Starpio Inc. ("Starpio", "we", "us") provides an AI-powered review management platform for local businesses, including personalized report pages we generate for businesses we have not yet worked with ("Reports") as part of our outreach process. This policy explains what we collect, how we use it, and your rights, across both the Starpio dashboard and Report pages.

What We Collect

Account data: your name, email address, and business name when you sign up or claim a Report.
Google account data: when you connect or claim your Google Business Profile, we request the business.manage OAuth scope and receive an access token, a refresh token, and their expiry, which we store to read your reviews and post responses on your behalf. We never see your Google password.
Review content: the text, rating, reviewer name, and reviewer photo of reviews on your connected Google Business Profile, used to generate AI responses.
Publicly available business data: before you ever create an account, we compile information about your business from public sources — Google's Places API (name, address, phone, category, rating, review count) and publicly visible reviews (via an open-source scraper) — to build a Report that shows how your business compares to nearby competitors. This is public information about your business, not about you personally.
Payment data: handled directly by Stripe; Starpio does not store your card number or full payment details.
Usage data: pages visited, features used, and actions taken on starpio.com and in the dashboard, collected via PostHog analytics and cookies.
Communications data: if we email you (including cold outreach about a Report we generated for your business), we track opens, clicks, and delivery status via our email provider, Resend.

How We Use Your Data

Generate a personalized Report comparing your business to competitors, and generate AI draft responses to your reviews.
Read reviews from and post approved responses to your Google Business Profile, once you connect or claim it.
Send transactional, onboarding, and — for businesses we have identified but who have not yet signed up — outreach emails about Starpio and their Report.
Process subscription payments via Stripe.
Measure product usage and improve Starpio's features via PostHog analytics.

Google User Data

Starpio's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We only use your Google Business Profile data (reviews and account/location identifiers) to display your reviews to you and to post responses you have approved — the core, user-facing feature of Starpio.
We do not use Google user data for advertising or sell it to third parties.
We do not allow humans to read Google user data, except: (a) with your explicit consent, for a specific support request; (b) for security purposes, such as investigating abuse; (c) to comply with applicable law; or (d) where the data has been aggregated and anonymized.
Your review text is sent to Anthropic (maker of Claude) solely to draft a suggested response; it is not used to train Anthropic's models under our commercial agreement with them.
You can revoke Starpio's access to your Google account at any time at myaccount.google.com/permissions, which stops all further access immediately.

Cookies

We use essential cookies to keep you signed in (via Supabase Auth) and to remember referral attribution for a limited time. We use PostHog analytics cookies to understand how starpio.com and the dashboard are used. You can block cookies in your browser settings, though this may affect sign-in.

Data Sharing

We do not sell your data. We share data only with the service providers necessary to run Starpio:

Supabase — database and authentication hosting.
Google — Business Profile API access (reviews, responses) and Places API (public business data for Reports).
Stripe — payment processing.
Anthropic — AI generation of draft review responses from review text.
PostHog — product analytics.
Resend — transactional and outreach email delivery.

Data Retention

We retain account data for as long as your account is active. If we have generated a Report or hold public business data about your business and you have not created an account, you can ask us to remove it at any time. You can request deletion of your account and all associated data, including stored Google tokens, at any time by emailing support@starpio.com. We process deletion requests within 30 days, and deleting your account immediately invalidates any stored Google tokens.

Security

Starpio uses industry-standard security practices including encrypted data in transit (TLS), encrypted data at rest, and OAuth 2.0 for all third-party platform connections. We do not store review platform passwords.

Your Rights

You have the right to access, correct, export, or delete your data at any time, including revoking our access to your Google account and requesting removal from any Report or outreach list. Contact us at support@starpio.com for any data requests.

Changes to This Policy

We may update this policy from time to time. Material changes will be posted here with an updated "Last updated" date.

Contact

Questions about this policy: support@starpio.com

Privacy Policy