Privacy Policy
Version 1.8 · Effective October 24, 2026
This policy explains what KILLCRITIC by X1OTHINK, a service of Repair Tune LLC ("we," "us"), collects, why, who it's shared with, and your choices. The short version: we collect what you give us to run the product, we don't sell your data, we don't run ads or third-party trackers, and you can delete your data.
1. Data We Collect — Full Label
Everything the app collects, in one table. We collect nothing outside this table.
| Category | What exactly | Why | Shared with | Kept until |
|---|---|---|---|---|
| Account | Name, email address, password (stored only as a scrypt hash — we cannot read it), plan, Terms acceptance record, account creation date | Sign-in, account management, service emails | Email delivery provider (Resend) when we send you email | Until account deletion |
| Business profile | Business name, category, address, city, state, ZIP code, phone, website URL, hours, services, description, photo count, posting frequency; if you connect Google, the main and extra categories Google has on your profile, your regular and holiday opening hours as Google has them, and your answers to our holiday-hours questions | Audits, content generation, reports | AI provider (Anthropic) to generate content about your business | Until you delete the business or account |
| Reviews you add or import | Reviewer name, star rating, review text, review date, source, your reply drafts and posted replies (and when each reply was posted); for a Google review, the date Google stopped showing it, if it did; and a monthly note of your own review count and average rating | Review management, sentiment analysis, AI reply drafting, review alerts | AI provider (Anthropic) to draft replies; email delivery provider (Resend), when a review alert email to you includes the review (reviewer name, stars, date and text) | Until you delete the business or account |
| Competitor data you enter | Competitor names, ratings, review counts, photo counts, posting frequency, website scores, and their main and extra Google categories (read from their public Google Maps listings); ratings and review counts are re-read with the monthly refresh and noted once a month, to show how many reviews a month they get. Each competitor search also keeps every public Google Maps listing it returned — competitors or not — with its name, address, phone number and Google place ID | Comparison and gap analysis, including which Google categories your competitors use that you don't; the kept Maps listings are used only to spot a possible duplicate of your own Google listing | AI provider (Anthropic) for gap explanations; search data provider (DataForSEO), which we send your category and town — or your shop's map pin, when Google has one — to find your Google Maps competitors and read their public listings | Until you delete the business or account; the kept Maps listings are replaced by your next competitor search, are no longer used after 90 days, and are deleted with the business or account |
| Products checklist | The products and services you list: name, category, price, description, a link to your website, and the date you ticked “Done on Google” | A checklist for adding your products to Google by hand — never sent to Google by us | Nobody | Until you remove the item, or delete the business or account |
| Daily history for your graphs | Each night, a note of a few numbers for each location as they stand that day: your profile score and its parts, how many directory listings are live or have a problem, how many sites in your link tracker link to you (on plans with the link tracker), your own Google reviews' count and average rating, and your photo count | Graphs of how these numbers change over time (they can't be worked out again for a past day). These numbers are worked out from what we already hold: nothing extra is read from Google or anyone else for them | Nobody. It is not sent to our AI provider or any other service | Until you delete the business or account |
| Notes on your graphs | The day and the words of each note you add to your graphs, and which sign-in added it; plus short notes KILLCRITIC adds itself (such as a week the AI answers check was paused) | Showing them beside your numbers on Graphs | Nobody. They are not sent to our AI provider or any other service | Until you delete the note, or delete the business or account |
| SEO & content data | Keywords, tracked rankings you record, generated articles and drafts, content calendar, site-audit results for URLs you submit | The Your website and Posts & photos pages | AI provider (Anthropic) for generation | Until you delete the item, business, or account |
| AI pictures | When you make a picture: your business name, category, city and state, and any description you type. The finished picture is stored with us and served at an unlisted web address, so Google can fetch it when you post it. Each picture also gets a short description (alt text), written from your words and editable by you | Making pictures for your Google posts (AI pictures go in posts only, never on your profile as photos) | The image provider we use to draw it (Google Gemini or OpenAI); Google, if you post the picture (Google posts take the picture only). A picture made before October 6, 2026 may also have gone up as a profile photo, with its description | Until you delete the business or account |
