Angry Turtle
Privacy Policy
This explains what Angry Turtle collects, why, who else sees it, and how long we keep it. It is written to be read, not to be survived.
Who we are
Angry Turtle is a local-SEO management tool. Businesses and the agencies that work for them use it to manage their Google Business Profile listings.
If you are a business whose listing an agency manages using this tool, that agency decides what happens to your data and we act on their instructions. Contact them first; we will help them respond.
What we collect
- Account details — name, email, and a hashed password. We never store your password in a form we can read.
- Business listing data — whatever your Google Business Profile contains: name, address, phone, hours, categories, photos and descriptions.
- Reviews — the text, star rating and reviewer name that Google publishes on your listing, together with any reply you send.
- Usage — which features you use and how much, so we can meter plan limits and bill correctly.
- Billing — name, email and payment records. Card details go directly to our payment provider and never reach our servers.
- Security records — sign-ins, permission changes and administrative actions, so we can investigate if something goes wrong.
Reviews written by other people
Reviews on your listing were written by members of the public, and they carry the reviewer's name as Google publishes it. We store them so you can read and answer them.
Where we keep a record of what a review said on a given day — to detect a review being removed or altered — we store a one-way fingerprint of the text rather than the text itself. It is enough to prove something changed, without keeping a second copy of what someone wrote.
Who else sees your data
These are the only third parties that receive it, and what each one gets.
| Who | Why | What they receive | Where |
|---|---|---|---|
| Google — Business Profile API | Reading and updating the business listings a customer has connected. | Listing details, reviews and the replies a customer publishes. Reviewer names and review text as Google supplies them. | United States and other Google regions |
| Google — OAuth and identity | Authorising the connection to a customer's Google Business Profile. | The Google account identifier and email of whoever authorises the connection. | United States and other Google regions |
| Google — Places API | Finding competing businesses near a listing. | The listing's coordinates and category. No customer personal data is sent. | United States and other Google regions |
| SearchApi.io | Checking where a listing ranks in local search results. | The search phrase, a location, and the business name being looked for. | United States |
| Razorpay | Taking payment and issuing receipts. | Billing name, email and payment details. Card details go directly to Razorpay and are never stored by us. | India |
We do not sell your data, and we do not share it for advertising.
How long we keep it
- Your account and listings — for as long as your account exists. If your plan lapses your account becomes read-only; nothing is deleted.
- Technical error logs — 30 days.
- Routine activity records — 180 days.
- Security and administrative records — kept longer, because "who had access to this account" does not stop mattering.
- Billing records — kept as long as tax law requires, even after you ask us to delete everything else. We cannot lawfully remove these on request.
Your rights
You can ask us to give you a copy of your data, correct it, or delete it. We can produce a complete machine-readable export, and a deletion that removes every row we hold about you apart from the billing records described above.
Ask by writing to the address below. We will confirm who you are first — a deletion request we act on without checking is one anybody could send.
Google account access
When you connect a Google Business Profile you authorise us to read and update those listings on your behalf. We hold the resulting access credentials encrypted, and we use them only for actions you have asked for.
Nothing is published to your live listing automatically. Every change that reaches Google — a review reply, a post, a listing edit — happens because someone pressed a button.
You can disconnect at any time from the listing's settings, or revoke our access directly from your Google account. Either takes effect immediately.
Security
Access credentials and payment configuration are encrypted at rest. Each customer's data is isolated at the database query level rather than by application code remembering to filter, and that isolation is verified by automated tests on every change.
Contact
Write to support@angryturtle.ai.
Last updated: version 2026-08-05.