Who we are
Kerbrank is a UK service that measures how visible local businesses are on Google Maps and in ChatGPT. For the account data described below, Kerbrank is the data controller under UK GDPR and the Data Protection Act 2018. You can reach us about anything on this page at support@kerbrank.co.uk.
What we store, and why
| Data | Why we hold it | Lawful basis |
|---|---|---|
| Your name or business name, email address and password | To run your account and sign you in. Passwords are stored only as a salted scrypt hash, never in readable form. | Contract |
| Businesses you track | Names, addresses, websites, categories and the searches you choose. These describe businesses, but a sole trader's details can still be personal data. | Contract, and our legitimate interest in providing the service |
| Scan results | Map positions, competitor listings as Google shows them publicly, ChatGPT answers, search volumes and website checks. We keep the raw results so history stays comparable. | Contract |
| Sign in with Google (optional) | If you sign in with Google, Google tells us your name, your email address (only if Google has verified it) and an ID for your Google account, so we can recognise you next time. We ask Google for nothing else at sign-in and store no Google password or token for it. | Contract: it is how you sign in |
| Google connection (optional) | If you connect Search Console or Business Profile, we store a Google refresh token, encrypted, and the email address of the Google account. We only read from Google; we never post or change anything. | Consent, which you can withdraw by disconnecting |
| Messages you send us | When you use the contact form or the Questions button, we keep your email address, your name if you give it, and your message, so we can reply. We delete them 12 months after they arrive. | Legitimate interest in answering you |
| Questions asked of the assistant | The text of questions typed into the instant-answers assistant, without any name, email or identifier, so we can see which answers are missing and write them. Deleted after 12 months. Answers come from our own help text; questions are only sent to TypeSafe, our answer-matching provider, when that service is switched on. | Legitimate interest in improving our help |
| Visit counts | To see which pages help people and which don't, we count page views: the page address, the website that sent you (its domain only) and whether you were on a phone, tablet or computer. No cookie, no IP address and no identifier are stored, so a visit cannot be linked to you or to your next visit. | Legitimate interest in improving the site |
| Sign-in attempts | Your IP address is held in memory for up to 15 minutes to slow down password guessing. It is not written to our database. | Legitimate interest in security |
We do not buy or build lists of personal contacts, we do not sell data, and we do not use your data for advertising.
Cookies
We set one cookie, kr_session, when you sign in. It keeps you signed in for up to 30 days and cannot be read by scripts on the page. It is strictly necessary under the Privacy and Electronic Communications Regulations, so it does not need your consent. There are no analytics, advertising or tracking cookies, and our website pages load no third-party scripts. Our fonts are served from our own server.
Your browser also remembers a couple of small settings for you, such as having closed the cookie notice or the getting-started list. These stay on your device and are never sent to us.
Who else sees it
We use a small number of suppliers to run the service. Each only receives what it needs.
- DataForSEO runs the Google Maps searches, ChatGPT questions and search-volume lookups. It receives the business name, search phrases and grid coordinates, not your account details.
- TypeSafe helps judge which search ideas and review topics fit a business, and helps the instant-answers assistant pick the right stored answer. It receives the business name, its Google categories, search phrases, the review topics Google shows publicly and the text of questions typed into the assistant, not your account details.
- Resend sends our emails, such as password reset links and the notification when you send us a message. It receives the email address and the message being sent.
- postcodes.io tells us which grid points are near a postcode, so we can leave out the sea. It receives map coordinates only.
- Google, only if you choose to sign in with Google or to connect Search Console or Business Profile.
- Fly.io, our hosting provider, runs the servers and database in London.
- OpenStreetMap supplies the map tiles on shared reports. Someone viewing a report or the map designer loads those tiles from OpenStreetMap's servers, which see the viewer's IP address. The map library itself is served by Kerbrank.
Some of these suppliers may process data outside the UK. Where they do, we rely on the safeguards UK law requires, such as the UK International Data Transfer Agreement or an adequacy decision.
Report links are private but not password-protected: anyone you send a link to can open it. Only share them with people you mean to.
How long we keep it
We keep your account and scan history while your account is open, because the history is what makes weekly tracking useful. When you delete a client or location, its scans are deleted with it. When you disconnect Google, the stored token is deleted. If you close your account, we delete your data within 30 days, except anything we must keep by law, such as billing records.
Your rights
You can ask us for a copy of your data, ask us to correct or delete it, object to how we use it, or ask us to restrict it. Email the address above and we will reply within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put it right first.