Privacy policy
Last updated: July 2, 2026
1. Data controller
PlaceRankFlow is operated by MCS, a French company registered under SIREN 106 942 600 (R.C.S. Nantes), EU identification number FR4401.106942600, with its registered office at 5Q Avenue des Naudières, 44800 Saint-Herblain, France.
Contact: [email protected]
2. Data we collect
Account data. When you sign in with Google we receive your Google account identifier (sub), name, email address and profile picture. These are used to create and identify your account.
Google Business Profile data. If you connect a Business Profile, we request the business.manage OAuth scope. This allows us to read and write on your behalf: location details, scheduled posts, review replies and performance metrics. We store a refresh token (encrypted at rest) to perform actions you have explicitly approved.
Usage data. We log actions taken inside the app (automations run, posts approved, replies sent) for audit trail purposes. We collect anonymised page-view analytics via a self-hosted Umami instance.
Billing data. Payment processing is handled by Stripe. We store only a Stripe customer identifier; we never see or store full card numbers.
3. How we use your data
We use data solely to provide the PlaceRankFlow service:
- Authenticate your session and identify your account.
- Execute automations (post publishing, review replies) that you have explicitly approved.
- Display performance insights from your connected Business Profile.
- Send transactional emails (welcome, weekly digest) where you have consented.
- Detect and prevent abuse or fraud.
We do not use Google user data for advertising, profiling unrelated to the service, or training machine-learning models. We do not sell or share your data with third parties except as described in Section 4.
4. Google API Services User Data Policy
PlaceRankFlow's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- Google user data is used only to provide or improve user-facing features visible within PlaceRankFlow.
- Data is not transferred to third parties except as necessary to provide the service, comply with applicable law, or as part of a merger or acquisition where users are notified.
- Data is not used for serving advertisements.
- Human access to Google user data is limited to cases where the user has given explicit permission, where it is necessary for security purposes, or where required by law.
5. Subprocessors
| Provider | Role | Location |
|---|---|---|
| Cloudflare | Application hosting, D1 database, CDN | EU / US (Standard Contractual Clauses) |
| Identity, Business Profile APIs | Global | |
| Resend | Transactional email delivery | EU |
| Stripe | Payment processing | EU / US (Standard Contractual Clauses) |
| DataForSEO | Geo-grid rank data (optional feature) | EU |
6. Data retention
- Active accounts: data is retained for the duration of the subscription plus 30 days.
- Deleted accounts: all personal data is purged within 30 days; only a pseudonymous record (hashed email, hashed Google identifier) is kept to prevent trial re-use.
- Cached Google Business Profile content: deleted within 30 days of disconnection.
- Refresh tokens: revoked and deleted immediately on disconnection or account deletion.
7. Security
Google refresh tokens are encrypted at rest using AES-GCM with a key stored as a Cloudflare Worker secret. All data in transit is protected by TLS 1.2+. Access to production systems is restricted and logged.
8. Your rights (GDPR)
If you are located in the European Economic Area you have the right to:
- Access — obtain a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — request deletion of your account and associated data.
- Portability — receive your data in a machine-readable format.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — revoke Google access at any time from your Google account settings or from PlaceRankFlow workspace settings.
To exercise these rights, contact [email protected]. You also have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés, www.cnil.fr).
9. Legal basis for processing
- Performance of contract (Article 6(1)(b) GDPR) — processing necessary to provide the service you subscribed to.
- Consent (Article 6(1)(a) GDPR) — Google OAuth access, optional email notifications.
- Legitimate interests (Article 6(1)(f) GDPR) — security logging, fraud prevention, service improvement.
10. Changes to this policy
We will notify registered users by email of material changes at least 30 days before they take effect. The current version is always published at placerankflow.com/privacy.
11. Contact
MCS — PlaceRankFlow
5Q Avenue des Naudières
44800 Saint-Herblain, France
[email protected]