Privacy Policy

Google Business Profile and Google User Data

Starworks can connect to your Google Business Profile so your reviews and listing details can be selected for your dashboard, and so you can approve and publish review replies without leaving Starworks. This section explains exactly what that connection does. It applies only if you choose to connect a Google account. Starworks works without one, and connecting is entirely optional.

How the connection works

We connect using Google OAuth 2.0. You sign in on Google’s own consent screen and approve the access there. We never see, receive, or store your Google password, and we will never ask you for it. Google issues us an access token instead, and that token is what we use to make requests on your behalf.

We request a single permission, the Google Business Profile management scope (https://www.googleapis.com/auth/business.manage), because it is the only scope Google provides for reading and managing a business profile. We do not request access to Gmail, Drive, Calendar, Contacts, Photos, or any other Google service, and we cannot reach them with this permission.

What we access

• The Google Business Profile accounts and locations your Google login manages, so you can choose which location to connect.
• Business name, address, website and Google Maps links shown while you choose a profile, and the identifiers needed to connect it to the correct Starworks branch.
• Reviews on those locations, including the star rating, the review text, the date it was posted, the reviewer’s public display name and public profile photo as Google supplies them, and any reply already published.
• Replies published to those reviews, including replies posted through Starworks.

What we use it for

• Showing your Google reviews in your Starworks dashboard, with filtering, alerts, and reporting on your rating over time.
• Drafting replies in the tone you choose, and publishing a reply to Google only after you review its exact text and choose Publish reply. Editing that text requires a new approval.
• Measuring the results of your review campaigns, for example matching a new review to a request you sent.
• Alerting you when something needs attention, such as a new negative review.

Every one of these is a feature you can see and use in the Starworks interface. We do not use Google data for anything that is not on this list.

Limited Use

Starworks’ use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms, we will never:

• Sell or license Google user data, or transfer it to a data broker or information reseller.
• Use it for advertising of any kind, including targeted, retargeted, or personalised advertising.
• Use it to develop, improve, or train generalised artificial intelligence or machine learning models. Where we use AI to draft a reply for you, the content is processed by our AI provider under commercial terms that prohibit training on it, and it is used only to produce that draft for you.
• Allow a human to read your Google data, except where you have specifically asked us to, where it is necessary for security or to comply with the law, or where the data has been aggregated and anonymised.
• Use it for any purpose other than the features described above.

Storage, retention, and deletion

• We store only what we need to run the features above. The copy in your dashboard is a working copy refreshed from Google or expired within 30 days. API review content is restricted to your authenticated management dashboard and is excluded from customer API exports and permanent content logs. Google remains the source of truth.
• Google data is held in our database in Sydney, Australia, encrypted in transit and at rest, and kept logically separated so no other business on the platform can see it.
• Access and refresh tokens are encrypted before database storage and are used only to make the requests you have authorised. They are never returned to your browser.
• You can disconnect at any time in Settings. When you do, we ask Google to revoke the token and remove the local credentials. Previously selected location identifiers are retained to prevent public scraping from restarting without a new connection. Already-synced content expires under the same 30-day limit.
• You can also revoke our access directly from your Google account at myaccount.google.com/permissions. That takes effect immediately and stops all further access.
• You can ask us to delete the Google content already synced to your dashboard at any time by emailing support@starworks.com.au, and we will do it. If you close your Starworks account, everything associated with the connection is permanently removed within 30 days.

Acting on your behalf

Connecting a profile authorises automatic review sync for the locations you select. Publishing a reply requires your separate approval of the exact text each time. This connection does not change listing details or add or remove Google account managers.

Our use of the Google Business Profile APIs is also governed by Google’s own terms, including the Business Profile API policies. Starworks is an independent product. We are not affiliated with, endorsed by, or sponsored by Google. Google and Google Business Profile are trademarks of Google LLC.