Privacy Policy

1. Introduction

This policy explains what data Iqrava (“we”, “us”) collects from users of our dashboard, why we collect it, how long we keep it, and how you can have it deleted.

2. What we collect

• Account information: your email address and display name, collected when you sign up, and used to authenticate you and identify your account.
• Google Business Profile connection:if you choose to connect your Google Business Profile, we receive and store an OAuth access token and refresh token from Google, along with the connected Google account's email address and the scope you granted (business.manage). These tokens are encrypted (AES-256-GCM) before being written to our database — we never store them as plain text, and no one at Iqrava can read the raw token values directly from the database.
• Google Business Profile data:using the stored token, we fetch your business locations and reviews directly from Google's API on demand, to display them in your dashboard and to let you reply to reviews. We do not currently keep a separate stored copy of this data — it is fetched fresh from Google each time you view it.

3. Why we collect it

We use this data solely to operate the features you use: to authenticate you, to show your connected Google Business Profile's locations and reviews, and to let you reply to reviews on Google's behalf. We do not sell your data, and we do not use it for advertising.

4. How long we keep it

Your account information is kept for as long as your account exists. Your Google OAuth tokens are kept until you disconnect your Google Business Profile (from your dashboard Settings page) or delete your account — either action deletes the stored tokens immediately, and we additionally notify Google to revoke the token so it can no longer be used.

5. Who we share it with

We use Supabase to host our database and authenticate users, and Google's Business Profile API to fetch your locations and reviews. Neither is used for any purpose beyond operating the service described above. We do not share your data with any other third party.

6. Your rights

You can disconnect your Google Business Profile at any time from your dashboard's Settings page, which immediately deletes the stored tokens. You can permanently delete your account and all associated data (profile, Google connection) from the same page. You can also reach us at support@iqrava.com with any data access, correction, or deletion request.

7. Security

Data is encrypted in transit (HTTPS/TLS) between your browser, our servers, and Google's and Supabase's APIs. Stored Google OAuth tokens are additionally encrypted at rest with AES-256-GCM. Access to your data in our database is restricted at the database level so that only your own authenticated session can read or write your rows.

8. Contact

Questions about this policy or your data can be sent to support@iqrava.com.