Google API use and data access
SureReply helps businesses manage Google Business Profile reviews. Customers connect Google with OAuth, SureReply displays authorized reviews, AI drafts a proposed response, the user reviews or edits it, and SureReply publishes the approved reply back to Google.
Contents
1. Purpose of the integration
SureReply is an AI-assisted review response platform for businesses. The Google integration exists so customers can manage reviews from the Google Business Profile locations they own or are authorized to manage.
The product workflow is visible to users: connect Google, review incoming customer reviews, inspect the AI-generated draft response, edit when needed, then approve and publish the response to Google. Optional 5-star auto-response is off by default and requires a separate, explicit admin opt-in for each location.
2. Google APIs used
Google OAuth 2.0
Used to obtain the customer's explicit authorization before SureReply reads Business Profile data, publishes approved responses, or performs any optional 5-star auto-response action the customer expressly enables.
Google Business Profile APIs
Used to read authorized business locations and reviews, read existing owner replies, and publish responses that the customer approves or explicitly authorizes through optional 5-star auto-response rules.
3. Data we access from Google
| Google data category | Why SureReply needs it |
|---|---|
| Google account identifiers, including email address and account IDs | To authenticate the connected account, associate the integration with the correct SureReply workspace, and make authorized API calls. |
| Business Profile locations and public business details | To let customers select the locations they manage and route reviews to the correct office or business profile. |
| Review content, star ratings, reviewer display names, timestamps, and public reviewer metadata | To show reviews inside SureReply, generate context-aware draft responses, and help users decide what to publish. |
| Existing owner responses and responses published through SureReply | To show whether a review has already been answered, prevent duplicate responses, and keep the SureReply workflow aligned with Google. |
| OAuth access and refresh tokens | To keep the integration working after consent without requiring the customer to sign in before every review action. |
4. How we use Google data
- Display authorized Google reviews in the SureReply dashboard.
- Generate AI-assisted draft responses based on review text, star rating, customer-configured tone, and business context.
- Allow the customer to edit, approve, and publish a response to Google.
- Support optional 5-star auto-response only when an authorized admin explicitly enables it for a specific location.
- Show current owner replies and detect when a review or reply state changes.
- Secure, troubleshoot, and improve the customer-facing review response workflow.
SureReply does not use Google user data for advertising, retargeting, selling data, credit decisions, or training generalized AI models.
5. Customer controls
- Consent first: Google access begins only after the customer completes Google's OAuth consent flow.
- Human review: SureReply's primary workflow requires the customer to review or edit AI-generated drafts before publishing.
- Specific authorization for automation: optional 5-star auto-response is off by default, can be enabled only by an authorized admin for a specific location, and is limited to clearly positive 5-star reviews under customer-controlled rules. Low-star or needs-care reviews require manual approval.
- Revocation: customers can revoke SureReply's Google access at any time from Google Account permissions.
- Deletion: customers can request deletion of their SureReply account and associated Google data at surereply.ai/data-deletion.
6. Google API Limited Use commitment
SureReply's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Google data is transferred only to subprocessors needed to provide the visible SureReply service, such as hosting, authentication, transactional email, and AI model inference for the customer-requested draft response workflow. Current subprocessors are listed in our Privacy Policy.
7. Retention and deletion
SureReply caches Google Business Profile API-provided content temporarily for no more than 30 calendar days. This includes Google-provided review text, reviewer metadata, ratings, timestamps, owner replies, and derived draft/analysis data created from that content. After that window, the content is redacted or deleted unless re-synced through an active customer authorization.
OAuth tokens are deleted when the customer disconnects Google or deletes their account. We do not store Google Business Profile content to build a separate public database, resell data, create advertising profiles, aggregate unrelated datasets, or prevent Google from tracking API usage. Customers can review deletion timelines and request removal at surereply.ai/data-deletion.
8. Contact
Questions about SureReply's Google API use can be sent to hello@surereply.ai.
SureReply is not affiliated with, endorsed by, or sponsored by Google. Google and Google Business Profile are trademarks of Google LLC.