Top Local Pick: Privacy Policy

Effective date: 29 June 2026 Last updated: 02 August 2026

1. Who we are

Top Local Pick (toplocalpick.com) is operated by Moxie Circle Inc. DBA Top Local Pick (“we,” “us,” “our”). We provide done-for-you Google Business Profile management for local businesses.

This policy explains what personal information we collect, why we have it, what we do with it, how long we keep it, and what rights you have. It covers two different groups of people, and the difference matters:

Visitors and clients. People who visit our website, request a free Personalized Grid Audit, or buy our service. For this information, we decide how it is used. In privacy law terms, we are the controller.

Our clients’ customers. People whose names and contact details a client sends us so we can invite them to leave a review. We handle that information only on our client’s instructions, for our client’s purposes. In privacy law terms, our client is the controller (or “business”) and we are the service provider (or “processor”). Section 6 covers this in full.

Contact: hello@toplocalpick.com Moxie Circle Inc. DBA Top Local Pick, 8 W. Campbell St., Floor 2, Suite 222, Arlington Heights, IL 60005

2. Information we collect about visitors and clients

2.1 Information you give us

• Name and contact details: first and last name, business name, email address, phone number.
• Business details: website address, business address, Google Business Profile details, services, hours, categories.
• Grid Audit requests: the business and location you ask us to check, and the report we generate.
• Account and billing information: subscription plan, billing history, and payment details. Card payments are handled by our payment processor. We do not store full card numbers.
• Anything you send us: emails, support requests, call bookings, onboarding form answers, and photos of your business.

2.2 Information collected automatically

When you use our website we collect standard technical information: IP address, browser and device type, operating system, pages viewed, time spent, referring source, and date and time of visit. We use cookies and similar technologies for this. See section 8.

2.3 Information from other sources

We may receive information from Google (profile data, insights, and performance metrics for profiles we manage), from our payment processor (transaction status), and from advertising and analytics platforms.

We do not knowingly collect sensitive personal information such as health data, precise geolocation, government identifiers, or biometric data, and we ask that you do not send it to us.

3. Why we use it, and our lawful basis

Delivering the service you bought. Basis: performance of our contract with you.

Taking payment and preventing fraud. Basis: contract, and our legitimate interest in getting paid.

Producing your free Grid Audit and following up on it. Basis: your request, and our legitimate interest in marketing.

Support and account communication. Basis: contract.

Marketing emails and ads. Basis: your consent where required, otherwise our legitimate interest. You can opt out at any time.

Improving the service and understanding how the site is used. Basis: our legitimate interest.

Meeting legal, tax, and record-keeping obligations. Basis: legal obligation.

We do not use your information to make decisions about you by automated means that produce legal or similarly significant effects.

4. When we share information

We do not sell personal information.

We do share some website visitor information with Meta for advertising, through the Meta Pixel on our public website. Under California law that is “sharing for cross-context behavioral advertising.” It covers visits to our marketing website only. It does not apply to our client dashboard or client portal, where no advertising tracking runs, and it never applies to the customer lists our clients send us. Section 8 explains how to opt out, and section 6 explains how client customer lists are handled.

We share information with:

• Service providers who help us operate, listed in section 5.
• Google, which is where the work happens. Managing a profile means information about your business, your posts, your photos, your replies, and review activity is processed by Google under Google’s own terms and privacy policy.
• Professional advisers, such as accountants and lawyers, where needed.
• Authorities, where the law requires it or we need to protect our rights, our clients, or someone’s safety.
• A buyer or successor, if our business is sold or reorganized. We will tell you before your information becomes subject to a different policy.

5. Our service providers (subprocessors)

We use trusted third parties to run the service. Each has access only to what it needs, and each is required to protect the information and use it only for us.

• Google Business Profile management, and review-request sending: GBPly
• Google Business Profile itself: Google LLC
• Payments: Stripe
• Email: Google Workspace
• Text message delivery: Twilio, used only for clients who have chosen to supply mobile numbers
• CRM and client portal: Go High Level
• Website hosting: WPX
• Website advertising measurement: Meta, on our marketing website only, never our client dashboard, portal, or client customer lists

We keep this list current. Clients can ask us for the up-to-date version at any time by emailing hello@toplocalpick.com. If we add or change a provider that will handle client customer lists, we will tell affected clients before that provider begins handling their data.

6. Customer lists our clients send us

This section is the important one, and it deserves plain language.

What happens. Part of our service is inviting a client’s recent customers to leave a review. To do that, the client exports a list of recent customers from their own system and uploads it to us, normally as a CSV file. The list contains customer names and email addresses, and mobile numbers where the client chooses to include them.

Email is the standard. Text messages are optional. Every client’s review requests are sent by email. A client may also choose to supply mobile numbers so that requests can go by text as well, but that is entirely their choice: phone numbers are never required, and a client who supplies none receives the full service by email. Nothing about the service is reduced, delayed, or held back because a client chose not to share their customers’ phone numbers.

