LocalGrid Network ("LocalGrid", "we", "us") is a tool for marketing agencies and multi-location businesses to manage Google Business Profiles, reviews and local search performance. This policy describes what we collect, why, where it goes and how to get it back or delete it.
It is written against what the software actually does. Where a section names a database field, a scope or a provider, that is the real one.
Who we are. LocalGrid Network is operated by Aemorph, 34 South Bridge Road, #03-01 LEAGOO Building, Singapore 058668. Contact us at dom.orcajada@aemorph.com for any question about this policy, or to exercise any right described below.
1. Two kinds of people in this policy
The distinction matters, because the rights and the routes differ.
- Users — people who sign in to LocalGrid: agency staff, brand managers, business owners. You gave us your data directly.
- Data subjects in the content you manage — chiefly the people who leave Google reviews on the profiles you manage. We hold their data because Google published it on your profile and you asked us to show it to you. We never obtained it from them and we do not contact them.
2. What we collect
Account and identity
Authentication is handled by Clerk. Clerk holds your email address, name, password or social-login identity, and session records. LocalGrid stores your Clerk user ID and your role within your workspace; we never see or store your password.
Requests to join the Community tier
If you ask to join the Community tier on the request form, we store the name, email address and note you give, the time, and what an admin did with it (invited or dismissed). Aemorph staff read it to decide on your request and send an invite. Ask us to delete it at any time.
Workspace and business data
You, or an import you trigger, put the following into our database:
| What | Fields |
|---|---|
| Organizations | Workspace name, operating model, link to your Clerk organization |
| Clients | Client name, industry, primary contact, health score |
| Locations | Business name, store code, street address, city, state, postcode, phone, website, categories, opening and holiday hours, attributes, verification and sync status, Google Maps place ID, Search Console property |
| Reviews | Reviewer display name, reviewer avatar URL, star rating, review text, our sentiment classification, any AI-drafted reply, the reply actually published, and which of your users published it |
| Posts | Scheduled Business Profile posts and their status |
| Performance | Search Console clicks, impressions, CTR, average position, daily trends, top queries; geo-grid rank scans |
| Usage counters | Per-organization, per-day counts of calls to paid APIs, used only to enforce spending limits |
Google connection
When you connect a Google account we store, against your workspace: the email address of the connected Google account, the granted scopes, the Business Profile account names you gave us access to, the token expiry, and the access and refresh tokens — encrypted, never in plain text. See section 5.
3. Google user data — what we request and why
LocalGrid requests these OAuth scopes and no others:
| Scope | What we do with it |
|---|---|
.../auth/business.manage |
Read the Business Profile locations you manage; read reviews and publish your replies; publish the posts you schedule; update listing details you edit in LocalGrid. We act only on profiles you selected. |
.../auth/webmasters.readonly |
Read Search Console performance for the properties tied to your locations: clicks, impressions, position, queries. Read-only — we cannot change anything in Search Console. |
.../auth/userinfo.email |
Show you which Google account is connected, so you can tell one client's connection from another's. |
.../auth/userinfo.profile |
Basic profile display only. |
Limited Use commitment
LocalGrid Network's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Specifically, we do not:
- transfer or sell Google user data to advertising platforms, data brokers or information resellers;
- use Google user data to serve advertising of any kind;
- allow humans to read Google user data, except with your explicit consent for a specific support request you raised, where required by law, or on aggregated anonymised data for security and abuse prevention;
- use Google user data to train generalised artificial-intelligence or machine-learning models.
Artificial intelligence
When you ask LocalGrid to draft a review reply or a post, the review text and the business details needed for context are sent to Google Gemini to generate that draft. Drafts are shown to you for approval; nothing is published to a Google Business Profile until one of your users approves it. We do not use your data, or Google user data, to train any model — ours or anyone else's.
4. Why we may process your data (legal bases)
- Contract — to provide the service you signed up for.
- Legitimate interests — keeping the service secure, preventing abuse, enforcing usage limits, and diagnosing faults.
- Consent — connecting a Google account. You may withdraw it at any time (section 8) without affecting the rest of your account.
- Legal obligation — where we must retain or disclose data by law.
5. How we protect it
- Google tokens are encrypted before they are stored, using AES-256-GCM. The encryption key is held by the application, never by the database. A database backup, or a leaked database credential, therefore yields ciphertext rather than usable Google tokens.
- Tenant isolation is enforced at more than one layer. Every data access is scoped to your organization in the application layer; the database additionally denies access by default, and key relationships carry the organization on the foreign key itself, so a row cannot reference another tenant's record.
- Encryption in transit — HTTPS/TLS everywhere.
- Access control — roles determine what each member of your workspace can see and do.
- No system is perfectly secure. If a breach affects your data, we will notify you and any regulator we are required to notify, without undue delay.
6. Who else processes it
We do not sell your data and we do not share it for advertising. We use these sub-processors to run the service:
| Provider | Purpose | Data involved |
|---|---|---|
| Clerk | Authentication and workspace membership | Identity, sessions |
| Supabase | Database hosting (PostgreSQL) | All workspace data |
| Vercel | Application hosting | Request and error logs |
| Business Profile and Search Console APIs | Google user data, per section 3 | |
| Google Gemini | AI drafting of replies and posts | Review text and business context, on request |
| DataForSEO | Geo-grid rank tracking | Business name, location coordinates, search terms |
| Bing Places | Directory publishing, where you enable it | Listing details you publish |
We may also disclose data where required by law, or to a successor entity in a merger or acquisition — in which case this policy continues to apply until you are told otherwise.
7. International transfers
Our providers operate globally, and your data may be processed outside your country, including in the United States and Singapore. Where required, transfers rely on Standard Contractual Clauses or an equivalent lawful mechanism. Governing law and jurisdiction: Singapore.
8. Your choices and rights
Disconnecting Google
Open Sync Google Profile in the LocalGrid header and choose Disconnect. This deletes the stored access and refresh tokens immediately. You can also revoke LocalGrid independently at myaccount.google.com/permissions, which takes effect whether or not you tell us.
Access, correction, export and deletion
Subject to your local law — which in many places includes the GDPR or the CCPA — you may ask us to give you a copy of your data, correct it, delete it, restrict or object to its processing, or export it in a portable format. Email dom.orcajada@aemorph.com and we will respond within 30 days. We will not charge you or degrade your service for asking.
Deleting your workspace
Ask us to delete your workspace and we remove its organization, clients, locations, reviews, posts, performance history and Google connection. Backups are overwritten on their normal cycle, within 30 days.
Review data
Reviewer names and review text originate on Google, not with us. Deleting a review in LocalGrid removes our copy; the review itself remains on Google and is governed by Google's own policies.
9. How long we keep it
- Workspace data — while your account is active, then deleted on request or within 90 days of account closure.
- Google tokens — until you disconnect or revoke, then deleted.
- Usage counters — rolling, retained for billing and abuse prevention.
- Logs — retained by our hosting provider on their standard schedule, typically 30 days.
10. Children
LocalGrid is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe we have, tell us and we will delete it.
11. Cookies
We use cookies and equivalent browser storage only to keep you signed in and to remember interface preferences such as your selected tab. We set no advertising or cross-site tracking cookies.
12. Changes
If we change this policy materially we will update the date above and notify workspace owners by email before the change takes effect. Continuing to use LocalGrid after that date means you accept the revised policy.
13. Contact
dom.orcajada@aemorph.com
Aemorph, 34 South Bridge Road, #03-01 LEAGOO Building, Singapore 058668
If you are in the EEA or the UK and believe we have not resolved your concern, you may complain to your local supervisory authority.