Privacy Policy
Last updated: 27 August 2026
This policy explains what personal information Map Pack Machine collects when you use it, why we collect it, who we share it with, and the control you have over it. "We", "us" and "our" mean Map Pack Machine.
Map Pack Machine connects to your Google Business Profile and, if you choose, your Instagram and Facebook accounts, so it can publish content, request and reply to reviews, and report on your local search performance. That means we handle data from those platforms on your behalf. The sections below set out exactly what we access and what we do not.
Contents
- Information we collect
- Google user data and Limited Use
- Meta platform data
- Contact details you upload about your customers
- How we use information
- AI processing
- Who we share information with
- Storage, location and security
- How long we keep information
- Your rights and choices
- Deleting your data
- Cookies
- Team members
- Not for minors
- Changes to this policy
- Contact and complaints
1. Information we collect
Account information
Your name, email address, a hashed password, your business name, and the dates your account was created and last used. If you sign in with Google, we receive your name, email address and profile picture from Google rather than a password.
Business profile information
The details of each Google Business Profile you connect, including business name, address, categories, attributes, opening hours, phone number, website and the profile's unique Google identifier. We store the address so we can show you which listing each profile is connected to and warn you if two profiles point at the same one.
Content you create
Photos you upload, post copy, captions, keywords, review replies, content briefs, calendar entries and any edits you make to them. This includes the images and video files we render for Reels and Stories.
Performance and analytics data
Geo-grid scan results, ranking positions, competitor names and public listing details returned by those scans, profile impressions, calls, direction requests, website clicks, follower counts and post engagement.
Usage and device information
Pages you visit inside the app, features you use, timestamps, IP address, browser type and device type. We use this to keep the service running, apply rate limits and investigate abuse.
Payment information
Subscriptions are processed by Stripe. Stripe collects and stores your card details directly. We never see or store your full card number. We receive your billing name, email, country, the last four digits of the card, the plan you are on and your payment history.
Orders you start but do not finish
Our order forms ask for your name and email before they ask for card details. If you fill in that first step and then leave without paying, we keep what you entered, together with the plan and billing term you were looking at, so we can follow up about that order.
2. Google user data and Limited Use
When you connect a Google Business Profile, you grant us access through Google's official OAuth flow. You can see exactly which permissions are requested on the consent screen before you approve anything. We use that access to read your profile and performance data, publish posts, add photos, read and reply to reviews, and update profile fields you ask us to change.
Limited Use commitment. Map Pack Machine's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, we do not sell Google user data, we do not use it for advertising, and we do not use it to build profiles for any purpose other than delivering the features you have asked for. Humans do not read your Google data except where you have given us permission for support, where it is necessary for security or to investigate abuse, or where the law requires it.
You can disconnect a Google Business Profile at any time from the profile settings inside the app, or revoke our access directly from your Google Account permissions page. When you disconnect, we delete the stored access and refresh tokens immediately.
3. Meta platform data
If you connect Instagram or Facebook, you do so through Facebook Business Login. We receive an access token for the Pages and Instagram professional accounts you select. We use it to publish posts, Reels and Stories, and to read and reply to comments and direct messages that arrive in your unified inbox.
We store the message and comment content, the sender's public username or display name and profile picture where Meta provides it, and the timestamp. We do not access your personal Facebook friends list, personal profile content, or any Page you did not select during connection.
You can disconnect at any time inside the app, or remove our access from your Facebook Business Integrations settings. See Deleting your data for how to have the stored data removed.
4. Contact details you upload about your customers
To send review requests, you give us the name and email address of the customer you want to ask. This is personal information about someone who is not our user, so it needs saying plainly:
- You remain responsible for that person's data. You must have their consent, or another lawful basis, before you give it to us.
- We use it only to send the review request and follow-up sequence you set up. We do not market to your customers, add them to any list of ours, or share them with anyone else.
- Every email we send on your behalf carries a working unsubscribe link and identifies your business as the sender, as required by the Spam Act 2003 (Cth).
- The sequence stops automatically when a review is left, or when the recipient unsubscribes.
- We delete the contact record when you delete it, when you close your account, or 24 months after the last email in that sequence, whichever comes first.
5. How we use information
- To provide the service: publishing posts, sending review requests, drafting replies, running geo-grid scans, building audits and calendars, and showing you your analytics.
- To manage your account, process payments through Stripe, and send you service messages such as receipts, lapse reminders and your monthly digest.
- To keep the service secure and reliable, including rate limiting, fraud prevention and debugging.
- To improve the product. Where we analyse usage patterns to do this, we work with aggregated or de-identified data that does not identify you or your customers.
- To follow up on an order you started but did not finish. Those emails are only ever about completing that order, every one carries a working unsubscribe link, and we stop the moment you use it. An unfinished order does not put you on any other list.
- To meet our legal and tax obligations.
We do not sell your personal information, and we do not share it with third parties for their own marketing.
6. AI processing
Map Pack Machine uses third-party AI models to generate post copy, captions, review replies, business descriptions, content briefs and calendar suggestions, and to describe the contents of photos you upload for before-and-after posts.
To do that, the relevant content is sent to our AI providers. We use their business or enterprise offerings, under terms that prohibit them from using your content to train their general models. Output is generated for you alone and is not shared with other customers.
AI output can be wrong. You are responsible for reviewing anything before it is published. See the Terms of Service for more on this.
7. Who we share information with
We share information with the service providers we need to run the product, and no one else, except where the law requires it or where you have told us to.
| Provider | What they handle |
|---|---|
| Business Profile data, posting, reviews, sign-in | |
| Meta (Facebook, Instagram) | Publishing, comments and direct messages |
| Stripe | Payments and card processing |
| Our hosting and database provider | Storage of your account and content |
| Our AI providers | Generating copy, replies and image descriptions |
| Our email provider | Delivering review requests and service email |
We may also disclose information where we are required to by law, where it is needed to protect someone's safety, or as part of a sale or restructure of the business, in which case the buyer would be bound by this policy.
8. Storage, location and security
Passwords are hashed, never stored in readable form. Data in transit is encrypted with TLS. Data at rest is encrypted. Access tokens for Google and Meta are stored encrypted and are only decrypted when performing an action you have configured. Access to production systems is limited to personnel who need it.
Your data is stored on servers located in {{DATA_LOCATION}}. Some of our providers, including Stripe and our AI providers, process data outside Australia. Where information is transferred overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.
No system is perfectly secure. If a data breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.
9. How long we keep information
| Data | Retention |
|---|---|
| Account and profile data | Until you delete your account, then removed within 30 days |
| Posts, photos and content you created | Until you delete it, or until account deletion |
| Google and Meta access tokens | Deleted immediately when you disconnect |
| Cached Google Business Profile data | Up to 30 days, then refreshed or removed |
| Customer contacts for review requests | Deleted on request, on account closure, or 24 months after the last email |
| Social inbox messages and comments | 12 months, or until you disconnect the account |
| Usage and access logs | 30 to 90 days |
| Contact details from an order you did not finish | 30 days, then deleted. Sooner if you ask us, or unsubscribe |
| Invoices and payment records | 7 years, as required by Australian tax law |
Content that has already been published to Google, Instagram or Facebook lives on those platforms. Deleting it from Map Pack Machine does not remove it from them. You will need to delete it there as well.
10. Your rights and choices
Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles you can ask us to:
- Give you access to the personal information we hold about you.
- Correct anything that is wrong or out of date.
- Delete your information, subject to records we are legally required to keep.
- Provide a copy of your data in a portable format.
- Stop using your information in a particular way.
Most of this you can do yourself inside the app. For anything else, email hello@mappackmachine.com with the subject line "Privacy Request". We will acknowledge within 2 business days and respond in full within 30 days. There is no charge.
11. Deleting your data
You can delete individual items, disconnect a platform, or close your account entirely from your account settings. Full instructions, including how to remove data associated with Facebook and Instagram, are on our Data Deletion page.
12. Cookies
We use cookies to keep you signed in, remember your preferences, apply rate limits and measure performance. We do not use advertising or cross-site tracking cookies. You can block cookies in your browser, but the app will not work properly without the ones that maintain your session.
13. Team members
If you invite team members, the account owner can see which member performed which action, and can set what each member is allowed to access. Permissions are enforced at the database level, not merely hidden in the interface. If you are a team member, the owner of the account controls your access and can see your activity within it.
14. Not for minors
Map Pack Machine is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a minor has given us information, contact us and we will delete it.
15. Changes to this policy
We may update this policy as the product changes. The date at the top always reflects the current version. If a change materially affects how we handle your information, we will tell you by email or in the app before it takes effect.
16. Contact and complaints
For any privacy question or request, contact:
Map Pack Machine
PO Box 1284, East Victoria Park WA 6981
hello@mappackmachine.com
If you are not satisfied with how we have handled your complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.