Privacy policy

Mapkita (Metro Manila, Philippines) is run by Nacho Gabaldon, who is the data controller for the information described here. Contact: hello@mapkita.com.

• Account data — the name and email address of the person who signs up, so we can identify the account owner.
• Free check data — the business you look up with the free check and its public result, and, if you ask for the full report, your email address. We use that email to send you the report and the occasional tip about your Google page; reply “stop” to any of them and we remove you. We do not store your IP address or device with a check.
• Free tool data — when you use a free tool, which tool and what you did with it (for example, copied a link or downloaded a PDF), the public Google listing you picked or the shop name you typed, your country and the site you came from. We use it to see which tools help, and we do not store your IP address, your photos, payment QR codes or any review text.
• Business data — the public details of the business you ask us to manage: name, address, phone, hours, categories, photos, ratings and reviews.
• Google account data — when you connect Google, we receive an access token, a refresh token and your email address. See the section below.
• Meta account data — if you connect Facebook or Instagram, the Pages you grant, their access tokens, and the messages sent to those Pages.
• Usage data — basic logs needed to run and secure the service (timestamps, errors, IP address of requests).
• Analytics data — how people move through this website: pages viewed, roughly where in the world the visit came from, whether it was a phone or a computer, and which site sent them. See the section below.

We do not collect payment card details ourselves; payments, when applicable, are handled by a payment processor.

When you connect your Google Business Profile, you grant the business.manage scope. With it we access, strictly on your behalf:

• The list of Business Profile accounts and locations you manage — to know which listing to work on.
• Your reviews and their replies — to show them to you and to publish the replies you approve.
• Your profile information (hours, phone, categories, attributes) — to show it and to apply the changes you approve.
• Your Business Profile performance metrics (views, calls, direction requests, website clicks) — to show you results.

We also request openid and email so the app can display which Google account is connected.

When you sign in to Mapkita with Google, we request openid, email and profile: your email address to identify your account, and your name and profile picture to show who is signed in. Nothing else from your Google account is read at sign-in.

Limited Use. Mapkita’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we do not use Google user data to serve advertising, we do not sell it, we do not transfer it except as needed to provide the service you asked for, and no human reads it except with your explicit permission, for security purposes, or where required by law.

We are an independent service. Mapkita is not affiliated with, sponsored by, or endorsed by Google.

To draft review replies, posts and suggestions, we send the relevant text — the review or message content, and the business details needed for context — to our AI provider (DeepSeek) for processing. That content is processed only to generate the draft you requested. Drafts are shown to you; nothing is published without the approval level you set.

Mapkita’s plugin for ChatGPT has its own privacy policy, which lists tool by tool what it receives, who it goes to and how long anything is kept: Mapkita for ChatGPT: privacy policy. In short, it needs no account, looks up only public Google Maps information, and uses an email address only if you ask for a report by email, keeping it only if you also ask to hear from us.

We count visits to this website ourselves, without cookies and without storing anything in your browser: the page opened, the site that sent you, your country and whether you are on a phone or a computer. To count the same visitor once a day, we keep a code made from your IP address and browser that changes every day and cannot be turned back into either; we do not store the IP address itself. This count is not shared with anyone.

If you accept, we also use Google Analytics 4 to understand which pages are read and which are ignored, so we know what to write next. It sets cookies in your browser and tells Google your IP address, the pages you open on this site, and the site that referred you.

We do not use it for advertising, we have not enabled ad personalisation or remarketing, and we do not upload any of your business data or your customers’ reviews to it. Analytics runs on the public website; nothing you type inside the application is sent to it.

You can opt out with Google’s official browser add-on at tools.google.com/dlpage/gaoptout, or by blocking cookies for this site. Nothing on the site stops working if you do.

We do not sell personal data. We share it only with the processors that make the service work:

• Hosting and infrastructure providers, to run the application and store your data.
• Our email provider, to deliver the emails you ask for.
• Google, to look up public business information on Google Maps for the free check and the ChatGPT plugin.
• Our AI provider, as described above.
• Google Analytics, for the website measurement described above.
• The platforms you connect (Google, Meta), to carry out the actions you approve.
• Authorities, where we are legally required to.

Access tokens are stored encrypted at rest by our storage provider and are never exposed to the browser or to other customers. Access to production data is restricted to the people who operate the service.

We keep your data for as long as your account is active. When you disconnect a platform, we delete the corresponding tokens immediately. When you close your account, we delete your data within 30 days, except where we must retain records by law.

• Disconnect at any time — from Integrations inside the app, or from your Google account permissions. Revoking access stops all further data access immediately.
• Access, correct, export or delete your data — write to us and we will do it.
• Object to or restrict processing, and withdraw consent, without affecting what happened before.

We handle personal data under the Philippine Data Privacy Act of 2012 (RA 10173). If you are in a jurisdiction with additional rights, those apply too.

The service is for businesses and is not directed at children under 18.

If we change this policy materially, we will update the date above and notify account owners by email before the change takes effect.