Where a client does supply mobile numbers, they confirm separately and in writing, at onboarding, that those customers agreed to be contacted by text. We do not treat the presence of a phone-number column as that agreement.

Whose data it is. It is the client’s data about their own customers. The client decides to collect it and decides to send it to us. We act only on the client’s instructions.

What the client promises. By sending us a customer list, the client confirms they collected those details lawfully, that they have the consents and permissions needed for those customers to receive a review request by the channels they have asked us to use, that no one on the list has asked not to be contacted, and that their own privacy notice tells customers this sharing happens. This is set out in our Terms and Conditions.

What we do with it. We use it for exactly one thing: sending review requests for that client’s business, spaced out over time, and handling the replies and opt-outs that come back. We do not use it for our own marketing. We do not use it for any other client. We do not sell it, rent it, license it, or disclose it to anyone except the providers listed in section 5 that deliver the messages, each of which is contractually bound to use it only for that purpose and only on our instructions. We do not use it to build profiles, audiences, lookalikes, or advertising lists, and we do not include it in any anonymized or aggregated analysis of how our service performs. If a client instructs us to stop using their list or to delete it, we do so.

Where it is held. Once uploaded, a client’s list becomes scheduled and sent message records inside GBPly, our Google Business Profile management platform: recipient address, message content, scheduling data, delivery status and the related logs, attached to the workspace and business profile they were sent from.

How it is protected. Encrypted in transit using TLS, and encrypted at rest by the platform’s hosting. Access is limited to members of that client’s workspace whose role permits it, enforced at the database level by per-workspace authorization rules rather than by a setting that could be overlooked, plus a small number of platform staff where needed to operate or support the service. We require two-factor authentication on every member of a workspace holding client lists. Lists are never emailed as attachments after upload, never held on personal devices, and never copied into general-purpose tools.

What is never done with it. Confirmed in writing by our platform provider: client customer lists are never sold, never shared for anyone else’s marketing, never enriched or appended from other sources, never combined with another customer’s data, and never used to train AI models.

Opting out, by either channel. Every review request identifies the business it comes from and gives the person a clear way to stop.

• Email requests are sent from or clearly on behalf of that business, carry a truthful subject line that is not misleading about what the message is, include a valid physical postal address, and include a clear one-click way to unsubscribe.
• Text message requests identify the business, and replying STOP ends them.

Opt-outs are honored promptly and in any event within 10 business days, and in practice immediately. An opt-out received by either channel is recorded against that person so they are not contacted again through us by either channel: someone who replies STOP to a text is not then emailed instead.

How long we keep it. Our platform does not impose a maximum retention period of its own: uploaded lists persist until they are deleted. We therefore apply our own limit. We keep a customer list only as long as we need it to run review requests for that client, and no longer than 12 months from upload. Older lists are deleted on a rolling basis, and that deletion is something we carry out rather than something that happens automatically.

When a client leaves: one rule, one clock. Sixty days after a client’s service ends, we delete everything we hold for them. That means the contents of their client portal, the photos they uploaded, their customer list, and their client folder. One date, everything, no exceptions to remember.

That deletion includes removing the client’s business profile from GBPly, which deletes the scheduled and sent review-request records held against it, including recipient email addresses and the related unsubscribe records.

Because that step also removes the unsubscribe records, we copy the opt-out list out first and keep it in our own records, separately from the platform, in the minimum form that serves the purpose. That copy covers both channels: email unsubscribes and text-message STOP replies. Without it, someone who had asked not to be contacted could be contacted again if the same business returned to us later with a fresh list. The copy is never used to reach anyone; it exists so that an opt-out keeps working after everything else is gone.

Apart from that opt-out list, nothing survives the 60 days except records the law requires us to keep, such as billing and tax records.

A client can ask for earlier deletion, or for a copy, at any time. Ask us in writing and we will confirm in writing, within 10 business days of completing it, that the deletion has been done.

If you are a customer of one of our clients and you want to know what is held about you, or want it deleted, the fastest route is to contact the business you dealt with, because it is their data and their decision. You can also contact us at hello@toplocalpick.com and we will pass the request to that business and help them act on it.

7. How long we keep information

• Everything we hold for a client, once their service ends: deleted 60 days after the end date. Portal contents, uploaded photos, customer list, client folder. See section 6.
• Client account records while the subscription is live: for the life of the subscription, then under the 60-day rule above.
• Grid Audit requests and leads that never became clients: 24 months from last contact, unless you ask us to delete sooner.
• Opt-out suppression records: kept indefinitely in minimal form, because they are what stops someone being contacted again.
• Billing and tax records: as long as the law requires, typically seven years.
• Website analytics: typically 26 months.

