Privacy Policy

1. Information We Collect

1.1 Account Information

When you create an account or sign in with a third-party provider (Google, Microsoft), we collect:

• Email address — used as your unique identifier and for transactional communications.
• Full name — displayed in your profile and used for personalisation.
• Profile image / avatar URL — sourced from your Google or Microsoft account when you use OAuth sign-in.
• Phone number — optionally provided during registration; used for account recovery and WhatsApp integration if enabled.

1.2 Usage Data

We automatically record information about how you use the Service, including:

• Search queries you submit (business type, location, radius).
• Search results and business leads you save or export.
• Notes and status labels you attach to leads.
• Subscription plan and payment status (we do not store full card details).
• IP address, browser type, and device information for security and analytics.

1.3 Payment Information

Payments are processed by Razorpay. We store only the Razorpay order ID and payment status. Full card numbers and bank details are never transmitted to or stored on our servers.

1.4 Integration Credentials

If you connect WhatsApp Business via our Integrations page, we store your WhatsApp API token and webhook verification token in our database, encrypted at rest.

2. How We Use Your Information

We use the information we collect to:

• Provide and improve the Service — process searches, display results, and personalise your dashboard.
• Authentication — verify your identity when you sign in and maintain your session.
• Communication — send transactional emails (OTP verification, payment receipts, plan change confirmations). We do not send marketing emails without your explicit consent.
• Subscription management — track your plan limits, search quotas, and billing cycle.
• Security & fraud prevention — detect suspicious activity and protect your account.
• Analytics & product improvement — understand aggregated usage patterns to improve features (data is anonymised where possible).
• Legal obligations — comply with applicable laws, regulations, or lawful government requests.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

3. Third-Party Services

We rely on the following third-party providers to operate the Service. Each has its own privacy policy.

When you choose to sign in with Google or Microsoft, those providers may share your name, email address, and profile picture with us as part of the authentication flow. We use this data only to create or update your GrabNear account.

3a. GrabNear Chrome Extension

The GrabNear Chrome Extension ("Extension") is a browser extension available on the Chrome Web Store that extracts publicly visible business information from Google Maps search result pages.

What the Extension accesses

• Google Maps page content — the Extension reads publicly visible business listings on Google Maps (business name, phone number, address, website, rating, category, and photos) directly from the page DOM. This is the same information any visitor to Google Maps can see.
• GrabNear authentication token — when you are signed into GrabNear, the Extension reads your session token from your browser's local storage on grabnear.com. This token is stored locally in chrome.storage.local and is used solely to authenticate API requests when saving leads to your GrabNear account.

What the Extension does NOT do

• Does not collect, transmit, or store any personal data about the user (beyond the authentication token described above).
• Does not track browsing history or activity outside of Google Maps pages.
• Does not run any remote code — all JavaScript is bundled within the Extension package.
• Does not share any data with third parties. Extracted business data is sent only to your own GrabNear account via our API, or saved locally as a CSV file.

Data flow

When you click "Save to GrabNear", the extracted business listings (name, phone, address, website, rating, image URL) are sent via HTTPS to the GrabNear API and stored in your account. When you click "Export CSV", the data is saved directly to your local device — no server is involved.

Permissions used

• storage — stores your GrabNear login token locally.
• tabs / activeTab / scripting — detects Google Maps pages and reads business listing data from the DOM.
• downloads — saves CSV exports to your device.
• Host access (google.com, grabnear.com) — required to read Google Maps listings and communicate with the GrabNear API.

3a. Google User Data — Permissions, Sharing & Disclosure

GrabNear requests Google user data in two separate flows, each with distinct permissions:

A. Google Sign-In (Authentication)

When you sign in with Google, we request the following OAuth scopes:

• openid — confirms your identity
• email — your Google email address, used as your GrabNear account identifier
• profile — your full name and profile picture, displayed in your account

This data is used only to create or update your GrabNear account and to authenticate your sessions. It is not used for advertising, profiling, or any unrelated purpose.

B. Google Calendar Integration (Optional)

If you choose to connect your Google Calendar from the Integrations page, we request the following additional OAuth scope:

• https://www.googleapis.com/auth/calendar.events — allows GrabNear to create, read, update, and delete calendar events on your primary Google Calendar. This is used exclusively to add, update, or remove follow-up reminder events when you mark a business lead as "Follow Up" in GrabNear.

We do not read, store, or process the contents of your existing Google calendar events. We only write/manage events that GrabNear itself creates (follow-up reminders). Google Calendar access is entirely optional — the core Service works without it.

Your Google Calendar OAuth access token and refresh token are stored encrypted in our database (Supabase) and are used solely to perform the calendar actions described above. You can revoke Google Calendar access at any time from the Integrations page or from your Google Account permissions.

C. Microsoft (Outlook) Calendar Integration (Optional)

If you choose to connect your Microsoft Outlook Calendar from the Integrations page, we request the following Microsoft OAuth scopes:

• https://graph.microsoft.com/Calendars.ReadWrite — allows GrabNear to create, read, update, and delete calendar events in your Microsoft/Outlook Calendar. This is used exclusively to add, update, or remove follow-up reminder events when you mark a business lead as "Follow Up" in GrabNear.
• offline_access — allows GrabNear to refresh your access token without requiring you to re-authenticate each time, so your calendar integration stays connected.

We do not read, store, or process the contents of your existing Outlook calendar events. We only write/manage events that GrabNear itself creates (follow-up reminders). Microsoft Calendar access is entirely optional — the core Service works without it.