| Your photos | Photos you upload from your phone or computer, the kind of photo you pick (logo, cover, outside, inside, at work, team), the short description you write, and the photo's size. Before a photo is stored we take out the hidden details cameras add — where it was taken (GPS), the device and the time. It is stored with us and served at an unlisted web address, so Google can fetch it when you send it | Putting your real photos on your Google profile | Google, only when you click to send that photo — with the kind you picked and its description. A cover photo goes without its description, as Google requires | Until you delete the photo, business or account |
| Your writing style (brand voice) | Writing samples you paste in, and the style profile our AI derives from them. If you give us your website URL, the readable text of that page is fetched and analysed too | Making generated content sound like you wrote it | AI provider (Anthropic) to build and apply the profile | Until you delete your writing style (the Forget my style button), the business, or the account |
| Weekly tasks & listings progress | Your generated weekly task list and which tasks you've ticked off; which directories you've marked as submitted, live, or not started on the Online listings page, and where you are with any program you can apply to that's shown there (not started, applied, accepted or not for us); and, when you run "Find my existing listings", the listings it found, any you've told us aren't yours, and the name, address and phone number each of those public pages shows for your business | Tracking your progress, and showing where another site has your details wrong | AI provider (Anthropic) generates the task list. "Find my existing listings" sends your business name and town to our search data provider (DataForSEO) to search Google, then opens each listing it found on that directory's own website (as KILLCRITIC, to read your details there). Listing progress is shared with nobody, unless you buy a listings pack (see "Paid listings submission") | Until you delete the business or account; we keep your last ten listing checks, and always your newest finished one |
| Paid listings submission (only if you buy it) | If you buy a listings pack: the pack you chose, and the business details you confirm for it — business name, address, ZIP code, phone, website, hours, category, services and description, exactly as shown to you under "This is what we'll send" — frozen at the moment you confirm, with when you confirmed; then when we sent it, and the partner's reference for it; the shortened description, the five services and the directory category you confirm; when it's sent through our partner's system, its references there and the progress it reports back — which directories your listing went to, which are live and their addresses; and if our listings partner asks about your listing, the answers you give us (kept with the order) | Submitting your business to business directories, which is what you bought. Nothing is sent until you confirm your details | BrightLocal (based in the United Kingdom), our listings partner, which receives the details you confirmed (and your answers to any questions it asks about them) and submits your details to business directories. Those directories publish your details publicly, and each decides for itself whether to keep, change or remove a listing — we can't guarantee a listing is removed from a directory later | Until you delete the business or account; then the details you confirmed and your answers to our partner's questions are removed, and only the order's pack, amount, dates and references are kept, for accounting. BrightLocal keeps what we sent under its own data-processing terms. Live listings stay on the directories after you cancel |
| Backlink data | Your website domain, and the backlink profile returned for it: linking page URLs, linking domains, anchor text, follow status, domain ratings, and dated snapshots of the totals | Backlink monitoring (Growth and Pro plans) | SEO data provider (DataForSEO) — we send them your domain to look it up | Until you delete the business or account |
| Link tracker | The sites you list as places that could link to your business, and what you write about them: the site's name and web address, what kind of site it is, a contact's name, email address and contact page (people at other organisations, whose details you choose to enter), where things stand, your notes and follow-up dates, and the address of the page that links to you. For a live link, what our check found: whether the link is there, its words, its type (such as nofollow) and when we last looked | Keeping track of the links you're working on, reminding you on your Approvals page when you asked to follow up, and checking once a week that your live links are still there | Nobody. We never email or contact the people you list — you do that yourself. To check a link we visit the public page you named, the way any visitor would, and our visit says it's from KILLCRITIC | Until you remove the site, or delete the business or account |
