Privacy Policy
Effective date: July 21, 2026
This policy explains how Volamo LLC ("Volamo," "we," "us") collects, uses, stores, and shares information when you use volamo.com and Volamo's products and services, including GBPLock and any service where you connect a Google account. Questions any time: support@volamo.com.
Information we collect
- Information you give us — your name, email address, business name or website, and anything you include in a form, email, or early-access signup.
- Business visibility data — publicly available information about businesses (listings, reviews, rankings, website content) that we analyze to produce reports and audits.
- Usage data — standard server logs (IP address, browser type, pages visited) used to operate and secure the site.
How we use information
- To provide, operate, and improve Volamo's services (reports, audits, monitoring, management).
- To respond when you contact us or request access to a product.
- To secure the service and comply with legal obligations.
Cookies & analytics
volamo.com uses only strictly necessary cookies/local storage needed to run the site (for example, keeping a form or session working). We do not use third-party advertising cookies or cross-site ad-tracking pixels. If we add privacy-respecting analytics in the future, this section will be updated before that change takes effect.
Google user data
Some Volamo features connect to your Google account with your explicit, per-user consent via Google OAuth. We request only the following scopes, and only for the reasons below:
- Sign-in identity (
openid,email,profile) — used to identify you, create your account, and let you sign in. We access your name, email address, and profile picture — nothing more. - Google Business Profile management
(
https://www.googleapis.com/auth/business.manage) — used only for the Business Profile(s) you explicitly choose to connect (for example, in GBPLock). This scope lets us read and update your Business Profile account and location data: business information (name, address, hours, categories, attributes), photos, posts, reviews, and performance insights. We use it solely to provide the service you asked for — monitoring your profile for unauthorized changes and suspension risks, generating audits and optimization recommendations, and (when you direct us to) keeping hours, photos, posts, and business information accurate on your behalf.
We do not sell Google user data, use it for advertising or ad targeting, or transfer it to third parties, except: (a) the service providers listed below who host and operate our infrastructure under confidentiality obligations, (b) as needed to provide the feature you enabled, (c) to comply with law or protect against fraud/security threats, or (d) as part of a merger, acquisition, or asset sale, with notice to you first. Human access to Google user data is limited to Volamo personnel who need it for support, security, or compliance.
Limited Use: Volamo's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Security
OAuth refresh tokens and other Google credentials are encrypted at rest using AES-256-GCM in Volamo's credential vault, separate from ordinary application data. Access to decrypted tokens is limited to the backend systems that need them to operate the feature you enabled, plus authorized personnel troubleshooting an issue at your request or investigating security incidents. We use industry-standard transport encryption (HTTPS/TLS) for all data in transit.
Storage, sharing & service providers
Data is stored on infrastructure operated by our service providers: Cloudflare (hosting and network), MongoDB Atlas (database), and Google Workspace (email). These providers act as our processors and only process data to help us run the service — they don't use it for their own purposes. We do not sell personal information to anyone.
Retention
We keep your data only as long as needed to provide the service or as required by law. You can revoke Google access any time at myaccount.google.com/permissions — this immediately cuts Volamo's access to your Google data going forward.
Data deletion
You can delete your Google connection and Volamo account data at any time:
- Disconnect Google — from your account settings once signed in, or by revoking access at myaccount.google.com/permissions. Volamo deletes the associated Google tokens and cached Business Profile data automatically once a disconnect is processed.
- Delete your Volamo account — use the account controls in-product once signed in, or email support@volamo.com with the subject line "Delete my data" from the account's email address.
- All deletion requests, including any stored Google user data, are honored within 30 days, and we confirm by email when it's done.
Changes
If we materially change this policy we'll update this page and the effective date above.
Contact
Privacy questions or requests: support@volamo.com