Privacy policy

Who we are

Cibita is operated by Murat Koyuncu, trading as Cibita, based in London, United Kingdom. We are the data controller for the personal data described in this policy, except where we act on a client's instructions as described below. You can reach us at privacy@cibita.co.uk.

What we do

We manage Google Business Profiles and Google Ads for local businesses that have engaged us (our clients). Business owners can sign in to a dashboard to see their results, reviews and monthly reports.

The personal data we process and why

• Client contacts and users: name, email address, preferred language and sign-in records, so that you can access your dashboard. Basis: performance of our contract with the client.
• Business information: name, address, phone number, opening hours, services, website content and Google account identifiers for the businesses we manage. Basis: contract.
• Google reviews of client businesses: the reviewer's public display name, rating, review text, date and our reply, so that we can draft and post replies on the client's behalf and report on reviews. Basis: the legitimate interests of the client and of us in responding to public reviews. This information is already public on Google.
• Google Ads performance data: search terms, clicks, costs, conversions and call reporting such as call duration and whether a call was answered. We do not store callers' full telephone numbers. Basis: contract.
• Enquiries: if you contact us by WhatsApp, phone or email, we keep the message and your contact details to reply. Basis: legitimate interest in answering you.
• Emails we send: delivery records for monthly reports and sign-in codes. Basis: contract.

Google API Services

We access Google Business Profile and Google Ads data through Google's APIs, using accounts that our clients have authorised us to manage. We request the business.manage and adwords permissions, and we access only the profiles and advertising accounts that a client has placed under our management.

Cibita's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements (developers.google.com/terms/api-services-user-data-policy).

We do not sell data obtained from Google, do not use it for advertising other than managing the client's own campaigns, and do not use it to develop or train generalised machine learning models.

Automated drafting

We use a third-party language model service to draft review replies, campaign plans and report commentary from the data described above. Every draft that changes a client's account or is posted publicly is reviewed by a person before it takes effect, except replies to 4 and 5 star reviews where a client has chosen automatic replies. The provider processes data only to provide the service and does not use it to train its models. A list of our service providers is available on request.

Where data is stored and who helps us

• Supabase: database and sign-in, hosted in London, United Kingdom.
• Vercel: web hosting.
• Railway: background processing, hosted in the European Union.
• Resend: sending email, hosted in the European Union.
• Google: the source of profile and advertising data.
• Where a provider processes data outside the United Kingdom, we rely on the UK's adequacy regulations or the International Data Transfer Addendum.

How long we keep data

For as long as the client remains a customer and for 12 months afterwards, unless the law requires us to keep it longer. Monthly reports are kept as records of the service for the same period. Sign-in and processing logs are deleted after 90 days. Enquiries that do not become a client relationship are deleted after 12 months.

Cookies

This website sets one cookie, to remember your language choice. The dashboard uses strictly necessary cookies to keep you signed in. We do not use advertising or analytics cookies.

Your rights

Under UK data protection law you can ask for access to your personal data, correction, erasure, restriction of processing and portability, and you can object to processing based on legitimate interests. Write to privacy@cibita.co.uk.

If you left a review of one of our clients and want it removed from our systems, tell us and we will delete our copy. The review itself is controlled by Google and by you as the reviewer.

You can complain to the Information Commissioner's Office at ico.org.uk.

Security

Data is encrypted in transit and at rest. Access is limited to the people who need it, and every change made to a client's Google account through our platform is recorded.

Changes to this policy

We will post any changes on this page and update the date at the top.