| Link opportunities | About once a week automatically (unless you turn weekly link chances off), and when you press Find opportunities: your business name, phone number, town, state, category, services and website, the names and websites of the competitors you track or type in, and the websites of your other locations (so we never suggest one of your own shops); the searches we run with them, and what they found — the sites, the public pages we opened, a contact or news-tips page linked from them, and why we left a site out; and the sites we pick as weekly link chances, each with a short draft we build from your business details without AI where we can | Finding real sites that could link to you or mention you — ones that link to your competitors, local organisations and news, “best of” lists in your town, community calendars, sites that welcome guest articles, and pages that mention you without a link — and choosing up to three at a time to show on your Approvals page | SEO data provider (DataForSEO) — we send them the searches and the websites to look up. Nobody else: we never contact the sites we find, and our visit to a public page says it's from KILLCRITIC | Your last three searches; the sites we've suggested as weekly link chances (so we never suggest one twice), until you delete the business or account |
| Mentions of your business | Public pages that mention your business name or phone number, found by our link searches (about once a week, unless you turn weekly link chances off, and whenever you press Find opportunities), outside the directories on Online listings: each page's address and title, whether it links to your website, whether it names you or only gives your phone number, whether it looks like a discussion or a complaint (those we only show you, and never suggest writing to), the phone number or street address it seems to give for you when that differs from yours, and when we first and last saw it | Showing you the pages that mention you (on your Links to your site page), choosing link chances among them, and telling you on your Approvals page about pages that seem to have your phone number or address wrong | SEO data provider (DataForSEO) runs the searches (your business name and phone number, from your town). Nobody else: we never post, reply or contact anyone, and our visit to a public page says it's from KILLCRITIC | Each page until 12 months after we last saw it. A notice about a wrong detail until it's fixed, the page is gone or we haven't seen the page for 8 weeks (even if you hide it), then 90 days. If you disconnect Google or switch to a different location, notices showing your Google phone number are deleted; our next search raises them again if the page is still wrong. All deleted with the business or account |
| Outreach and press drafts | When you ask for a draft: the facts you type for it (what your business does, your real connection to a site, your story, the community events you list, a press release's details and your quote), the site's name, its contact's name and what we found about it, your name, and — for story ideas — your services, the number of your reviews, their average rating and how many mention common themes; the drafts we write, and when you told us you sent one | Writing short, honest messages, story ideas and press releases for you to send yourself, and reminding you to follow up | AI provider (Anthropic) to write the drafts you ask for (the drafts for weekly link chances are built without AI). Nobody else: we never send them — you send them yourself, from your own email | The latest draft for each site, story ideas and press release, until you replace them, remove the site, or delete the business or account |
| AI Search | For the weekly AI answers check (Growth and Pro, once you pay): your business name, town and state, the questions you pick, and the AI answers we get back — the text, the shops and websites they name, what they say about your shop, and what each answer cost us. For the AI readiness checklist: what our read-only look at your own public website found (whether AI crawlers may read it, its sitemap, its business schema, your phone, address and prices on it), and every night, from your home page only, your phone number, address and opening hours (holiday hours included) as your website states them, to compare with your Google listing. For "What I saw": the checks you type in yourself — which app, the exact words, where you were, whether your shop was named and which other shops were. For "I checked": the day you told us you'd checked a setting we can't see from outside (Cloudflare's AI crawler settings, or Search Console's Search generative AI setting), and what it was for: your website's robots.txt settings, or the Search Console website you connected | Showing how often AI answers name your shop, which sources they used, and what to fix | AI Search: your business name, town, the questions you pick and, for Google AI Mode, your shop's spot on the map are sent to DataForSEO, which passes them to OpenAI, Anthropic and Google to get the answers. Nothing about your customers is sent. The readiness checklist and the nightly comparison only visit your own public website (our visit says it's from KILLCRITIC). What the nightly comparison finds is shared with nobody. What the checklist finds is shared with nobody either, except that when it puts a task on your weekly plan (AI search engines can't read your website, or no page names your town with a price), that task's title goes to our AI provider (Anthropic) with the rest of the plan. "What I saw" entries are kept for you only and never sent to any AI company. Your "I checked" answers are shared with nobody | The text of each AI answer for 120 days; the rest of each answer's record (which shops and websites it named, what it cost) for 400 days, about a year of trend; the weekly totals and your "What I saw" entries until you delete them, the business or the account; the readiness checklist keeps only its latest result; the nightly comparison keeps only its latest result too, and a notice about a difference is kept while the difference lasts, even if you hide it, and deleted 90 days after it's fixed; your "I checked" answers until you delete the business or account (the row asks again after a year), and the Search Console one is also deleted when you disconnect Search Console or switch to a different website |