8. Cookies and tracking

Our public website uses cookies and similar technologies:

• Essential cookies, needed for the site to work.
• Analytics cookies, so we can see how the site is used and improve it.
• Advertising technologies, described below.

The Meta Pixel. Our public website runs a Meta Pixel. It records that you visited, which pages you viewed, and technical identifiers such as your device, browser, and IP address, and it shares that information with Meta. We use it to measure whether our advertising works and to show our service to people who may be interested in it. Meta processes that information under its own terms and privacy policy.

Where it does not run. The Meta Pixel is on our marketing website only. It does not run in our client dashboard or client portal, and it has no access to any client’s customer list. Nothing behind a client login is tracked for advertising.

How to opt out. Any of these work:

• Use our Do Not Sell or Share My Personal Information page.
• Turn on Global Privacy Control in your browser. We honor it.
• Use your browser settings to block or clear cookies.
• Change your ad preferences directly with Meta, in the settings of your Facebook or Instagram account.

Turning some cookies off may affect how the site works.

9. Email and text messages

If you give us your email address, we may send you your Grid Audit, follow-ups about it, service updates, and information about what we do. You can unsubscribe from marketing at any time using the link in any email or by emailing us. We will still send messages you need about your account and billing while you are a client.

Review requests sent to a client’s customers are covered in section 6, and always include a way to opt out.

10. Your rights

Depending on where you live, you may have the right to:

• Know what personal information we hold about you and get a copy.
• Correct information that is wrong or incomplete.
• Delete your information, subject to legal exceptions.
• Opt out of marketing.
• Opt out of any sale or sharing of personal information, and of targeted advertising.
• Limit the use of sensitive personal information (we do not seek it).
• Receive your information in a portable format.
• Be free from discrimination for using any of these rights.

To make a request, email hello@toplocalpick.com. We will verify who you are before acting, usually by confirming details we already hold. We respond within 45 days and can extend by another 45 days where the law allows, and we will say so if we need to. An authorized agent may act for you with proof of authority.

California (CCPA/CPRA)

In the past 12 months we have collected the categories of information described in section 2: identifiers, commercial information, internet activity, and business contact information. We collect it for the purposes in section 3 and disclose it for business purposes to the providers in section 5.

We do not sell personal information. We never have.

On sharing for advertising, there are two different answers, and the difference matters.

Our marketing website. Our public website uses a Meta Pixel so we can measure our advertising and reach people who may be interested in our service. That means information about your visit, such as your device and browser identifiers and the pages you viewed, is shared with Meta. Under California law that counts as “sharing for cross-context behavioral advertising,” so we tell you plainly that it happens. It applies to visits to our public website only. You can opt out at any time: see section 8, or use our Do Not Sell or Share My Personal Information page.

Client data and customer lists: nothing is shared for advertising, and nothing ever has been. No advertising or analytics tracking runs in our client dashboard or client portal. The customer contact lists our clients send us are never shared with Meta or any other advertising platform, never used to build audiences, never used for targeting, and never used for our own marketing or anyone else’s. That data is used to send review requests for that client’s business, and for nothing else. Section 6 sets this out in full.

We do not knowingly collect or sell the personal information of anyone under 16. California residents may use the rights above, and may appeal a refusal by replying to our decision.

Other US states

Residents of states with comparable privacy laws, including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and Montana, have similar rights, including a right to appeal a decision we make on a request. Use the same contact address.

Outside the US

We operate in the United States, and information we hold is processed there. If you contact us from elsewhere, we will handle your request in line with the rights that apply to you where we are required to do so.

11. Security

We use reasonable, industry-standard measures to protect personal information: encrypted connections, access limited to people who need it, two-factor authentication on the systems that hold client customer lists, payment handling through PCI-compliant processors, and regular review of our tools and access.

No system is completely secure, so we cannot guarantee absolute security, but we take it seriously. If we confirm a breach affecting a client’s information or the customer contact details they entrusted to us, we will tell that client without undue delay and in any event within 72 hours of confirming it, and we will tell them what we know, what we are doing about it, and what we suggest they do. Where the law requires affected individuals or a regulator to be notified, we will support the client in doing so.

12. Children

Our services are for businesses and are not directed to anyone under 18. We do not knowingly collect information from children. If you believe a child’s information has reached us, contact us and we will delete it.

13. Other websites

Our site links to other websites, including Google. We are not responsible for how those sites handle your information. Read their policies.

14. Changes to this policy

We may update this policy. When we do, we will change the “Last updated” date at the top, and if the change is material we will email active clients. Continuing to use the site or the service after that means you accept the update.

15. Contact us

Moxie Circle Inc. DBA Top Local Pick 8 W. Campbell St., Floor 2, Suite 222 Arlington Heights, IL 60005

Email: hello@toplocalpick.com Web: toplocalpick.com

For privacy requests, put “Privacy Request” in the subject line.