Draft — pending legal review
This document is a working draft for launch readiness. It is not the final approved legal text.
Last updated: 23 July 2026
Privacy Policy
This draft explains what information Locaplex handles, why it is needed, and the choices available to users and other people whose data appears in the service.
Data we collect
We process account and user information such as names, email addresses, roles, language preferences, and authentication records. When an account connects Google, we store encrypted OAuth access and refresh tokens, granted scopes, and connection details. The service may also process business profiles, locations, reviews and replies, rankings, citations, website content, survey questions and responses, uploaded media, AI prompts and outputs, and operational records such as job status, audit logs, error reports, device or request details, and IP addresses.
How and why we use data
We use this information to provide and secure Locaplex, authenticate users, keep tenant data separated, connect requested services, run local SEO workflows, send transactional messages, answer support requests, monitor reliability, prevent abuse, and improve the product. Depending on the context, processing is intended to rely on performance of a contract, legitimate interests in operating and protecting the service, consent where required, or compliance with legal obligations. We do not intend to sell personal data.
Service providers and data transfers
We use Hetzner infrastructure managed through Dokploy for hosting; Resend for transactional email; Sentry for error monitoring; DataForSEO and Google for business-profile, search, and local SEO data; and configured AI providers for AI features requested by users. These providers may act as processors on our behalf or process information under their own terms, depending on the service. Data may be handled outside your country. Where applicable law requires it, appropriate transfer safeguards should be used. Provider accounts and final contractual terms remain subject to launch review.
Retention and deletion
We intend to keep personal data only for as long as needed to provide the service, maintain security and audit records, resolve disputes, and meet legal obligations. Retention depends on the type of record, the account relationship, and whether an active integration or support matter remains. Verified deletion requests will be handled manually until self-service export and deletion tools are available. Some information may remain for a limited period in backups or where law requires retention, after which it should be deleted or anonymized.
Security
Locaplex uses measures designed to protect data, including tenant and location scoping, access controls, encrypted stored OAuth tokens, restricted production configuration, logging controls, and backups. No online service can guarantee absolute security. Users must protect their credentials and notify us promptly if they suspect unauthorized access.
Your privacy rights
Depending on where you live and the legal basis for processing, you may have rights to information, access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent or complain to a data protection authority. Until automated export and deletion endpoints are available, send requests to admin@otospex.com. We may need to verify your identity and account authority before acting. Some rights have legal exceptions, including records that must be retained.