Privacy policy

Last updated: 17 October 2026

This policy explains what personal data GBP Spy and this website process. The data controller is Paul Massey trading as Lean Strategy Guru, Cornwall, United Kingdom. Contact: gbp-spy@leanstrategy.guru.

1. The extension

GBP Spy works by reading the Google Maps data your browser has already loaded. Your captured business data never leaves your browser. Captured businesses, your settings, your agency name and your licence status are stored in Chrome's local extension storage (chrome.storage.local) on your device. CSV files and PDF reports are generated in your browser. GBP Spy has no analytics, telemetry, tracking, third-party scripts, fonts or background servers.

The extension makes only these outbound requests:

• Google Maps. If GBP Spy missed data while the page loaded, it may re-request the same Google Maps search or place-detail URL that Maps itself used, from your browser cache or from Google. This goes to Google with your normal Maps session, exactly as scrolling the page would, and no extra data is added.
• Lemon Squeezy licence API (api.lemonsqueezy.com). Only if you enter a Pro or Lifetime licence key: when you click Activate, Check now or Deactivate, and once every 24 hours while a key is stored. The request contains your licence key, an instance name such as "Chrome on Windows" with an 8-character random install ID, and, on later checks, the instance ID Lemon Squeezy issued. It never includes search queries, business names, your agency name or exports. If no key is entered, this request never happens.
• Checkout links open in a new tab only when you click a Buy button.

2. Purchases

When you buy GBP Spy, Lemon Squeezy collects your name, email address, billing address and payment details as merchant of record. We receive your name, email address, country and order details so we can provide the product and support. See Lemon Squeezy's privacy policy for how they handle your data.

3. This website

This website does not use cookies, analytics or tracking. Our hosting provider (Netlify) may keep standard server logs, such as IP address and time of request, for security purposes.

4. Emails

If you email us, we keep the correspondence for as long as needed to help you and for our records.

5. Legal basis and retention

We process customer data to perform our contract with you and to meet legal obligations, such as keeping financial records for six years. We do not sell personal data.

6. Your rights

Under UK GDPR you can ask to access, correct or delete your personal data, or object to its processing. Email us and we will respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).