| Cached AI output | Generated analysis text kept alongside a fingerprint of the inputs that produced it | Avoiding a paid regeneration of identical analysis on every page view | Nobody | Until the underlying data changes, or you delete the business or account |
| Plan usage signals | Which features you use and how many times, with the first and last date; the date you last signed in; and, when a feature your plan doesn't include turns you away or you reach your daily AI limit, which feature and how often. Counts and dates only — never the content of what you generated | Telling us when a plan is the wrong fit for a customer, which features earn their place, and who needs help getting value | Nobody | Until account deletion |
| Abuse-prevention counters | Short-lived counters keyed to your IP address, your account ID, or (for sign-in and password-reset attempts) your email address, with a count and an expiry | Rate limiting — stopping credential-stuffing, signup floods, and runaway AI spend | Nobody | Most counters expire within 24 hours; the one that limits how often we can email you about your trial lasts 7 days. Entries tied to your account and email are also deleted with the account |
| Password resets | A one-time reset token stored only as a SHA-256 hash, its expiry, and whether it has been used | Letting you reset a forgotten password securely | Nobody (the link itself goes to your email via Resend) | Expires after 1 hour; rows deleted with the account |
| Billing | Stripe customer ID, subscription ID, plan, subscription status, billing period end, how many location slots you pay for, and your subscription's unit price; and, if you buy a listings pack, which pack, the amount, its Stripe payment reference and any refund. We NEVER see or store card numbers — payment details go directly to Stripe | Subscription management | Stripe (payment processor) | Until account deletion; Stripe retains records per its own policy |
| Google Search Console data | If you connect Search Console: the list of websites your Google account can see there, the one you choose, and for that website the last 28 days' search clicks, impressions, click rate and average position, the top searches people used, and the top pages they landed on; plus that website's daily totals (clicks, times shown and average position for each day) for up to the last 16 months; for each page we publish for you, whether Google has added it, Google's reason when it hasn't and when Google last visited it; the sitemaps Search Console lists for that website, with the dates Google read them; the searches each of your pages showed up for in the last 28 days, with how often each was shown and its average position (we keep only what these lists need: up to 15 searches where one of your pages is around spots 5 to 15, up to 3 more for each page we publish for you, and up to 10 searches that two or more of your pages show up for); and daily clicks and times shown from searches that don't use your business's name, for up to the last 16 months | Showing your website's Google search performance on the Your website page, and the daily totals as graphs of how it changes over time; whether Google lists the pages we publish for you (Articles & pages, and notices on Approvals when one can't be opened, is left out, or a sitemap isn't listed); the searches where your pages show up around spots 5 to 15, and two or more of your pages showing up for the same search; title ideas that use the words people searched (only if you choose one does it become your page's title); and the clicks from searches without your business's name, as a graph of which way they're going. Read-only: we never change anything in Search Console, and we never submit anything to Google for you | Nobody. It is not sent to our AI provider or any other service (like everything in this table, it is included in our database backups, described below). Title ideas are made by fixed rules, not by AI. If you use one, our AI writer keeps seeing your page's earlier title, so the search words don't reach it. If you later type a different title for that page yourself, the AI writer sees the title you typed, as it does any title you type | Only the latest 28-day snapshot is kept, replaced on each daily refresh. The daily totals are kept for up to 16 months, with the newest days re-read as Google corrects them. The searches lists are the latest week's only, replaced weekly; the daily clicks from searches without your name are kept for up to 16 months, and read again from the start when the words that count as your name change. The latest check of each page and the latest sitemaps list are kept, each replaced when we read them again; a notice about a page or sitemap is kept while the problem lasts, even if you hide it, and deleted 90 days after it's fixed. All of it is deleted when you disconnect Search Console, switch to a different website, or delete the business or account; a page's check is also deleted when you delete that page or it's no longer on your website |
