Privacy Policy

Last updated: April 27, 2026

Apnosh (“we”, “us”, “our”) operates portal.apnosh.com, a private dashboard used by our restaurant marketing clients to view performance across the channels Apnosh manages on their behalf. This policy describes what data we collect, how we use it, who can see it, and how it is protected.

Who this applies to

This policy applies to two groups: (1) businesses that have engaged Apnosh as their marketing agency and use the portal to view their data, and (2) Apnosh staff who operate the portal on behalf of those clients.

Data we collect

From the businesses we manage

  • Business profile information you authorize us to access (name, address, hours, services)
  • Performance metrics from Google Business Profile (impressions, calls, direction requests, website clicks, photo views, search queries) — read-only, only for locations where Apnosh holds a Manager role
  • Social media performance metrics from Instagram, Facebook, TikTok, and LinkedIn for connected accounts
  • Website analytics from Google Analytics and Search Console for connected properties
  • Reviews and ratings from Google Business Profile
  • Content, briefs, and assets you provide to us
  • Communications between you and your account manager

From portal users (logging in)

  • Email address (for authentication)
  • Login timestamps and IP address (for security audit)

How we use Google Business Profile data specifically

For clients who have added Apnosh as a Manager on their Google Business Profile, we read performance data through the Google Business Profile Performance API for the sole purpose of presenting that client’s own metrics back to them in the portal. Specifically:

  • We never write to, modify, delete, or moderate Google Business Profile content via the API. Read-only scopes only.
  • We never aggregate one client’s GBP data with another client’s data.
  • We never share, sell, or expose one client’s data to other portal users — strict per-client row-level security in our database enforces this.
  • We never use GBP data to train machine learning models or for any purpose other than reporting to that specific client.
  • We delete GBP data on request within 7 days of a client offboarding from Apnosh.

How we use your data overall

  • To render dashboards in the portal showing your performance across channels
  • To generate monthly reports your account manager reviews with you
  • To inform the content, ads, and SEO work we do on your behalf
  • To bill you for the services you have agreed to

We do not use your data for advertising. We do not sell your data. We do not share your data with anyone outside Apnosh and the sub-processors listed below.

Where data is stored and how it is protected

Your data is stored in a private Supabase Postgres database hosted in AWS us-west-2. Access is gated by row-level security policies — each client’s login can only see rows tied to their own organization. Connections to the portal use HTTPS exclusively. OAuth tokens for connected platforms (Google, Meta, etc.) are stored encrypted at rest and never exposed in client-side JavaScript. Apnosh staff access is limited to the specific account manager assigned to your account and the company owner.

Sub-processors

We use the following third-party services to operate the portal. Each receives only the minimum data needed to perform its function:

  • Supabase — database, authentication, file storage
  • Vercel — application hosting
  • Stripe — billing and invoicing (only billing-related data is shared)
  • Anthropic — AI-assisted content suggestions (only content you explicitly send to AI features)
  • Google Cloud — for Google API access (Drive, Business Profile, Analytics, Search Console)
  • Resend / SendGrid — transactional email

Your rights

You can request a copy of all data we hold about your business at any time. You can request deletion of your data at any time. You can revoke API access we have to your connected platforms at any time through the platform’s own settings (e.g., removing Apnosh as a Manager on your Google Business Profile). We will respond to data requests within 30 days.

Cookies

We use a single first-party session cookie to keep you logged in. We do not use third-party advertising cookies, tracking pixels, or analytics cookies on the portal.

Children

The portal is a B2B service. We do not knowingly collect data from anyone under 18.

Changes to this policy

We will notify you by email of any material change to this policy at least 14 days before the change takes effect. The current version is always at portal.apnosh.com/privacy.

Contact

Questions about this policy or your data: apnosh@gmail.com.