Client Builder Pro

Privacy Policy

Last Updated: September 25, 2026

1. Who We Are

Client Builder Pro is operated by MK153 INC.

Client Builder Pro helps local businesses collect and respond to customer reviews. This Privacy Policy explains how we collect, use, share and delete information when businesses use the Client Builder Pro Platform, and when their customers ("patrons") use a review page the Platform hosts for a business.

2. Information We Collect

  • Account and contact information for business owners (name, email, phone, business details)
  • Google Business Profile data the owner connects (see Section 3)
  • Patron information collected on a business's behalf (see Section 5)
  • Billing information handled by Stripe (we do not store card numbers)
  • Usage and technical data (logs, timestamps, and IP addresses used for rate limiting)
  • Communications you send to us

We do not intentionally collect sensitive personal information.

3. Google User Data

When a business owner connects Google, we request the Google Business Profile business.manage scope. We use it to read the business's locations and reviews (reviewer display name, rating, review text and date) and to post replies to those reviews. Replies are posted only as the owner directs: after the owner approves a draft, or automatically under the automatic-reply setting the owner chooses. Google access tokens are stored encrypted.

Client Builder Pro's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

  • We use Google user data only to provide and improve the review features the business owner uses.
  • We do not use Google user data for advertising, and we do not sell it.
  • We do not use Google user data to train generalized AI or machine-learning models.
  • We transfer Google user data to others only as needed to provide those features (such as the AI drafting providers in Section 6), to comply with law, or as part of a merger or acquisition.
  • No person reads Google user data unless the owner has given affirmative agreement for specific messages, it is needed for security purposes (such as investigating abuse), it is needed to comply with law, or it is aggregated and anonymized for internal operations.

4. How We Use Information

  • Provide and operate the Platform, including drafting and posting review replies
  • Send business owners approval, alert and digest emails
  • Deliver a patron's private message to the business it was sent to
  • Maintain security, prevent misuse and keep the service running

5. Patron Data Collected on a Business's Behalf

A patron who taps a business's review card is offered two equal choices: leave a Google review (which happens on Google, not on this Platform) or send the business a private message. A private message may include, optionally, a name, an email address and a phone number. We collect this for that business and process it on the business's behalf.

  • A private message, with any contact details, is emailed to the business so it can follow up. The patron is told the message was sent only after our email provider accepted it for delivery; if it could not be sent, the patron is told so. If the patron left an email address and the message was sent, we send them one thank-you email. Patrons are not added to a mailing list.
  • A patron who ticks the SMS box is telling that business it may text them; we do not send SMS to patrons.
  • If the patron left an email address or phone number, a copy of the private message is also kept as a record for the business in ClientBuilder CRM: the message text, name, email address, phone number and SMS choice. The retention periods in section 7 apply to the copy on this Platform; the CRM copy is deleted on request (see section 8).
  • While a business is paused, its review page still offers every visitor the Google review link. For the first 30 days of the pause it also still offers the private message option, and messages are delivered to the business as before; after that the private message option is hidden and no private messages are accepted for it.
  • Every visit to a review page is logged as a session, whether or not the patron sends anything: a random session ID, the card and business, the browser's user agent string, which buttons were pressed and when (opening or closing the message form, sending a message, and following the Google review link, recorded with the link and the screen it was followed from). Each of these requests also leaves a rate-limit record of the visitor's IP address (see section 7). Opening a card's short link also records a card view: the card, the business and the time.

We do not sell personal information.

6. Service Providers

We share information with these service providers only to operate the Platform:

  • OpenAI: drafts review replies (review text, reviewer display name, rating and the business context the owner provides)
  • OpenRouter (Google Gemini): backup reply drafting when OpenAI is unavailable (the same data as above)
  • Inngest: runs background jobs such as review sync, reply drafting and scheduled emails; job data passes through it
  • Resend: sends email (approval and alert emails to business owners, the patron thank-you email, sign-in links)
  • Clerk: account sign-in and authentication
  • Stripe: payments and subscriptions; we do not store card numbers
  • Supabase: database hosting
  • ClientBuilder CRM: our affiliated CRM, which keeps lead and patron records, including the text of a patron’s private message (see Section 5)
  • MillionVerifier: checks whether email addresses submitted through our forms can receive mail
  • Telegram: internal operator alerts about service failures; these carry at most a rating, a reviewer’s first initial and the business concerned, never a full name, review text or a patron’s message or contact details

If a business owner sets up their own alert webhook, low-rating alerts sent to it contain the rating, the reviewer's public Google display name and the review text, as shown on Google. We may also disclose information when required by law or to protect the rights, safety or integrity of the Platform.

7. Data Retention

We are putting automatic deletion in place on the schedule below. Until it is switched on, these records are deleted on request (see section 8).

  • Rate-limit records (IP addresses of visitors to public pages): planned: deleted after 30 days, once automatic deletion is switched on; until then kept and deleted on request
  • Magic sign-in links: planned: deleted 7 days after they expire, once automatic deletion is switched on; until then kept and deleted on request
  • Patron submissions and review-page session logs (private messages, contact details, and the session events described in section 5): planned: deleted after 12 months, once automatic deletion is switched on; until then kept and deleted on request
  • Review data (Google reviews, drafts and replies): planned: deleted 12 months after the business is paused (its subscription ended), once automatic deletion is switched on; until then kept and deleted on request

Account and billing records are kept as long as needed to operate the Platform, meet legal and accounting obligations, and resolve disputes.

8. Disconnecting Google and Deleting Data

When a subscription ends or lapses (the owner cancels it, the final payment fails, Stripe marks it unpaid or paused, or a complimentary plan ends), the business is paused. Nothing is deleted when it pauses: we stop reading reviews, drafting and posting replies and sending review emails, and we keep the business’s settings, review history and drafts. The owner can reactivate at any time from the Billing page. A refund on its own does not end a subscription.

We keep the stored Google access token while a business is paused; we do not use it while the business is paused. If the owner reactivates within 30 days of pausing, Google switches back on without reconnecting. We revoke the token when asked (see below); automatic revocation is not switched on. A paused business’s review data is kept while it is paused; we delete it when asked (see below). Automatic deletion 12 months after pausing is not switched on.

When a business owner disconnects Google, we revoke our Google access token straight away. Owners can also remove access at any time from their Google Account permissions page.

To request access to or deletion of your data, email hello@clientbuilder.pro. Patrons can contact the business directly or write to us, and we will handle the request with that business.

9. Security

We implement reasonable technical and organizational measures to protect information. However, no system is completely secure.

10. Children's Information

The Platform is not intended for use by individuals under 13 years of age.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised "Last Updated" date.

12. Contact Us

For questions about privacy or data handling:

hello@clientbuilder.pro