| Google Business Profile performance data | If you connect Google: for your connected location, daily counts of calls, direction requests, website clicks, profile views on Google Search and Maps, messages and bookings for about the last 18 months; the searches Google showed your profile for each month of about the last 18 months, with Google's counts; where Google pins your shop on the map, when Google has a pin for it; and when each post, photo and video on your profile was added, with Google's own ID for it (read each night; kept until you disconnect Google or change listing) | Showing what your Google profile did for you on Home, Reports, your emailed report and as graphs of how it changes over time, including the Graphs page's “Posts and photos added” (the map pin is for checking your Google Maps position). Read-only: we never change anything on Google with it | Nobody, except the map pin: it is sent to our search data provider (DataForSEO) as the middle spot of your weekly Google Maps position check, and as the place your competitor search runs from. The rest is not sent to our AI provider or any other service; the numbers in your emailed report go to your inbox via our email provider (Resend) | Re-read nightly, with each day's numbers replaced as Google corrects them; deleted when you disconnect Google or switch to a different location, or delete the business or account |
| Nightly copy of your Google profile | If you connect Google: a read-only copy of your connected location's Google Business Profile, taken every night — business name, phone numbers, website, description, regular, holiday and other opening hours, categories, address or service area, services, labels, open or closed status, the review link and place ID, the map pin and the profile's attributes (features such as accessibility or payment options) — plus which of those Google changed itself or is still reviewing; and the notices we raise when something changed that you didn't approve here, or when your website's phone, address or hours differ from it | Scoring your audit from what customers actually see on Google, showing where Google and KILLCRITIC differ in Settings, telling you when your profile changed (on Approvals and in Settings), and comparing your phone, address and hours with your website's (notices on Approvals), and your phone and address with a page of your own website you check on the Website check. Read-only: copying it never changes anything on Google | Nobody. It is not sent to our AI provider or any other service | Only the latest two nightly copies are kept, older ones are deleted as new ones arrive; the copies, the latest comparison with your website and the notices are deleted when you disconnect Google or switch to a different location, or delete the business or account |
| Google Maps position checks | The searches you pick, the 25 map spots around your shop (worked out from its map pin), and what Google Maps showed at each spot: your position and the names of the top 3 businesses. When Google has no pin for your shop, we find it on Google Maps by searching your business name and town | The Your spot on the map page in Your website, Reports, your emailed report and the Graphs page (your own top-3 share and, for competitors you track, how often they're in the top 3). Read-only: nothing is changed on Google | Search data provider (DataForSEO) — we send it the search words and the map spots (and, to find your pin, your business name and town). Your Google place ID is not sent; we match it on our side | Until you delete the business or account; deleted when you disconnect Google or switch to a different location |
| Google profile changes you approve | If you connect Google: each change you approve on your Google Business Profile (today, adding an extra category or changing your main one, changing your opening hours, setting your hours for a holiday, or changing your description, services, attributes or booking link) — who clicked, when, what we were asked to change, what Google had just before and just after, and Google's answer if it refused | Making the change you clicked, and keeping a record of every change KILLCRITIC made to your profile and that you approved it. We change your profile only when you approve that specific change with a click — never on our own or on a schedule | Google (the change itself goes to your Business Profile); nobody else | Until you delete the business or account |
| Integration credentials | WordPress site URL, username, and application password (if you connect WordPress); Google OAuth tokens (if you connect Google Business Profile or Search Console), encrypted at rest | Publishing content and syncing data on your instruction | Sent only to the service you connected (your WordPress site / Google) | Until you disconnect the integration, or delete the business or account |
| Database backups | Nightly copies of our database, which holds everything in this table. One set is kept on our hosting volume (Railway); a compressed copy is also stored in a private Cloudflare R2 bucket so the service can be restored if the hosting volume is lost | Disaster recovery | Cloudflare (storage provider, as processor); nobody else | Rolling: about two weeks on the hosting volume, and 30 days in off-site storage, after which copies are deleted automatically. Deleting your account removes you from every backup taken afterwards |
