Privacy & Cookie Policy

Last updated: October 26, 2026

This Privacy Policy explains what personal data LORENGRAFF Technologies, Inc. ("LORENGRAFF ®", "we", "us") collects, for what purpose we use it, with whom we share it, how long we retain it, and what rights you have over it. It applies to the website lorengraff.net, all its subdomains, and specifically to the digital business management platform LORENGRAFF Business, available at https://business.lorengraff.net.

MyCorreoApp application. Data processing by our MyCorreoApp mail app (Android, iOS and desktop) is described in its own policy: MyCorreoApp Privacy Policy. To delete an app account: Delete your MyCorreoApp account.

1. Data Controller and Contact

The data controller for information collected directly by us is LORENGRAFF Technologies, Inc. For any inquiries regarding privacy, to exercise your rights, or to request the deletion of your data, you may contact us at [email protected]. To report a security incident or abuse: [email protected].

2. What is LORENGRAFF Business

LORENGRAFF Business is a subscription-based platform through which our team manages the digital presence of local businesses (restaurants, hotels, real estate, and commercial enterprises): their Google Business Profile, reviews, Google Analytics metrics, social media channels, and WhatsApp customer communications. The business owner selects a plan, completes an onboarding form, and, optionally, authorizes access to their Google or Meta accounts so we can deliver the service.

3. Information We Collect

a) Data you provide to us. When contacting us or completing the onboarding form: business name, contact person name, email address, phone and WhatsApp numbers, physical address, business hours, website, social media profiles, business description, services offered, keywords, and selected plan.

b) Payment data. Subscription payments are processed securely through PayPal. We do not receive or store credit or debit card numbers. We retain only the subscription ID, status, plan, amounts, and billing dates communicated by PayPal.

c) Google Data (only if you authorize the connection). See Section 4.

d) Meta and WhatsApp Data (only if the client connects accounts). WhatsApp or Meta user IDs, associated phone numbers and names, messages sent and received, multimedia attachments shared in conversations, and delivery and read status of messages.

e) Technical data. IP address, browser type, requested pages, date and time, error and security logs, and the cookies described in Section 9.

4. Use of Google User Data

When a platform administrator or client connects their Google account via "Sign in with Google" (OAuth 2.0), LORENGRAFF Business requests only the following permissions:

openid, email, and profile: to identify the connected Google account (name and email) and display it within the dashboard.
https://www.googleapis.com/auth/business.manage (Google Business Profile): to list the business accounts and profiles you manage, read and update profile details you select (name, description, phone, website, and hours), read customer reviews and publish responses drafted by you or our team, and monitor profile performance metrics (views, searches, calls, direction requests, and website clicks).
https://www.googleapis.com/auth/analytics.readonly (Google Analytics): to list Google Analytics 4 properties you have access to and read traffic reports for the selected property (users, sessions, page views, key events, and traffic sources). This permission is read-only: we never modify your Analytics configuration.

How we use Google user data. Exclusively to provide the contracted service: displaying metrics and reviews to the business owner and our team in the dashboard, keeping Google listings up to date, and replying to reviews. We do not use Google data for advertising, do not sell it, and do not use it for profiling or credit scoring.

Compliance with Google API Services User Data Policy. LORENGRAFF Business's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We only use Google data to provide or improve visible, user-facing platform features that you use.
We do not transfer Google data to third parties, except as necessary to provide the service, comply with applicable law, or as part of a merger or acquisition, always under equivalent safeguards.
We do not use Google data to serve advertisements, and we never sell Google data to data brokers or advertising exchanges.
No humans read Google user data, except with your explicit prior consent for specific situations (e.g., technical support), when required for security or legal compliance, or when data is aggregated and anonymized for internal analytics.
We do not use Google data to develop, improve, or train generalized artificial intelligence or machine learning models.

Storage and Protection. Access and refresh tokens provided by Google are stored encrypted in our database and are accessible only to the server; they are never transmitted to the browser. Performance metrics and reviews are stored to display them in the client dashboard.

