated: 21 May 2026

This Privacy Policy explains how GenAi Tribe.Agency (“GenAi Tribe,” “we,” “us,” “our”) collects, uses, stores, and discloses information in connection with:

• our public marketing website at genaitribe.agency; and
• GMB Master Pro, our internal agency tool at gmb.genaitribe.cloud that we use to manage our clients’ Google Business Profiles on their behalf (together, the “Services”).

1. Who this policy applies to

This policy describes the personal data we handle in three distinct contexts:

• Visitors to our marketing site at genaitribe.agency.
• GenAi Tribe.Agency staff who sign in to GMB Master Pro at gmb.genaitribe.cloud using their staff Google account and operate the tool on behalf of the agency.
• Clients whose Google Business Profile we manage under a written or otherwise-recorded service agreement, after the client has invited our Google account as a Manager of their profile through the official Google Business Profile UI.

2. Information we collect

2.1 Information collected on the marketing site

• Enquiry data — when you click a WhatsApp or email link on genaitribe.agency, your message is delivered through your own WhatsApp or email client. We see only the information you choose to send.
• Standard server logs — IP address, user agent, request path, and timestamp, retained for up to 30 days for security and abuse-prevention.
• Minimal cookies / local storage — first-party only, used for animation timing and form state. We do not use third-party advertising cookies and we do not run third-party analytics or remarketing pixels.

2.2 Information collected inside GMB Master Pro

Because GMB Master Pro is used only by GenAi Tribe.Agency staff, the data inside the tool falls into two buckets:

(a) Staff-account data — the email address and password our staff use to sign in to the tool (passwords are stored as bcrypt hashes by our authentication provider; we never see plain-text passwords). Standard application logs, kept up to 30 days.

(b) Client-business data we record about our clients — business name, address, phone, opening hours, services, photos, notes from calls, billing records, and any other information the client asks us to manage. This information is provided to us by the client under our service agreement and is held on their behalf.

2.3 Google user data — what flows in from Google APIs

Our staff Google account, once added as a Manager on a client’s Google Business Profile by that client, authorises GMB Master Pro to call the Google Business Profile API on its behalf using the OAuth scope https://www.googleapis.com/auth/business.manage. With that authorisation, the Service reads and (when our staff direct it) writes the following data:

• The identifier of our staff Google account that authorised the connection.
• The list of Google Business Profile locations on which our staff account currently holds Owner or Manager access — i.e. the client profiles the client has explicitly invited us to manage.
• For each managed location: profile fields (name, address, categories, hours, attributes, services, products), photos, posts, offers, events, reviews and ratings, questions and answers, and GBP performance metrics (views, searches, calls, direction requests).
• Replies, posts, photos, and Q&A answers that our staff publish to the client’s profile from inside GMB Master Pro on the client’s behalf.

We do not request access to Gmail, Drive, Calendar, Contacts, YouTube, Photos, or any other Google service. The only Google scope we request is the Google Business Profile business.manage scope listed above.

Because the OAuth principal is always a member of GenAi Tribe.Agency staff (not the client), the only Google account whose identity is captured by the OAuth flow is that staff account. The data about the client’s business is data Google holds about the client’s Google Business Profile and exposes to us because of the Manager relationship the client established in their own Google Business Profile dashboard.

3. Google API Services — Limited Use disclosure

Specifically:

• We use Google user data only to provide and improve user-facing features of GMB Master Pro that are prominent in the application’s user interface (viewing the client’s profile, drafting and publishing posts, replying to reviews, generating monthly reports, and similar GBP-management tasks).
• We do not transfer Google user data to third parties except (a) as necessary to provide or improve those user-facing features, (b) to comply with applicable law, or (c) as part of a merger, acquisition, or sale of assets, with appropriate notice.
• We do not use Google user data to serve advertisements, including retargeting, personalised, or interest-based advertising.
• We do not allow humans to read Google user data except: (i) the GenAi Tribe.Agency staff member who is logged in and operating the tool on the client’s behalf under our service agreement; (ii) for security purposes (investigating abuse or a security incident); (iii) where required by applicable law; or (iv) where the data has been aggregated and anonymised and is used for internal operations.
• We do not use Google user data to train, fine-tune, or otherwise develop generalised or non-personalised AI/ML models. AI features in the Service operate on a per-client basis on that client’s own data, using third-party model providers under enterprise contracts that prohibit training on the data we send.

