Privacy Policy

Application and Google data

Application: Alex-Digital
Operated by: PT Klimov Advertising Agency
Google permission: https://www.googleapis.com/auth/business.manage
Application and privacy support: psihopaat@gmail.com

Alex-Digital is operated by PT Klimov Advertising Agency. Google Business Profile works in two stages: a client connects their Google account, selects profiles and authorizes the managed service through their client portal; our administrator manages reviews, replies, monitoring and performance in a separate staff workspace while the Reputation subscription is active. Google API access for our project is also required.

1. Who we are

ALEX-DIGITAL services are operated by PT Klimov Advertising Agency in Indonesia. We process data under our agreements with clients and applicable personal-data protection laws.

2. Data we collect

• Contact data, including name, email address, phone number, and Telegram contact.
• Advertising-account identifiers for Google, Meta, TikTok, and other connected platforms.
• Technical data, including IP address, cookies, and request logs, used to operate and secure the website.
• Advertising-platform data, including campaign statistics, spend, and creatives, only to the extent required to provide our services.

3. Purposes of processing

We use data to configure and manage advertising, prepare reports and analytics, handle billing, support clients, improve our products, and comply with connected-platform requirements.

4. Meta data (Facebook / Instagram)

When accounts are connected, we may access data through official Meta APIs, including the Marketing API. We use this data solely for analytics, reporting, and automation for the client. We do not sell personal data to third parties.

5. Sharing and retention

Data is accessible only to authorised employees and service providers required to operate the service, including hosting and email providers. Data is stored on protected servers for the period required by contract, business necessity, and applicable law.

6. Your rights

You may request access to, correction or deletion of your personal data, or restriction of processing. Contact info@alex-digital.io. We will review your request within a reasonable period, subject to applicable law.

7. Cookies

We use cookies and similar technologies for authentication, preference storage, security, and, where consent is provided, analytics.

8. Changes to this policy

We may update this policy. The current version and its update date will always be published on this page.

9. Contact and company details

PT Klimov Advertising Agency
NPWP: 39.483.059.0-905.000
Email: info@alex-digital.io
Website: alex-digital.io
Address: Jalan Sunset Road No. 28, Seminyak, Kuta, Kab. Badung, Bali, Indonesia

10. Google Business Profile: data accessed and purpose

Alex-Digital is operated by PT Klimov Advertising Agency. Google Business Profile works in two stages: a client connects their Google account, selects profiles and authorizes the managed service through their client portal; our administrator manages reviews, replies, monitoring and performance in a separate staff workspace while the Reputation subscription is active. Google API access for our project is also required.

When you choose Connect Google Business Profile, Google handles sign-in and consent. Alex-Digital does not receive your Google password. We request the business.manage permission because Google's Business Profile APIs use it for listing accessible businesses, reading reviews and performance, and creating or updating review replies. This connection does not request Gmail, Google Drive or Google Ads access.

We access business-account and location identifiers, business names and addresses to let you select locations. For selected locations we access review identifiers, reviewer display names where supplied, ratings, review text, timestamps and existing business replies. We access performance metrics supplied by Google, including Search and Maps impressions, call-button clicks, website clicks and direction requests, with their dates. Availability varies by business and reporting period.

We process authorization codes and OAuth tokens to establish and maintain the connection. We retain the refresh token in encrypted form on the server; access tokens are used for server requests. We also retain your selected location references, the portal account responsible for the connection, manager permissions and limited action receipts.

11. How Google data is used and who can see it

Google data powers the connected business's review and performance workspace. With the connection owner's explicit permission for each selected location, Reputation can monitor new and updated reviews in the background, prepare AI reply drafts and automatically publish eligible positive replies. Manual replies require confirmation. Automatic replies are off by default and require separate opt-in, selected star ratings and an active eligible subscription. Complaints, critical topics, edited reviews and uncertain cases require a person. You can stop automated processing at any time; a request already sent to Google may finish. Published replies are public on Google.

