Privacy Policy
Last updated: 23 October 2026
Tochky (“we”, “the service”) helps companies manage the Google Business Profiles of their locations: reviews, posts, opening hours, profile data, analytics and map visibility. This policy explains what data we receive, how we use it, where it is stored and how you can have it deleted.
1. Data we receive
- Sign-in with Google (
openid,email,profile): your email address, name and profile picture — to identify you and give you access to your company’s workspace. - Google Business Profile (
https://www.googleapis.com/auth/business.manage), granted by the person who connects a Google account that owns or manages the company’s profiles: business accounts and locations (name, address, categories, phone, website, description, hours, attributes), reviews and existing replies, posts, photos metadata, verification status, performance metrics (views, calls, direction requests, website clicks) and the search keywords Google reports for each location. - Data your users enter in Tochky: reply texts, post content and images, templates, settings, the profile data standard and comments.
- Public map data: publicly available information about places near your locations from the Google Places API (name, rating, number of reviews) and from OpenStreetMap.
- Technical data: server logs (time, path, status) kept for security and troubleshooting.
2. How we use it
Only to provide the features your company uses in Tochky: showing and answering reviews, publishing posts, updating hours and profile data at your users’ request, reports and notifications, and map-visibility advice. Tochky writes to Google only as a result of an action by your users or a rule they configured (for example, scheduled posts or approved automatic replies).
We do not sell data, do not use it for advertising, do not use it to build user profiles for third parties, and do not use Google user data to develop, improve or train generalised AI or machine-learning models.
3. Google API Services User Data Policy — Limited Use
Tochky’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. People at Tochky read Google user data only with your permission (for example, to resolve a support request), when necessary for security, or to comply with the law.
4. Service providers
- Hetzner Online GmbH — servers in Falkenstein, Germany (EU), where the service and its database run.
- Cloudflare — network delivery and protection (HTTPS); data passes through it in transit.
- Anthropic (Claude API) — if your company enables AI features, the text of a review and the location name are sent to generate a reply draft or to classify the review. Under Anthropic’s commercial terms, API inputs are not used to train its models.
- Telegram — only if your company configures notifications: short alerts about new reviews.
- Google Drive — encrypted backups of the database (encrypted before upload; the provider cannot read them).
5. Security
All traffic uses HTTPS. Google access tokens are stored encrypted. Each company’s data is isolated, and access inside a company is limited by roles and regions set by its administrator.
6. Retention and deletion
- Data is kept while your company uses Tochky.
- Disconnecting Google in Tochky settings deletes the stored access token immediately; you can also revoke access at myaccount.google.com/permissions.
- To delete your company’s data, write to [email protected] from an administrator’s address. We delete it from the live service within 30 days; encrypted backups are rotated and fully removed within 180 days.
- A user removed from a company loses access immediately.
7. Your rights
You may ask what data we hold about you, ask us to correct or delete it, or object to its processing. Write to [email protected]; we reply within 30 days.
8. Changes
We will post changes on this page and update the date above. Significant changes will be announced in the service.