Privacy Policy

1. Who we are

Rakho ("we", "our", or "the app") helps business owners submit business details and create or manage a location on Google Business Profile using Google's official APIs. This Privacy Policy explains what information we handle and how we use it.

2. Information we collect

• Business details you enter — name, category, phone, website, address, hours, description, and related listing fields.
• Media you upload — such as logo, cover, or additional photos — to attach to your Google location.
• Google account data — when you sign in with Google we receive OAuth tokens and basic profile details (such as email) needed to call Google Business Profile APIs on your behalf.
• Session & audit data — connection state, selected Business Profile account, listing status, and operational logs needed to run the product securely.

3. How we use information

• To save your draft and show progress in your workspace.
• To authenticate with Google and create, update, or attach media to a Business Profile location using official APIs.
• To show connection, listing, and verification status.
• To secure the service, prevent abuse, and debug failures.

We do not sell your personal information. We do not use Google user data for advertising or for training generalized AI/ML models.

4. Google user data & Limited Use

Rakho requests the business.manage scope (plus basic OpenID email/profile scopes) so we can manage Business Profile resources you authorize.

Google OAuth tokens are stored encrypted server-side and are not exposed to client-side JavaScript. You can disconnect in the app and revoke access anytime in Google Account permissions.

Our use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements: we only use Google user data to provide or improve user-facing features that are prominent in Rakho's interface.

5. Cookies & similar tech

We use essential cookies (for example a session id and short-lived OAuth state) so login and listing flow work. See our Cookie Policy for details. We do not use third-party advertising cookies.

6. Storage & retention

Session, credentials, business drafts, location records, and audit events are stored on our servers (or ephemeral storage on some hosts). Tokens and related secrets are encrypted at rest where configured. Data sent to Google is retained by Google under Google's policies. You can request deletion of Rakho-held data — see Data deletion.

7. Sharing

We share data with Google solely to perform the listing actions you request. We do not sell or share your information with third parties for marketing. Hosting/infrastructure providers may process data only to run the service.

8. Security

We use OAuth, httpOnly session cookies, and encryption of stored credentials where enabled. No internet transmission is perfectly secure — use a trusted device and network.

9. Your choices

• Log out / disconnect Google in Rakho.
• Revoke Rakho in your Google Account settings.
• Request deletion of data we store — Data deletion.

10. Children

Rakho is for business owners and operators. It is not directed at children under 13, and we do not knowingly collect their data.

11. Changes

We may update this policy. The "Last updated" date above reflects the latest version.

12. Contact

Privacy questions: email privacy@rakho.app (or the support address provided for your deployment).