Only the portal account that connected Google can select locations, authorize or revoke the managed service, enable AI or automatic-publication permissions, and disconnect Google. With this service permission and an active subscription, our administrator may manage selected profiles and assign additional active employees to specific profiles. Assigned managers use their own staff accounts, can access only assigned profiles, and cannot expand client processing permissions or appoint other managers. The administrator can revoke individual assignments. The client can revoke all staff management access. Expiry of the subscription blocks staff operations and background processing. These permissions do not add employees as managers in Google.

Data is processed by our application hosting and database providers as needed to deliver the service. Authorized support staff may access information where needed for your support request, security or legal obligations. We do not sell Google user data. We do not share review content or reviewer identities with advertising platforms, use them for ad targeting or retargeting, or train general-purpose AI models.

Advertising integrations are separate. Viewing business performance alongside separately authorized advertising reports is for the client's reporting; it does not establish that an ad caused a review, call, visit or sale.

Our handling of Google API data follows the Google API Services User Data Policy, including its Limited Use requirements, and the applicable Business Profile API policies.

When the owner enables AI assistance, we send review text, its star rating and the owner's business rules to OpenAI to detect language, translate for the operator, identify sentiment and topics, and prepare three reply suggestions. We do not send the reviewer's Google profile name, avatar or profile identifier. Detected email addresses and phone numbers in the text are redacted, but other personal information may remain in the review text. Performance metrics are not sent to this AI feature. Requests use the API with storage disabled and are not used by us to train general-purpose models. OpenAI's applicable API data controls and abuse-monitoring retention still apply; disabling storage is not a promise of zero provider retention. See OpenAI API data controls. AI suggestions can be inaccurate and should be checked.

12. Google data security, retention and deletion

Connections use HTTPS. OAuth credentials are encrypted on the server using a key supplied separately from the connection records. Access is checked for the client workspace, selected business and, for publishing, the user's permission. The application uses expiring, single-use OAuth state tied to the initiating browser and account. Google tokens are not provided to managers or stored in the page's local storage.

The Business Profile integration retrieves Google reviews, business details and performance data on demand. It does not create a persistent archive of these API responses. Month comparisons are calculated for display from newly requested data. OAuth setup records expire after ten minutes; operational action receipts contain the acting account, time, action and outcome, without review text, and expire after thirty days.

Reputation stores the business rules and processing permissions you provide, operational review references and fingerprints, and encrypted reply drafts created for your business. Drafts expire after seven days, as do processing jobs and notification deduplication records. Action receipts expire after thirty days. A pending reply operation retains only resource references, timing and a hash of the intended reply until reconciled or disconnected. The product does not persist original Google review text, reviewer profiles, translations, performance responses or a historical archive of Google's content. Reports are calculated from newly fetched data and show their coverage. Customer-authored tasks and billing/usage records remain as portal records under the general retention provisions, and can be addressed through a verified deletion request.

Encrypted refresh credentials, selected location references and manager grants remain while the connection is active. Use Disconnect and delete connection data in the Business Profile workspace to stop local access, revoke the Google token and remove these records and related action receipts. If Google cannot be reached, local access stops and the encrypted credential is retained only to retry revocation; the interface explains that disconnect is pending.

You can also remove access in your Google Account connections. This stops future authorized Google access; use the portal disconnect action or contact us to remove the remaining connection records. Disconnecting does not remove reviews or previously published replies from Google.

For access, correction, deletion or connection support, email psihopaat@gmail.com or info@alex-digital.io, identifying your portal account and the affected business. We verify that the request comes from an authorized person. Other portal records, such as contracts and invoices, are governed by the general retention provisions above and any applicable legal requirements.

Optional Telegram notifications go only to the connection owner after opt-in. They describe agency follow-up activity, provide an open-work count where applicable and link to the client service settings; they contain no review text or reviewer identities. Review operations remain in the authenticated staff workspace.