Privacy Policy

This Privacy Policy describes how Reach("Reach by Locus", "we", "us", or "our"), a product operated by Growthnomics Technologies Private Limited, a company incorporated in India with its registered office at 309, UCT-2, Sector 45, Gurugram, Haryana 122003, India, collects, uses, stores, and protects your information when you use the Reach web app, the Reach mobile app, and related services (together, the "Service").

Reach is the consumer (B2C) product line of Locus Intelligence. By using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.

1. Information we collect

1.1 Information you provide to us

Account information: your name, email address, phone number, and business name when you create an account or contact us. Accounts are created and authenticated through Clerk, our authentication provider.
Business information: details about your business such as its category, locations, opening hours, photos, services, and offers that you add or edit through the Service.
Website content: the text, images, section layout, theme, and public address (slug) of the booking website you build and publish in Reach.
Availability and booking settings: your weekly hours, date overrides, and default appointment durations.
Communications: messages you send us by email or through forms in the Service.

1.2 Information about your customers

When someone books an appointment or sends an enquiry through your Reach booking page, we process their name, phone number, email address, and any message or booking details they submit, so that we can show you the lead and notify them about their booking. You are the owner of this customer data and are responsible for handling it lawfully. We process it on your behalf to operate the Service.

1.3 Information collected automatically

Usage data: pages visited, features used, and actions taken within the Service.
Device and log data: IP address, browser or mobile device type, operating system, referring URLs, and timestamps.
Cookies and similar technologies: we use cookies for sign-in and session management, and may use analytics tools to understand how the Service is used. You can control cookies through your browser settings.

2. Google user data

Reach connects to your Google Business Profile through official Google APIs (including the Google Business Profile APIs) using Google's secure OAuth 2.0 sign-in. We never see or store your Google password.

2.1 What Google data we access

With your explicit consent during Google sign-in, Reach accesses only the data needed to provide the Service, which may include:

Your basic Google account profile (name, email address) to create and identify your Reach account;
Your Google Business Profile information: business name, address, phone number, hours, categories, attributes, and photos;
Customer reviews on your Business Profile and your replies;
Posts, updates, and offers published to your Business Profile;
Performance insights for your Business Profile, such as views, searches, calls, and direction requests;
Search terms and local ranking data associated with your Business Profile, used to show your keyword and competitor positions.

2.2 How we use Google data

We use this data solely to provide and improve the Service for you:

Displaying your profile, reviews, posts, and insights in your Reach dashboard;
Publishing the replies, posts, and profile edits you create or approve;
Calculating your profile health score, keyword positions, and recommendations;
Pointing your Business Profile at your published Reach booking website, when you ask us to;
Sending you the alerts and summary reports you have enabled.

2.3 How we store and protect Google data

Google user data is stored on secure, access-controlled servers and encrypted in transit (TLS) and at rest. Access within our team is limited to personnel who need it to operate and support the Service.

2.4 Sharing of Google data

We do not sell Google user data. We do not share it with third parties except: (a) with service providers (such as cloud hosting) acting on our behalf under confidentiality obligations and only as necessary to operate the Service; (b) when required by law; or (c) with your explicit consent.

2.5 Limited Use disclosure

Reach's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not use Google user data for advertising, we do not sell it, and we do not allow humans to read it except with your consent, for security purposes, to comply with law, or where necessary to operate the Service.

2.6 Revoking access and deleting Google data

You can disconnect Reach from your Google account at any time from within the Service or via your Google account's security settings. When you disconnect or delete your Reach account, we delete the Google user data associated with your account within 30 days, except where retention is required by law. See section 7 for how to delete your account.

3. How we use your information

To provide, maintain, and improve the Service;
To set up and manage your account and subscription;
To deliver bookings and enquiries from your customers to you, and to notify your customers about their bookings;
To respond to your enquiries and provide customer support;
To send service communications such as alerts, reports, and important notices about your account;
To send product updates or marketing communications where you have opted in (you can unsubscribe at any time);
To monitor usage, prevent abuse, and keep the Service secure;
To comply with legal obligations.

4. Legal bases for processing

We process personal information on the following bases: performance of a contract (providing the Service you signed up for), your consent (for example, connecting your Google account or receiving marketing emails), our legitimate interests (improving and securing the Service), and compliance with legal obligations, consistent with applicable law including India's Digital Personal Data Protection Act, 2023.

