Legal & Compliance

Privacy Policy

Effective Date: 17 September 2026 · Version 2.0

1. Who We Are

Brotherhood Consulting is the operating brand of Brotherhood Productions and Studios Pvt. Ltd. (CIN U92100UP2017OPC098541), an Indian private limited company. Registered office: Tower C, Golden I, 414D, Techzone 4, Greater Noida, Uttar Pradesh 201308, India. Brotherhood Reviews is our proprietary reputation intelligence and review management platform for multi-location businesses and service enterprises.

For privacy inquiries, data subject rights, or security disclosures, contact our privacy team at hello@brotherhoodconsulting.com.

2. Information We Process

We process only the minimum information necessary to deliver our reputation management and AI drafting infrastructure:

Merchant Account & Profile Data: Name, work email address, and authentication credentials managed securely via Supabase Auth.
Business & Location Configuration: Business name, physical operating address, phone number, category, and public Google Place IDs supplied by the merchant.
Google Business Profile (GBP) Data: When connected via Google OAuth, we access authorized location information, public customer reviews (star rating, review text, reviewer display name, review timestamp), and existing merchant replies.
Private Customer Feedback: Customer feedback submitted through the private feedback gate (feedback text, optional rating for triage, and optional customer contact information if voluntarily supplied).
Technical & Telemetry Data: IP addresses, browser user-agent, session timestamps, and system logs necessary for security auditing and uptime monitoring.

3. Google API Services User Data Policy & Limited Use Disclosure

Brotherhood Reviews' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

We do not sell Google user data to third parties, advertisers, data brokers, or data marketplaces.
We do not use Google user data to train generalized artificial intelligence or machine learning models.
We do not use Google user data for advertising, retargeting, or credit assessment.
Access to Google user data is strictly restricted to providing merchant review aggregation and human-approved reply drafting features requested by the authenticated account holder.

4. Encrypted Token Storage & Security Safeguards

OAuth access tokens and refresh tokens granted by Google will be stored encrypted at rest using server-side AES-256 encryption. This AES-256 storage disclosure describes our committed launch standard; completing GBP-1B token-encryption implementation is an absolute launch-blocking requirement for this policy before live Google Business Profile connectivity ships.

Once operational, tokens will be decrypted only at execution time by backend serverless functions directly communicating with authorized Google Business Profile API endpoints. Tokens are never transmitted to client browsers, logs, or third-party monitoring platforms.

We maintain strict least-privilege database row-level security (RLS) policies ensuring that each merchant organisation can only access data belonging to its authorized workspaces.

5. Human-in-the-Loop AI Drafting Policy

Brotherhood Reviews utilizes generative AI (Google Gemini API) to generate context-aware draft responses to customer reviews. We adhere to an uncompromising governance principle:

Autonomous posting is strictly disabled.

All AI-generated text is delivered exclusively as an editable draft within the merchant dashboard. Every single reply requires explicit human review, manual approval, and intentional dispatch by an authorized operator before publishing to Google Business Profile.

6. Prohibition of Review Gating & Rating Disparity

In strict compliance with Google Business Profile policies and consumer protection regulations:

We never filter, intercept, gate, or prevent dissatisfied customers from leaving a public Google review.
Links to public review platforms are provided without condition or selective routing.
Private feedback forms are optional and explicitly distinct from public review mechanisms.
We do not offer incentives, discounts, or payments in exchange for customer reviews.

7. Service Providers & Infrastructure

We partner with enterprise infrastructure providers who maintain SOC 2, ISO 27001, and GDPR compliance:

Supabase: Managed PostgreSQL database, encrypted authentication, and row-level security.
Railway: Containerized production hosting and deployment infrastructure.
Google Cloud Platform: Google Business Profile API connectivity and Gemini generative drafting models.

8. Data Retention, Revocation & Deletion Rights

Merchants and users maintain full control over their data:

Revoke Google Access: You can disconnect your Google Business Profile at any time from your dashboard or via your Google Security Account Permissions. Revocation immediately invalidates stored tokens.
Data Deletion Protocol: You may submit an automated or manual deletion request by contacting hello@brotherhoodconsulting.com. All account records, location data, cached reviews, and credentials will be permanently purged within 30 days.

9. Governing Law

This Privacy Policy is governed by the laws of India. For disputes arising from this policy, the competent courts in Ghaziabad / Gautam Buddha Nagar, Uttar Pradesh, India shall hold exclusive jurisdiction (subject to confirmation with legal counsel).