Last updated: October 2026
Advantage Synergies LLP, 3rd Floor Suite, 207 Regent Street, London, England, W1B 3HH, United Kingdom (Companies House No. OC444202)
This agreement applies where LocalEdge processes personal data on behalf of a customer, for example the names of reviewers and the text of reviews in the customer's Google Business Profile. It forms part of the LocalEdge Terms of Use. LocalEdge is operated by Advantage Synergies LLP, a limited liability partnership registered in England and Wales (Companies House No. OC444202), 3rd Floor Suite, 207 Regent Street, London, W1B 3HH, United Kingdom, trading as LocalEdge by Avision (the "Processor"). The "Customer" is the person or organisation using LocalEdge, including on the free LocalEdge Lite plan.
For personal data in the Customer's Google Business Profile that LocalEdge processes to provide the service, the Customer is the controller and the Processor is the processor. For account and billing data, the Processor is a controller, as described in the Privacy Policy. Where the Customer manages profiles on behalf of its own clients, the Processor acts as a sub-processor, and the Customer confirms that it is authorised to appoint the Processor. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and, where applicable, the EU GDPR.
The Processor processes the data only to provide LocalEdge: connecting to the Customer's Google Business Profile through the official API with the Customer's authorisation, displaying and analysing profile data, monitoring changes, generating suggestions with AVI for the Customer to review, and publishing content only on the Customer's instruction. Annex A gives the details.
The Processor will: process personal data only on the Customer's documented instructions, which are the use of the service and the Terms of Use, unless the law requires otherwise; make sure that people authorised to process the data are bound by confidentiality; apply the technical and organisational measures in Annex B; help the Customer, taking into account the nature of the processing, to respond to requests from individuals and to meet its own obligations on security, breach notification and impact assessments; tell the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data; not sell the Customer's personal data, use it for advertising, or train or fine-tune AI models on it; and make available the information reasonably necessary to show compliance with this agreement.
LocalEdge includes an assistant called AVI, which relies on Google Gemini models. To produce a suggestion at the Customer's request, the relevant content is sent for that request to an AI routing service operated by a third party (see Annex C), which passes it to the model provider. For a draft review reply, this content is the text of the review (shortened if it is very long), the first name of the reviewer when it can be identified, and the business name and category. For other suggestions, such as post drafts or chat answers, it is the information the Customer provides together with the business name, category and city. For chat answers, the profile context may also include a short excerpt (about 100 characters) of the latest review, without the name of its author. For draft review replies, the Processor configures the requests so that they are routed only to model providers that, according to the routing service's published provider policies, do not collect request data. The Processor does not train or fine-tune AI models on the Customer's data. The Processor does not filter review text for sensitive information before it is sent. AVI keeps conversation history and basic profile context in the Customer's account to keep its suggestions relevant. Nothing generated by AVI is published on the Customer's behalf without an action from the Customer, such as publishing it, scheduling it or setting up a recurring schedule.
The Customer gives general authorisation for the categories of sub-processors in Annex C. The Processor will bind each sub-processor by terms that provide data protection obligations no less protective than this agreement, and remains responsible for them. The Processor will inform the Customer of any intended change of sub-processor, by email or by notice in the service, and the Customer may object on reasonable grounds; if the parties cannot agree, the Customer may stop using the service and close its account.
Customer data is stored on servers in Germany. When the Customer asks for an AI suggestion, the content sent for that request is processed by the services described in section 4 and Annex C, which may be located outside the United Kingdom and the European Economic Area, including in the United States. Where personal data is transferred outside the United Kingdom, the Processor ensures that the safeguards required by Data Protection Law are in place, including standard contractual clauses and the UK Addendum in its agreement with the AI routing service.
When the Customer closes its account, access is switched off and the Google access tokens are removed immediately. The Customer may then ask the Processor, by writing to contact@avision.org, to delete the personal data, which the Processor will do from its live systems within 30 days of the request, except where the law requires it to be kept. This covers the profile and account details, the reviews held for the Customer and the copy of removed reviews, AVI conversations, posts, photos and other content, alerts and history, notification tokens and the user account. It does not cover billing and consent records, which must be kept, or copies in backups, server logs and the services described in section 4, which apply their own retention. Backups are used only for disaster recovery and for no other purpose. The Processor's hosting provider keeps daily disk backups on a rolling cycle of seven days. The Processor also keeps its own backups on a rolling cycle of seven daily, four weekly and three monthly copies, so the oldest copy is about three months old. Copies held in backups are overwritten as these cycles roll, so personal data deleted from live systems is gone from all backups no later than about four months after the request. If a backup is ever restored, deletion requests already received are applied again. The Processor confirms completion to the Customer in writing. Billing records are kept for the period required by the tax law that applies to the invoice: 6 years for customers invoiced under UK tax law and 7 years for other customers, or longer where local law requires. The Customer can revoke the Processor's access to its Google Business Profile at any time from its Google Account.
Liability under this agreement is subject to the limits in the Terms of Use. This agreement is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
This agreement applies for as long as the Processor processes the Customer's personal data.
This agreement is written for customers subject to UK and EU data protection law. If a Customer is subject to the data protection law of another country and that law requires additional terms, the parties will agree a regional annex for that Customer before the service starts.
Subject matter: providing the LocalEdge Google Business Profile management service. Duration: the life of the Customer's account, plus the deletion period in section 7. Nature and purpose: connecting to Google Business Profile through the official API, displaying and analysing profile data, monitoring changes, generating suggestions for the Customer to review, and publishing content on the Customer's instruction. Types of personal data: names of reviewers and the text of their reviews, a copy of reviews that Google later removes from the profile (kept so that the Customer can ask Google to restore them), business contact details, account details of the Customer's users, and usage data. Data subjects: the Customer's users, the people who review the Customer's business, and staff named on the profile. Special category data: not intended to be processed. Review text is written by third parties and may occasionally contain such information; the service does not filter review text for it.
Encrypted connections (HTTPS). Access controls and authentication. Limits on what each plan can do inside the service.
Hosting provider (Hetzner, servers in Germany), including daily disk backups. AI routing service (OpenRouter, Inc., United States), which passes requests to the model provider. AI model provider (Google Gemini models). Google (access to the Business Profile through its API). Payment processor (Stripe), only for billing data if the Customer buys credits or upgrades; for customers in Turkey, Paddle. Transactional email service (Brevo). Push notification service, only if the Customer enables notifications. A list of the individual providers is available on request at contact@avision.org, subject to confidentiality terms.