5. Service providers and sharing

We do not sell your personal information. We share information only with the providers that run the Service, each bound by confidentiality and data-protection obligations:

Clerk — account sign-up, sign-in, and session management;
Google — Business Profile data, as described in section 2;
Dodo Payments — subscription payments. Card and payment credentials are handled by Dodo Payments and are never stored on our servers;
DigitalOcean Spaces — storage for the photos and media you upload;
Cloud hosting and email delivery providers — running the Service and sending booking and account emails;
Locus Intelligence / Growthnomics group entities — internal operations, under this same policy;
Legal authorities — when required by law, court order, or to protect our rights, our users, or the public;
A successor entity — in connection with a merger, acquisition, or sale of assets, in which case this policy continues to apply to your data.

6. Data retention

We retain personal information for as long as your account is active or as needed to provide the Service, and afterwards only as long as necessary for legitimate business or legal purposes. Google user data is deleted as described in section 2.6.

7. Deleting your account

You can delete your Reach account and its data at any time. In the Reach mobile app, open Account and choose Delete account. You can also request deletion by email, as described below.

Deleting your account removes your business profile, connected Google credentials, reviews and post history, leads and bookings, published website content, and uploaded media from the Service within 30 days, except where we are required by law to retain records (for example, tax and payment records). You can also request deletion by emailing hello@locus-intelligence.com from the address on your account.

8. Your rights

Depending on applicable law, you may have the right to access, correct, update, port, or delete your personal information, to withdraw consent, and to object to or restrict certain processing. To exercise any of these rights, email hello@locus-intelligence.com. We will respond within a reasonable timeframe and as required by law.

9. Security

We use industry-standard administrative, technical, and physical safeguards to protect your information, including encryption in transit and at rest, access controls, and regular review of our practices. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. International data transfers

Your information may be processed on servers located outside your state or country, including by our service providers. Where we transfer data internationally, we take steps to ensure it receives an adequate level of protection consistent with this policy and applicable law.

11. Children's privacy

The Service is intended for business owners and is not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

12. AI assistants and connectors

Reach offers a connector, built on the Model Context Protocol (MCP), that lets an AI assistant you choose, such as Claude, ChatGPT, or a coding agent, read your Reach data and, when you ask it to, make changes for you. Nothing is shared with an assistant until you add the connector to it and approve access.

12.1 What is sent to your assistant

When your assistant calls a Reach tool, the tool's result is sent to that assistant. Depending on the tool, this can include your public Business Profile content, reviews with reviewer names and your replies, posts and photo links, rankings with competitor names and ratings, aggregate profile metrics, recommendations, your plan and usage, and your leads and bookings.

In leads and bookings, your customers' phone numbers are masked to their last 4 digits, including phone numbers typed into notes. Customer names and email addresses are sent unmasked so that you can act on a lead. Sending your customers' information to an assistant is your decision as the owner of that data (see section 1.2).

Once data reaches your assistant, the assistant provider handles it under its own terms and privacy policy, not this one. We do not control how an assistant provider stores or uses it, so review the provider's terms before you connect.

If you ask your assistant to request a Reach feature, only your request is sent. Reach notifies our team using the account details it already holds, such as your account email and business name.

12.2 What Reach records

Reach stores a record of each tool call (the tool, the assistant that made it, the time, and the outcome) and shows it to you in the activity log under Settings → AI Connectors.

The results of tools that only read data are not stored. When a tool makes a change, Reach stores its result so that a retried call returns the same result instead of repeating the change.

12.3 Sign-in and access tokens

Your assistant connects through OAuth sign-in and never sees your password. It acts as you, with the same locations, plan limits, and permissions you have in Reach. Access tokens that Reach issues to an assistant are stored only as SHA-256 hashes, never in readable form.

12.4 Changes to your Google Business Profile

A connected assistant can change your public Google Business Profile, for example by editing profile details, adding photos, publishing a post, or replying to a review, only through Reach's tools and only while acting on your account. The result sent back to your assistant shows each change before and after, and each change is recorded in your activity log with the assistant that made it.

Changes made through a connected assistant are made on your instructions and are your responsibility. Reach is not responsible or liable for changes an assistant makes to your profile or account. See our Terms.

12.5 Disconnecting an assistant

Under Settings → AI Connectorsyou can block one assistant, or every assistant at once. A block applies from the assistant's next request, is checked again right before any change to your Google Business Profile, and stays until you lift it in Reach. If Reach cannot confirm whether an assistant is blocked, it refuses the request.

12.6 Google user data

Google user data that reaches your assistant through Reach remains subject to section 2, including the Limited Use disclosure in section 2.5.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, provide additional notice (such as email or an in-product message). Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

14. Contact us

If you have questions about this policy or our data practices, contact:

Growthnomics Technologies Private Limited
Attn: Privacy — Reach by Locus
309, UCT-2, Sector 45, Gurugram, Haryana 122003, India
Email: hello@locus-intelligence.com