Privacy Policy
Last updated: October 16, 2026
Athena Growth Marketing (“Athena”, “we”) operates AthenaOS, an internal operations panel used by our team to manage the online presence of the businesses we serve. This policy explains what information AthenaOS receives from Google (the “GBP Intelligence” module, staff sign-in with Google, and the optional Google Calendar connection), why, and how it is protected.
1. Who uses the application
The application is not offered to the general public. It is used only by Athena staff, to monitor the Google Business Profile locations that our clients have authorized us to manage and to organize our own daily work. Our clients grant access by adding Athena as a manager of their profile in Google Business Profile.
2. Information we access from Google
With the authorization of an Athena account that manages the profiles, the application reads, through the Google Business Profile APIs:
- Account and location data: business name, address, phone, website, categories, hours, services, description, status and verification state.
- Performance metrics: daily impressions, calls, website clicks, direction requests and monthly search keywords.
- Reviews: star rating, date, review text and whether the business replied. We do not store the reviewer’s name or profile.
- Content activity: number and date of posts and number of photos.
We do not read the e-mail, contacts or files of any user.
2.1 Sign-in with Google and Google Calendar (Athena staff only)
Athena employees can sign in to AthenaOS with their Google account, and can optionally connect their own Google Calendar:
- Sign-in uses the OpenID Connect scopes
openid,emailandprofile. We read the verified e-mail address and name only to check that the person is an active member of the Athena team and to open their session. Anyone whose e-mail is not on the team list is refused. - Google Calendar uses the read-only scope
https://www.googleapis.com/auth/calendar.events.owned.readonly, and only when the employee clicks “Connect my calendar”. We read the events of that employee’s own calendar for the current day (title, start and end time, location and video-call link) and show them only to that same employee, on their own home screen, next to their tasks. We never create, edit or delete events, and we do not read other people’s calendars. - What we store: events are fetched live each time the screen opens and are not saved in our database. We store only an encrypted refresh token (AES-256-GCM) so the connection keeps working. It is never shown in the panel or sent to the browser; it is readable only by our server code.
- Control: the employee can disconnect at any time in “My account”, which deletes the stored token and revokes the access at Google. Access can also be revoked at myaccount.google.com/permissions.
3. How we use it
The Business Profile data is used only to show our team the health and performance of each client profile, to alert about issues (for example an unanswered review or a profile that stopped being verified) and to prepare performance reports for the client that owns the profile. Calendar data is used only to show each employee their own schedule. We do not use any Google data for advertising, we do not build profiles of individuals, and we do not sell or rent it.
4. Google API Services User Data Policy
AthenaOS’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: data is used only to provide the user-facing features described above; it is not transferred to third parties except as needed to operate the service, to comply with law, or with the owner’s consent; it is not used for advertising; and humans do not read it unless needed for security, to comply with law, or to support the owner of the profile.
5. Storage, sharing and security
Data is stored in our database hosted by Supabase and is displayed in an access-controlled panel hosted on Vercel. Access requires an individual login, and database rules restrict what each user can see. Credentials and tokens are kept in server-side configuration and are never exposed in the browser. We share data with the client who owns each profile and with infrastructure providers acting on our behalf, and with no one else.
6. Retention and deletion
Calendar events are not retained. The calendar token is deleted when the employee disconnects or on request. Performance history is kept while the client relationship lasts, so trends can be compared over time. When a client ends the relationship, or on request, we delete that client’s stored data. You can also revoke the application’s access at any time at myaccount.google.com/permissions; after revocation, we stop collecting new data.
7. Your rights and contact
To ask what we hold, correct it or have it deleted, contact us at contact@athenagrowthmarketing.com. We respond within 30 days.
8. Changes
If we change this policy we will update the date above. Material changes in how we use Google data will be published here before they take effect.