Last updated: 14 August 2026
Privacy Policy
This policy explains what information Locaplex processes, why we process it, and the choices available to users and to other people whose data appears in the service. It applies to the Locaplex application at app.locaplex.com and to the locaplex.com website.
Who we are
Locaplex is operated by Otospex Solutions LLC, 1209 Mountain Road Pl NE Ste R, Albuquerque, NM 87110, United States, which is the data controller for the personal data described in this policy. For business data that customers bring into their account — such as imported reviews, survey responses, and connected Google Business Profile content — we process that data on the customer's instructions, and the customer remains responsible for it as controller. For privacy questions and requests, contact privacy@locaplex.com. For general questions, contact admin@locaplex.com.
Data we collect
We process account and user information such as names, email addresses, roles, language preferences, and authentication records. When an account connects Google, we store encrypted OAuth access and refresh tokens, the granted scopes, and connection details such as the email address of the connected Google account. The service also processes business profiles and locations, reviews and replies, search rankings, citations, website content, survey questions and responses, uploaded media, AI prompts and outputs, and operational records such as job status, audit logs, error reports, request details, and IP addresses. When someone opens a public Locaplex review or survey link, we record the visit, the destination chosen, and the technical details needed for rate limiting. Visit records store a keyed hash of the visitor's IP address rather than the raw address, and survey responses are stored with the visit.
How and why we use data
We use this information to provide and secure Locaplex, authenticate users, keep each customer's data separated from every other customer's, connect the services an account requests, run local SEO workflows such as review management, rank tracking, audits, and surveys, send transactional messages, answer support requests, monitor reliability, prevent abuse, and improve the product. Where the GDPR or a similar law applies, we rely on performance of a contract (providing the service you signed up for), legitimate interests (operating, securing, and improving the service), consent where required (for example, when you connect a Google account), and compliance with legal obligations. We do not sell personal data, and we do not use personal data for third-party advertising.
Google user data and Limited Use
When you connect a Google Business Profile, Locaplex requests the Google OAuth scopes needed to manage business information (https://www.googleapis.com/auth/business.manage) and to identify the connected account (openid, email). We use this access only to provide features you request in the app: listing your Google business locations and mapping them to Locaplex locations, importing your business profile details and reviews, and — when you approve a reply — publishing that reply to your profile. Google user data is stored encrypted, is accessible only within your account, and is never used for advertising. We do not sell Google user data, and we do not use it to develop, improve, or train generalized artificial-intelligence or machine-learning models. When you request an AI-drafted review reply, the text of the review you are answering is sent to the configured AI provider solely to generate that draft. Our staff do not read Google user data except with your permission for support, for security and abuse investigations, or where required by law. Locaplex's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. You can disconnect Google at any time from the integration settings in the app, which revokes and deletes the stored tokens, or remove Locaplex's access in your Google Account security settings at https://myaccount.google.com/permissions. Imported Google data is then deleted as described in the retention section below.
Cookies and local storage
Locaplex uses only first-party, strictly necessary cookies and browser storage: authentication session data, your active location selection, and preferences such as language and theme. We do not set advertising cookies, and we do not run third-party analytics or tracking scripts on the application or on locaplex.com. If this ever changes, we will update this policy and request any consent the law requires before the change takes effect.
Service providers and international transfers
We share personal data with a small set of service providers, only as needed to run Locaplex: Hetzner (application hosting and databases, data centers in Germany and Finland); Netlify (hosting of the locaplex.com website); Resend (transactional email delivery); Sentry (error monitoring); Google (OAuth, the Google Business Profile API, and the Google Places API); DataForSEO (search results, publicly available review data, and rank tracking); and the AI providers used for AI features — OpenAI, Anthropic, or Google (Gemini), depending on the account's configuration. Self-hosted AI models may also be used, in which case prompts do not leave our infrastructure. These providers act as processors on our behalf or, for platform services such as Google, under their own terms. Application data is hosted in the European Union (Germany and Finland). Where personal data is transferred outside the EU/EEA — for example to providers based in the United States — we rely on recognized safeguards such as the European Commission's Standard Contractual Clauses, an applicable adequacy decision, or the EU-US Data Privacy Framework where the provider is certified.
Retention and deletion
We keep personal data only as long as needed to provide the service, maintain security and audit records, resolve disputes, and meet legal obligations. In particular: account and workspace data is kept while the account is active and deleted or anonymized within 30 days of verified account closure; encrypted Google OAuth tokens are deleted when you disconnect Google or close the account, and imported Google Business Profile data is deleted with them; operational logs and error reports are kept for up to 12 months; backups are rotated on a fixed schedule and expire within 90 days. Verified deletion and export requests sent to privacy@locaplex.com are honored even where a self-service tool is not yet available for the record in question. Records that the law requires us to keep — for example for tax, accounting, or security purposes — are retained for the legally required period and then deleted or anonymized.
Security
Locaplex protects data with measures that include tenant and location scoping enforced on every query, role-based access controls, encryption of stored OAuth tokens, encryption in transit, restricted production access and configuration, logging controls, and regular backups. No online service can guarantee absolute security. Protect your credentials, and notify us promptly at privacy@locaplex.com if you suspect unauthorized access to your account.
Your privacy rights
Depending on where you live and the legal basis for processing, you have rights to information, access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent and to complain to a data protection authority. Send requests to privacy@locaplex.com. We respond within the time limits that apply — one month under the GDPR, extendable only where the law allows. We may need to verify your identity and your authority over the account before acting, and some rights are subject to legal exceptions, including records that must be retained. If your data appears inside a customer's account — for example a review or a survey response — we may refer your request to that customer, who controls the data, and assist them in fulfilling it.
Changes to this policy
This policy is effective as of 14 August 2026 and replaces all earlier versions. If we make material changes — such as new categories of data, new providers, or new purposes — we will update this page, revise the date above, and notify active accounts in the application or by email before the change takes effect where the law requires it. Questions about this policy can be sent to privacy@locaplex.com.