Effective date: September 29, 2026
Last updated: September 29, 2026
Sculpt (“Sculpt,” “we,” “us,” or “our”) operates Sculpt Reviews, a service that helps authorized businesses and their service providers view and respond to reviews associated with their business locations. This policy explains how Sculpt Reviews collects, uses, stores, and shares information, including information received through Google APIs.
Information we collect
Account and organization information
We may collect your name, email address, login information, organization, role, notification settings, and the client accounts and business locations you are authorized to access.
Google account and Business Profile information
When an authorized user connects a Google account, Sculpt Reviews may receive the Google identity needed for authorization; OAuth access and refresh tokens; Business Profile account and location identifiers, names, addresses, and access relationships; review content, ratings, reviewer information made available by Google, timestamps, and existing owner replies; and notification or API status needed to detect new or changed reviews.
Connecting a Google account does not automatically enroll every business visible to that account. A Sculpt administrator must assign approved locations to the correct client workspace.
Activity, security, and technical information
We may collect sign-in events, review-view and reply-approval activity, connection and delivery status, device and browser information, IP address, error logs, and security events to operate, protect, troubleshoot, and audit the service.
How we use information
- Authenticate users and maintain sessions.
- Connect only approved Google Business Profiles.
- Display reviews in the correct client workspace.
- Send requested in-app and email notifications.
- Let an authorized user draft, review, and explicitly confirm a reply.
- Submit a confirmed reply to the selected Google Business Profile.
- Prevent cross-client access, fraud, misuse, and unauthorized actions.
- Provide support, diagnose errors, maintain audit records, comply with law, and enforce agreements.
Sculpt Reviews does not automatically publish an AI-generated reply. A reply is submitted only after an authorized user confirms the final text, review, and business location.
Google user data and Limited Use
Sculpt Reviews’ use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements.
We use Google user data only to provide and protect the review-management features described here. We do not sell Google user data, use it for advertising, transfer it to data brokers, or use it to train general-purpose artificial intelligence or machine-learning models. We do not allow people to read Google user data unless necessary to provide or secure the service, the user gives specific permission, or the law requires it.
How we share information
- With the client organization whose workspace and approved business location the information belongs to.
- With Google when a user authorizes a connection or submits a confirmed action.
- With vendors providing hosting, email delivery, monitoring, security, and support under appropriate confidentiality and data-protection obligations.
- When required by law or necessary to protect rights, safety, and service integrity.
- As part of a business transaction, subject to appropriate notice and protection.
We do not share one client’s reviews, account data, credentials, or activity with another client.
Storage and retention
Google Business Profile content is stored only in limited amounts needed to operate Sculpt Reviews, is protected, and is refreshed or deleted within 30 calendar days. It is not kept to avoid Google usage tracking or combined into unrelated datasets.
OAuth tokens are stored in encrypted server-side storage while a connection remains active. When access is disconnected or no longer needed, we revoke tokens where supported and permanently delete them. Account, security, consent, and action records are retained only as reasonably needed for service operation, security, legal obligations, and dispute resolution. Email notifications use a link to the authenticated service and avoid review text by default.
Security
We use administrative, technical, and organizational safeguards designed to protect information, including encrypted connections, encryption of sensitive tokens at rest, role-based and client-based access checks, restricted administrative access, redacted logs, one-time authorization state, and records of reply approvals. No security system can guarantee absolute protection.
Your choices and controls
- Change notification preferences.
- Disconnect a Google connection in Sculpt Reviews.
- Revoke Sculpt Reviews through Google Account permissions.
- Request access, correction, export, or deletion of account information by contacting us.
When a client ends its relationship with Sculpt Reviews, we provide a prompt method to disconnect its Business Profile account and remove our permissions, including Google’s required disassociation period where applicable. Limited records may remain when required for security, legal compliance, or dispute resolution.
Children’s privacy
Sculpt Reviews is a business service and is not directed to children under 13. We do not knowingly collect personal information from children through the service.
Changes to this policy
We may update this policy as Sculpt Reviews changes. We will post the revised policy with a new effective date and provide additional notice when a change materially affects how we use information.
Contact us
Sculpt
Email: james@sculptconsulting.com
Website: https://www.sculptconsulting.com/
Mailing address: 501 Plantation Park Drive, Loganville, GA 30052