Your Microsoft OAuth access token and refresh token are stored encrypted in our database (Supabase) and are used solely to perform the calendar actions described above. You can revoke Microsoft Calendar access at any time from the Integrations page or from your Microsoft Account app permissions.

With whom we share Google user data

We do not sell, rent, or share Google user data with any third party, except in the following limited circumstances:

• Supabase — our database and authentication provider stores your email, name, avatar URL, and (if calendar is connected) your OAuth tokens to maintain your account and calendar integration. Supabase processes this data on our behalf and does not use it for independent purposes. (Supabase Privacy Policy)
• Google Calendar API — when creating or managing follow-up events, our backend sends requests to Google's Calendar API using your access token. No data beyond the event details (lead name, follow-up date) is transmitted.
• Microsoft Graph API — if you connect your Outlook Calendar, our backend sends requests to Microsoft's Graph API using your access token to create or manage follow-up events. No data beyond the event details (lead name, follow-up date) is transmitted. (Microsoft Privacy Statement)
• Google Cloud Run — our backend infrastructure hosted on Google Cloud processes all API requests. Google processes infrastructure data solely to operate the hosting environment. (Google Cloud Privacy Notice)
• Legal obligations — we may disclose your data if required by law, court order, or lawful government request.

No other third parties receive, access, or process your Google user data. Google user data is never transferred to data brokers, advertisers, or analytics platforms.

3b. Google API Limited Use Disclosure

GrabNear's use of information received from Google APIs adheres to the Google API Services User Data Policy , including the Limited Use requirements.

Specifically:

• We only request Google account data and Calendar access that is strictly necessary for the features described above.
• We do not use Google user data to serve advertisements.
• We do not use Google Calendar or Microsoft Calendar data for any purpose other than creating and managing follow-up reminders at the user's request.
• We do not allow humans to read your Google or Microsoft calendar data unless you have given explicit permission, it is necessary for security purposes, or it is required by law.
• We do not transfer Google user data to third parties except as described in section 3a above.
• We do not use Google data to develop, improve, or train generalized AI or machine learning models.

4. Cookies & Sessions

GrabNear uses the following types of browser storage:

• Authentication session (localStorage) — Supabase stores a JWT access token and refresh token in your browser's localStorage. This token is used to authenticate your requests and is automatically refreshed. It is cleared when you log out.
• Strictly necessary cookies — set by Cloudflare (our DNS/CDN provider) for DDoS protection and load balancing. These do not track you across websites.
• Analytics cookies — we use Google Analytics (GA4) to understand aggregate usage patterns such as page visits and session duration. This helps us improve the product. Google Analytics may set cookies on your device. You can opt out via Google's opt-out tool.
• Advertising cookies (Google AdSense) — our blog pages (grabnear.com/blog) use Google AdSense to display advertisements. Google AdSense may set cookies and use device identifiers to serve personalised ads based on your browsing activity. These cookies are set by Google (a third party) and governed by Google's Privacy Policy. You can opt out of personalised ads at google.com/settings/ads or via aboutads.info.

We use a cookie consent banner to obtain your consent before any non-essential cookies are placed. You can withdraw your consent at any time by clearing your browser cookies.

4a. Third-Party Advertising (Google AdSense)

We use Google AdSense to display advertisements on our blog pages. Google AdSense is a service provided by Google LLC. As a third-party vendor, Google uses cookies (including the DoubleClick cookie) to serve ads based on your prior visits to our website and other websites on the internet.

Key points about how Google AdSense works on our site:

• Google may use the DoubleClick cookie to serve ads based on your visits to this and other websites.
• Third-party vendors and ad networks may also use cookies to serve ads on our site.
• We do not control these cookies — they are governed by Google's own privacy policies.
• You can opt out of personalised advertising by visiting Google Ads Settings.
• You can also opt out of third-party vendor ad cookies by visiting www.aboutads.info.

If you would prefer not to see personalised ads, you can disable personalised advertising in your Google account settings or use browser extensions that block advertising cookies.

5. Data Retention

• Account data (name, email, profile) — retained for as long as your account is active. You may request deletion at any time.
• Search history and leads — retained for the lifetime of your account. You can manually delete individual searches or leads from your dashboard.
• Payment records — retained for 7 years as required by Indian GST regulations.
• Server logs — retained for up to 30 days for security and debugging, then automatically purged.
• Deleted accounts — personal data is removed within 30 days of account deletion, except where retention is required by law.

6. Security

We implement reasonable technical and organisational measures to protect your data, including:

• All data in transit is encrypted via TLS/HTTPS.
• Database and credentials are stored with Supabase, which encrypts data at rest.
• API keys and integration tokens are stored encrypted.
• Access to production systems is restricted to authorised personnel.

No method of transmission over the internet is 100% secure. If you believe your account has been compromised, contact us immediately at support@grabnear.com.

7. Your Rights

Depending on your location, you may have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — request that we delete your account and personal data ("right to be forgotten").
• Portability — receive your data in a machine-readable format.
• Withdraw consent — opt out of any non-essential data processing at any time.

To exercise any of these rights, email us at support@grabnear.com. We will respond within 30 days.

8. Children's Privacy

GrabNear is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email. Continued use of the Service after changes constitutes acceptance of the updated policy.

10. Contact Us

If you have questions or concerns about this Privacy Policy, please reach out: