Privacy Policy

This policy explains how we collect, use, disclose and retain personal information when you visit our website at www.usenearby.com, use our application at app.usenearby.com, connect a business profile, contact us or otherwise interact with our services. It also explains how personal information in business listings, reviews and published content is handled through Nearby.

Usenearby Ltd is registered in England and Wales under company number 12495984. Our registered office is Level 5a Maple House, 149 Tottenham Court Road, London, W1T 7NF, United Kingdom.

For privacy enquiries, requests or complaints, email privacy@usenearby.com or write to our registered office, marked for the attention of the Privacy Team.

We act as a data controller when we decide why and how personal information is used for our own business purposes. This includes managing accounts and business relationships, handling enquiries, billing, marketing our services and protecting our website and platform.

When a customer uses Nearby to manage listings, reviews, responses and posts containing personal information, we generally process that information on the customer's behalf and according to its instructions. In that capacity, we act as a data processor. If our customer is an agency acting for another business, we may act as a subprocessor. The relevant customer agreement and data processing agreement govern that processing.

Businesses using Nearby are responsible for the lawful collection and use of the personal information they ask us to process, including providing their own privacy information where required. This policy does not replace their privacy notices or those of Google and other connected platforms.

If your request concerns a review or other information handled for a business using Nearby, contact that business or the platform where the information was published. You may also contact us; we will help identify the appropriate route and assist our customer as required by law.

The information involved depends on how you interact with Nearby and which features and integrations your organisation uses.

• Account and business contact information: names, work email addresses, telephone numbers, job roles, business names, account identifiers, user permissions and authentication information.
• Subscription and transaction information: billing contact details, billing addresses, subscription plans, invoices, payment status and transaction references. Payment information is also handled by the payment providers involved in your transaction, under their own privacy notices where they act as controllers.
• Business listing information: business names, addresses, service areas, coordinates, contact details, opening hours, categories, descriptions, photographs and other profile content. Business information can be personal information where it identifies an individual, such as a sole trader or a person working from home.
• Review and response information: review text, ratings, dates, review identifiers, reviewer display names, profile photographs or links where supplied by the source platform, business responses and personal information mentioned in the content.
• Posting and media information: text, photographs, offers, links, publication schedules and associated metadata submitted for publication or management through Nearby.
• AI feature information: review content, instructions and business context used to generate responses or analyse feedback, together with generated drafts, summaries, topic classifications and sentiment results. These outputs may contain personal information.
• Connected account information: account and location identifiers, authorised permissions, access or refresh tokens, and information returned by connected services within the permissions granted.
• Technical and usage information: IP addresses, browser and device details, approximate location derived from an IP address, pages and features used, timestamps, diagnostic information and security logs. Cookies and similar technologies are addressed in section 8.
• Communications and preferences: enquiries, support requests, feedback, correspondence, marketing preferences and records of privacy choices or requests.

We collect information directly from you, from your organisation or its authorised users, through your use of the services, and from connected platforms such as Google Business Profile. Some listing and review information originates from publicly accessible profiles and reviews. Public availability does not remove the protections that apply to personal information.

Please avoid including unnecessary sensitive personal information in reviews, AI instructions, support messages or uploaded content. This includes health information, identity documents and information about beliefs or other protected characteristics. If such information appears in customer content, its processing must have a lawful basis and, where required, a separate legal condition for special category or criminal offence information, together with appropriate safeguards.

Where we act as a controller, we use personal information for the following purposes under the UK GDPR and, where applicable, the EU GDPR.

Providing accounts and services. We register users, authenticate access, manage permissions and deliver the services requested. We rely on performance of a contract where the individual is our contracting customer, or on steps requested before entering that contract. For users acting for an organisation, we generally rely on our legitimate interests in providing and administering that organisation's services.

Customer support and business relationships. We respond to enquiries, provide demonstrations, troubleshoot issues and send service information. Our basis is contractual necessity where applicable, or our legitimate interests in responding to requests and supporting customers.

Billing and administration. We administer subscriptions, collect payment and maintain transaction records. We rely on contractual necessity where applicable, our legitimate interests in administering business relationships, and legal obligations for required accounting and tax records.

Security and service improvement. We investigate faults, prevent misuse and fraud, protect accounts and understand how our services perform. We rely on our legitimate interests in operating a secure and reliable service, and on legal obligations where they apply. Any use of customer content remains subject to our role, customer instructions and applicable platform restrictions.

Marketing. We send relevant information about Nearby where permitted by law. We rely on consent where required, or on our legitimate interests in promoting our services where the applicable marketing rules allow this. You can object to direct marketing at any time.

Legal obligations and claims. We respond to lawful requests, meet applicable legal duties and establish, exercise or defend legal claims. We rely on the relevant legal obligation or our legitimate interests in protecting legal rights.

Where we rely on legitimate interests, we consider the purpose, necessity and impact of the processing and balance our interests against your rights. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

For personal information processed on a customer's behalf, the customer determines the applicable legal basis. Its subscription to Nearby does not, by itself, constitute consent from people who write reviews or appear in its content.

If information is needed to set up an account, provide a requested feature or meet a legal obligation, we will explain that when it is requested. Without it, we may be unable to provide the relevant service.

When you connect a Google Business Profile or another supported account, Nearby receives the permissions you authorise. Depending on those permissions and the features used, this allows us to retrieve and manage business information, reviews, replies, posts, media and performance information.

We use connected platform information to provide the features requested and within the permissions and restrictions that apply. We will obtain any separate authorisation required for automated actions, including automated review replies. Publishing through Nearby can make the content publicly visible on the destination platform.

Nearby's use and transfer of information received through Google APIs is subject to the Google API Services User Data Policy, including its Limited Use requirements where applicable, and the Google Business Profile API policies. These restrictions also apply when relevant information is processed using AI features or service providers.

You can revoke Nearby's access through your Google Account connections, through the equivalent controls of another provider, or by contacting us for help disconnecting an integration. Revocation stops future access through that authorisation and may prevent connected features from working. It does not automatically delete information already lawfully held by Nearby or content already published on the source platform. Deletion requests are handled under sections 11 and 13 and the platform rules that apply.

Google and other connected services process information under their own privacy notices. For Google, see the Google Privacy Policy.

Nearby uses AI to help customers draft review responses, identify topics and analyse sentiment in customer feedback. Depending on the feature, processing may involve review text and associated information, business details, customer instructions and generated outputs.

AI-generated responses and sentiment classifications may be inaccurate or incomplete. Customers should review outputs before relying on them or publishing them, and ensure that their use is appropriate and lawful. Where an automated publication feature is available, its use is subject to the permissions and authorisations required for that feature and the connected platform.

We disclose personal information where necessary for the purposes explained in this policy to the following recipients:

• Your organisation and its authorised users: administrators, colleagues and agencies with permission to access the relevant account or locations.
• Service providers: providers supporting hosting, storage, security, technical operations, payments, communications, support and AI features, to the extent needed for their services. Providers acting as processors must handle information under appropriate contractual instructions and confidentiality obligations.
• Connected platforms and the public: platforms to which you direct us to publish or transmit information, and anyone able to view published listings, posts and responses.
• Professional advisers and authorities: advisers, regulators, courts and law enforcement bodies where disclosure is necessary and lawful.
• Parties to a business transaction: prospective or actual purchasers, successors and their advisers where necessary for a merger, acquisition, financing or sale of our business, subject to appropriate confidentiality and data protection safeguards.

Disclosures of information received through connected platforms remain subject to the restrictions described in section 5, including any requirement to obtain your prior explicit consent.

Our website and application may use cookies, local storage and similar technologies to maintain sessions, provide requested functions, remember preferences and understand service use.

Where the law requires consent, we will request it before using the relevant technology. You can change or withdraw that consent through our cookie preference controls. Technologies that qualify for an applicable exemption are used only within its conditions, including any required information and means of objection. Browser settings can also limit or delete cookies, although blocking essential technologies may affect the service.

You can stop marketing emails by using the unsubscribe link in the message or by contacting us. We may retain limited information on a suppression list to respect your choice.

Service messages, such as security alerts, billing notices and essential account information, may still be sent because they are needed to administer the service. We do not treat your acceptance of service terms or your reading of this policy as consent to optional marketing.

Personal information may be processed outside your country where Nearby or its service providers operate.

Where a transfer is restricted by UK or EU data protection law, we use a legally recognised transfer mechanism as required. Depending on the destination and recipient, this may be an applicable adequacy decision or approved contractual safeguards, together with any required assessment and supplementary measures. You can contact us for information about the safeguards relevant to your data and request a copy, subject to appropriate redaction of confidential information.

We retain personal information only for as long as necessary for the purpose for which it is processed, taking account of the relevant contract, legal duties, applicable platform rules and the need to resolve disputes or protect legal rights.

Account and contact records are kept for the duration of the relationship and any justified period needed to close the account or handle outstanding issues. Financial records are kept for the applicable statutory period. Support and security records are retained according to their operational purpose, sensitivity and relevance to any incident or dispute. Marketing suppression records are kept as needed to honour an objection.

Customer content is retained, returned or deleted according to the customer's instructions, our agreement and the source platform's restrictions. Disconnecting an integration, closing an account and deleting content on the source platform are separate actions and may have different consequences.

When information is no longer required, we delete it or make it anonymous so that individuals are no longer identifiable. If information must be retained for a legal obligation or an active dispute, we restrict its use to that purpose. Backup copies are protected and expire under the applicable backup schedule.

We apply technical and organisational measures appropriate to the nature of the information and the risks involved, and limit access to people and providers who need it for an authorised purpose. No system can guarantee absolute security. Please protect your login credentials and notify us promptly if you suspect unauthorised access to your account.

Where a personal data breach occurs, we assess it and notify affected customers, individuals or regulators as required by applicable law and our contractual obligations.

Depending on the law that applies and the circumstances, you may have rights to:

• obtain information about our processing and access your personal information;
• correct inaccurate or incomplete information;
• request deletion or restriction of processing;
• receive certain information in a portable format and, where applicable, have it transmitted to another controller;
• object to processing based on legitimate interests and object at any time to direct marketing;
• withdraw consent where processing relies on it; and
• exercise safeguards concerning qualifying automated decisions, including human intervention and an opportunity to contest a decision where required by law.

Contact us using section 1 to exercise your rights. We may request information reasonably necessary to verify your identity or clarify the request. We normally respond within one month, subject to any lawful extension or other applicable timing rules, and will explain any permitted delay. Requests are normally free; any lawful fee or refusal will be explained.

These rights are subject to legal conditions and exceptions. If we process the information for a customer, we will refer the request to the relevant controller and assist it with responding as required.

You can complain directly to us using the email or postal contact in section 1. Please explain your concern and provide enough information for us to investigate. We will acknowledge a data protection complaint within 30 days, investigate it, keep you informed of our progress and inform you of the outcome without undue delay.

You also have the right to complain to the UK Information Commissioner's Office through ico.org.uk/make-a-complaint, or to another competent supervisory authority. Where the EU GDPR applies, this may include the authority in the country where you live, work or believe an infringement occurred. You do not have to obtain our permission to contact an authority.

Nearby is a business service and is not directed at children. If you believe that a child has provided information directly to us, please contact us so we can assess the situation and take appropriate action. Information about a child that appears in a customer's review or other content remains subject to the relevant customer's responsibilities and applicable data protection law.

We may update this policy to reflect changes to our services, practices or legal requirements. We will publish the updated version with a revised date and provide additional notice where required. If a new use of information requires consent, we will request that consent before starting that use.