4. How clients authorise us to access their Google Business Profile

We never ask a client to sign in to GMB Master Pro and we never ask a client to give us their Google password. The authorisation flow is the one Google itself defines for the Google Business Profile, with a written service agreement on top:

1. The client and GenAi Tribe.Agency agree on the scope of work (managing the client’s Google Business Profile) under a written or recorded service agreement, including the price, term, and what we are permitted to publish.
2. The client invites our staff Google account as a Manager (or Owner, at the client’s discretion) on their Google Business Profile, using the official Google interface at business.google.com. Google itself displays to the client exactly which permissions a Manager has before they confirm the invite.
3. Once the invite is accepted by our staff account, our staff sign in to GMB Master Pro using that same Google account. GMB Master Pro then calls the Google Business Profile API on behalf of that staff account to read the client’s profile and perform actions the staff initiate.
4. The client can revoke our Manager access at any time from their Google Business Profile dashboard, which immediately stops further data sync. The client may also terminate our service agreement under its own terms.

5. How we use the information

We use the information described in Section 2 to:

• Authenticate GenAi Tribe.Agency staff and keep their work sessions active.
• Display each client’s Google Business Profile data inside GMB Master Pro so our staff can review and manage it.
• Carry out actions our staff initiate on a client’s profile — for example, publishing a post, replying to a review, or updating an attribute.
• Generate performance reports and rank-tracking dashboards that we share back with the relevant client.
• Send service notifications to staff (security alerts, deploy notices) and to clients (report delivery, billing).
• Detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms.
• Comply with legal obligations.

6. AI features and third-party model providers

Some features of GMB Master Pro use large-language models (currently Anthropic Claude and OpenAI) to help our staff draft post copy, summarise reviews, generate suggested replies, and produce report narratives. When a staff member uses one of these features, the specific content needed for that single request — for example, the review text being summarised — is sent to the model provider under their enterprise API terms, which prohibit using the content to train their models. We do not send a client’s full profile contents, and we do not retain a separate copy of the AI prompt or response beyond what is needed to display it inside the tool.

7. Sharing and disclosure

We share information only in the limited circumstances below:

• Service providers (sub-processors) — Supabase (managed Postgres + auth), Hostinger (VPS hosting), Cloudflare (DNS), Anthropic and OpenAI (AI inference), Apify (rank-scan compute). Each is bound by contract to process data only on our instructions.
• The client whose data is being processed — reports, drafted posts, suggested replies, and other deliverables are shared back with the client whose profile they relate to.
• Legal requirements — we may disclose information if required by law, court order, or to protect rights, property, or safety.
• Business transfers — if we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction; affected parties will be notified and given a choice where the law requires.

We do not sell, rent, or trade personal information or Google user data to anyone, ever.

8. Storage, security, and retention

• Staff credentials, client business data, and OAuth refresh tokens are stored in our managed Supabase Postgres instance with encryption at rest and TLS 1.2+ in transit.
• Refresh tokens are stored encrypted and used only to refresh access tokens while a Manager relationship with the client’s profile is active.
• We retain Google user data only while the client’s service agreement is active and our Google account remains a Manager on their Google Business Profile. If a client revokes our Manager access in their Google dashboard, terminates the service agreement, or otherwise asks us to delete their data, we delete the associated Google user data within 30 days, except where we are required to retain it to comply with a legal obligation.
• Aggregated, anonymised metrics (counts, error rates) that cannot reasonably be tied back to a person may be retained for longer for operational purposes.

9. Your choices and rights

You have the following rights with respect to your personal information:

• Access & portability — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — ask us to delete your data; for clients, this is in addition to the right to terminate the underlying service agreement.
• Revoking Google access — clients can revoke our Manager access on their Google Business Profile at any time, either inside the Google Business Profile dashboard or at myaccount.google.com/permissions. Revocation stops further data sync immediately.
• Objection & restriction — ask us to stop or limit certain processing.
• Complaint — lodge a complaint with your local data-protection authority.

To exercise any of these rights, contact us using the details in Section 13. We will respond within 30 days.

10. Children

The Services are intended for businesses and for the adults who staff them. We do not knowingly collect personal information from children under 13 (or under 16 in jurisdictions where that is the applicable threshold). If you believe a child has provided us with personal information, please contact us and we will delete it.

11. International transfers

We are based in India and our primary infrastructure is hosted in regions selected by our service providers, which may include India, the European Union, and the United States. By using the Services or by engaging us as a service provider, you understand that information may be transferred to and stored in countries outside your country of residence. Where required, we rely on appropriate transfer mechanisms (such as the European Commission’s Standard Contractual Clauses).

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date at the top, and if the change affects how we handle Google user data we will additionally notify affected clients in writing before the change takes effect.

13. Contact us

For any privacy question, data-subject request, or to report a concern about how we handle Google user data, contact:

• Data Protection contact: Manthri Ashish Raj
• Email: Manthriashishraj@genaitribe.agency
• WhatsApp: +91 98889 49990
• Postal: GenAi Tribe.Agency, Fortview Apartments, Block 5, Hydershakote, Gandhamguda, Hyderabad, Telangana 500091, India

We aim to respond to all privacy enquiries within 5 working days and to resolve substantive requests within 30 days.