| Cookies | Three essential cookies: kc_session (signed login session), kc_business (which of your businesses is active), and kc_oauth_state (a short-lived random value that protects the Google Business Profile and Search Console connection flows from cross-site request forgery). No advertising, analytics, or tracking cookies | Keeping you signed in | Nobody | kc_session 30 days; kc_business 1 year; kc_oauth_state 10 minutes |
| Technical logs | IP address, browser user-agent, and request logs generated by our hosting provider (Railway). Your IP address is also used by us directly, as described under Abuse-prevention counters | Security, debugging, abuse prevention | Hosting provider (Railway) as processor | Short-term rolling logs |
| Sales chat (website visitors) | Whatever you type into the chat box on our homepage. You do not need an account to use it, and we do not store the conversation | Answering questions about the product before you sign up | Our AI provider (Anthropic), which generates the reply | Not stored by us — the message is sent, answered, and discarded. A short-lived counter tied to your IP address limits abuse (see above) |
| Billing incidents | If something goes wrong with a charge — a duplicate payment, or a subscription change we couldn't complete — we log your email, what happened, the amount, and the Stripe reference | So a billing mistake can be found and put right rather than quietly absorbed | Nobody (the underlying payment records live with Stripe) | The record is permanent for accounting, but your email is removed from it when you delete your account |
| Admin plan changes | If our staff grant or change your plan by hand (a comped or corrected account), we log your email, which staff member did it, the old and new plan, and when | So a plan you did not pay for can always be explained and audited | Nobody | The log entry is permanent, but your email is removed from it when you delete your account |
| Accessibility requests | What you tell us when you report a barrier or ask for help, including any information about a disability you choose to share | Helping you use the Service and fixing the problem | No one, except Cloudflare Email Routing, which forwards email sent to our addresses, and the email provider that hosts our inbox, where your message is kept and our replies are sent from | With your support correspondence; deleted on request or when your account is deleted |
| Review alerts | Which of your Google reviews we alerted you about (a new review of 3 stars or fewer, or three weeks with no new review), whether the email went, and your review-alert email setting for each location. A low-star alert email includes that review: the reviewer's name, the stars, the date and the review text | Emailing you, and showing on your Home page, when a review may need a reply or reviews have gone quiet | Email delivery provider (Resend), which delivers the alert, with the review it is about, to your account email | Until you delete the business or account |
| Weekly link chances email | Up to three link chances at a time across your locations (each site's name, what kind of site it is, one sentence on what we found, and whether a draft is ready), whether the email went, and your setting for it | Emailing you at most once a week, only when we found real link chances | Email delivery provider (Resend), which delivers it to your account email | The record of each email until you delete the account |
| Emails you trigger | Password reset emails and report emails you request, sent to your account email | The feature you triggered | Email delivery provider (Resend) | Delivery logs per provider policy |
2. What We Don't Do
- We do not sell or rent your personal information.
- We do not share your personal information for cross-context behavioral advertising.
- We do not use advertising trackers or third-party analytics.
- We do not use your data to train AI models. Content sent to our AI provider (Anthropic) is used to generate your output; we send only what the feature needs.
- We do not knowingly collect data from anyone under 18. The Service is for business use by adults.
- We do not receive what the Listen button reads aloud. The speech is made by your own browser. We pick a voice that runs on your device when one is available; if there isn't one, your browser's default voice is used, and some browsers' online voices send the text being read to the browser maker's speech service (for example, Google for Chrome's online voices).
3. Service Providers (Processors)
We share data only with the providers that run the product, each bound by its own terms: Railway (hosting and database), Cloudflare (off-site database backups), Cloudflare Email Routing (forwarding email sent to our addresses), the email provider that hosts our inbox (receiving and answering email you send us), Stripe (payments), Anthropic (AI generation), Google Gemini or OpenAI (AI pictures, when you make one), Resend (email delivery), DataForSEO (search, map and listings data, on paid plans, and AI Search's answer checks, for which it passes your business name, town and chosen questions to OpenAI, Anthropic and Google, and your shop's spot on the map to Google), BrightLocal (directory submissions — only if you buy a listings pack, and only the details you confirm), and — only if you connect them — Google and your WordPress site. We may also disclose information if required by law, or to protect the rights, safety, or security of KILLCRITIC, our users, or the public.