Revoking Access. You may disconnect your Google account at any time from your dashboard (Settings → Google → Disconnect) or through https://myaccount.google.com/permissions. Upon disconnection, we immediately delete stored tokens; you may also request the deletion of all stored metrics and reviews by writing to [email protected].

5. Purposes and Legal Bases

Providing contracted services (business onboarding, profile management, social channels, reviews, metrics, and customer support): contract performance.
Managing payments and subscriptions: contract performance and statutory accounting obligations.
Monitoring security and uptime of client websites and our platform: legitimate interest.
Responding to inquiries: your consent or pre-contractual measures.
Sending commercial updates: only with your explicit consent, which may be withdrawn at any time.

6. Sharing Data with Third Parties

We do not sell or rent personal data. We share data only with service providers essential to operational delivery, each operating under their respective privacy policies:

PayPal: payment and subscription processing.
Google: Google Business Profile and Google Analytics, when connected by the user.
Meta Platforms: Facebook, Instagram, and WhatsApp Business API, when connected by the client.
Hosting, Infrastructure, and CDN Providers: secure hosting servers and Cloudflare network delivery and DDoS protection.
AI Service Providers: only if the client enables assisted copywriting features (e.g., proposing draft responses to customer reviews or messages). Google data is never used to train these models.
Public Authorities: when required by statutory law or lawful court order.

7. Data Processed on Behalf of Clients

When managing WhatsApp chats, social media messages, or business reviews on behalf of a local business, that business is the data controller and LORENGRAFF ® acts as a data processor: we process information strictly following their instructions, adhering to Meta and Google API terms, and limiting access to authorized staff via authenticated, encrypted channels.

8. Retention and Deletion

Client and service data: retained while the subscription remains active. Upon cancellation or non-payment, we follow our Terms and Conditions retention schedule and subsequently erase the data.
Google and Meta tokens: retained until the account is disconnected or access is revoked.
Payment and financial records: retained for periods mandated by applicable tax and accounting laws.
Technical and security logs: retained for the duration necessary to detect and remediate incidents.

Requesting data deletion. Send an email to [email protected] from the account associated with your service, specifying your business name. We will verify your identity and delete your data (except records required by law) within 30 days.

9. Cookies and Local Storage

Cookies are small text files stored in your browser. We utilize:

Essential technical cookies: session cookies and CSRF protection tokens (XSRF-TOKEN). Essential for forms and authentication.
Browser local storage: saves draft onboarding inputs to prevent data loss during network disruptions. Cleared upon form submission.
Cloudflare security and performance cookies: safeguarding the site against malicious automated traffic and attacks.
Analytics cookies (Google Analytics) on lorengraff.net: measuring aggregated statistical metrics on visited pages and engagement.

You may delete or disable cookies in your browser settings. Disabling technical cookies may impair website functionality.

10. Security

All communication is encrypted via TLS/HTTPS. Integration credentials (Google, Meta, PayPal) are stored strongly encrypted, dashboard access requires secure authentication, and we enforce security headers, rate limiting, and regular patches. While no system is invulnerable, if an incident impacting your data is discovered, we will notify you without undue delay. Details in our Information Security Policy.

11. Your Rights

You may request access, rectification, deletion, or portability of your data, restrict or object to processing, and withdraw consent at any time by contacting [email protected]. We reply within 30 days. You also hold the right to lodge a complaint with your local data protection authority.

12. International Transfers

Our service providers (e.g., Google, Meta, PayPal, Cloudflare) may process data outside your country of residence under standard contractual clauses and recognized international transfer mechanisms.

13. Children's Privacy

Our services are strictly directed to businesses and professionals. We do not knowingly collect personal data from individuals under 18.

14. Third-Party Links

This site may link to third-party websites. We have no control over and assume no liability for their privacy practices. Review their respective privacy notices.

15. Changes to this Policy

We may update this policy to reflect service changes or statutory updates. We publish revisions on this page with the updated date and notify clients via email for material modifications.

Privacy and Cookie Policy