Privacy Policy

• Account data — name, email, and organization details you provide when signing up.
• Business data — locations, team members, coupon codes, review content, and replies you create or import into Poppr.
• Google Business Profile data — when you connect Google, we access reviews and location metadata under the scope you approve, and store an encrypted refresh token so we can sync on your behalf.
• Billing data — handled by our payments processor (Stripe). We store subscription status and identifiers, not full card numbers.
• Usage data — basic logs (IP, browser, timestamps) needed to operate and secure the service.

• Provide and improve the Poppr service and its features.
• Sync reviews and post replies to your connected Google Business Profile locations at your direction.
• Authenticate users and secure accounts.
• Process subscriptions and per-location seat billing.
• Communicate about your account, changes, and support.

We rely on the following providers to run Poppr:

• Lovable Cloud — application hosting, database, and authentication.
• Stripe — subscription billing and payment processing.
• Google (Business Profile API) — review and location data you connect.

Poppr's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only request scopes needed to read your locations and reviews and to post replies you initiate. We do not sell Google user data, use it for advertising, or share it with third parties other than the subprocessors listed above needed to run the service. You can disconnect Google at any time from the Locations page, which removes our stored refresh token.

We retain your account and business data for as long as your organization is active. You can delete individual records in-app. On account deletion, we remove or anonymize personal data within a reasonable period, except where retention is required for legal, accounting, or security purposes.

We use industry-standard practices including TLS in transit, encrypted storage of OAuth refresh tokens, row-level authorization in our database, and least-privilege access for staff. No system is perfectly secure; please use a strong password and keep your credentials safe.

• Access, correct, or delete your account data from within Poppr.
• Disconnect Google Business Profile at any time.
• Cancel your subscription from the Billing page.
• Contact us to exercise privacy rights available in your jurisdiction.

We use strictly necessary cookies and local storage to keep you signed in and remember preferences. We do not use third-party advertising cookies.

Poppr is a B2B product not directed to children under 13, and we do not knowingly collect personal information from them.

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

Questions or privacy requests: privacy@getpoppr.com.