Google user data
When you connect Google, we access only what the feature you connected needs: your Business Profile (business details and categories, reviews, the replies and posts you approve, and the profile changes you approve, plus a read-only copy of the profile taken every night and read-only performance numbers — calls, direction requests, website clicks, profile views, messages, bookings and the searches your profile showed up for — the dates your posts and photos were added, and where Google pins your shop on the map) and, if you connect it separately, read-only Search Console data for the website you choose (its search numbers, whether Google lists the pages we publish for you, and the sitemaps it lists). Business details and review text are sent to our AI provider (Anthropic) only to generate things for you inside KILLCRITIC: reply drafts, your weekly action plan, profile and post suggestions, and review-highlight posts. Search Console data and Business Profile performance numbers are never sent to it, and neither are the dates your posts and photos were added. Title ideas made from your Search Console searches come from fixed rules, not AI; if you use one, our AI writer keeps seeing your page's earlier title until you type a new title for that page yourself. Where Google pins your shop is sent to our search data provider (DataForSEO) only as the middle spot of your Google Maps position check and the place your competitor search runs from. We do not sell Google user data, use it for advertising, or use it to train AI models, and people at KILLCRITIC do not read it except with your permission, for security, or where the law requires. KILLCRITIC's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Profile changes you approve
If you connect Google, KILLCRITIC can make changes to your Google Business Profile, but only when you approve that specific change with a click, after we show you exactly what will be sent. Today that is your business categories, your regular opening hours, your holiday hours, your description, your services, your attributes (features such as accessibility or payment options), your booking link and the photos you send; posts you approve go up the same way — each one only on your click. KILLCRITIC never changes your profile on its own or on a schedule. Google may review, reject or alter a change, and may re-verify your business after a change to its main category. You are responsible for making sure every change you approve is accurate. We keep a record of each change (see "Google profile changes you approve" above), and you can see every one in Settings, next to your Google connection.
4. Security
- All traffic is encrypted in transit (HTTPS).
- Passwords are hashed with scrypt and never stored in plain text.
- Sessions use signed, HTTP-only cookies.
- Requests the app makes to URLs you submit are filtered to block internal and private network targets.
- No system is perfectly secure; if a breach affecting your personal information occurs, we will notify you as required by law.
5. Your Rights and Choices
- Access, correction, deletion, portability: you can edit business data in Settings, delete a business (which permanently deletes all its data) from My Businesses, and request full account deletion or a data export by emailing legal@killcriticseo.com. We honor verified requests within 30 days.
- Integrations: disconnect WordPress or Google at any time in Settings, and Search Console from the Your website page — stored credentials are deleted immediately.
- Emails: we send transactional email (password resets, reports you request, billing/legal notices), review alerts about your own Google reviews and, on plans with the links tools, a weekly link chances email (at most once a week, and only when we found something). Review alerts and the weekly email are both on by default. Turn review alerts off with the link in any alert or on the Reviews page. Turn the weekly email off with the link in it or on the Links to your site page. There is no marketing list.
- State privacy laws (e.g., California, Colorado, Virginia): where they apply to us, you have the rights above plus the right not to be discriminated against for exercising them. We do not "sell" or "share" personal information as those laws define it.
6. Data Location and International Users
Data is stored on servers in the United States. If you use the Service from outside the U.S., you understand your information is processed in the U.S. If you buy a listings pack, the business details you confirm for it also go to our listings partner, BrightLocal, in the United Kingdom.
7. Changes
We'll post any changes here and update the version and effective date above; for material changes we'll notify you by email or in-app before they take effect.
8. Contact
Privacy questions or requests: legal@killcriticseo.com
Accessibility, or help using the Service: legal@killcriticseo.com (see our Accessibility Statement).