Privacy policy

• We only collect what we need to run your website and improve how you show up on Google and AI search.
• We never sell your information, and we never use it for advertising.
• Your Google data is used only to show you your own profile and reviews and to make changes you approve. We don't keep copies of your Google reviews.
• Passwords and access tokens for your accounts are encrypted before we store them.
• There are no advertising or tracking cookies on this site.

When you run a free website check

• The website address and town you enter.
• What we read from that website's public pages, and public search results for businesses like it.
• Answers from AI assistants (such as ChatGPT, Perplexity and Gemini) to questions a customer might ask about that kind of business in that town.
• Your IP address, briefly, to stop the free check being abused.

When you sign up

• Your email address, which is how you sign in. We send you a sign-in link; there is no password.
• Details about your business that you give us or confirm: name, phone, services, prices, towns you serve, hours, and anything you tell us not to say.
• Photos you upload. We remove location data (GPS) and camera details from them before they're stored.
• Your choices in the dashboard: changes you approve or decline, and edits you make to your pages.

When you connect an account

• If you connect your Google Business Profile or Google Search Console, an access token from Google and the ids of the listing or property you choose.
• If you connect another website platform, the access details you give us for it.
• If you connect your own domain, the domain name and the DNS records we check.

From visitors to websites we host

When someone fills in the contact form on a website we host, we email their message to the business. We don’t keep a copy of it.

If you connect your Google Business Profile, Buttermilk asks Google for permission to manage it (Google’s business.manage permission). We use that access only to:

• show you your own reviews and listing in your dashboard, when you ask;
• write draft replies to your reviews for you to read and change;
• post a reply only when you press Post, and then check Google is showing it;
• make changes to your profile that you have approved.

We never change your business name, main category or address. We don’t store your reviews or other profile content; we read them from Google when you ask and keep only Google’s ids for your account and listing. If you connect Google Search Console, we read your search data (read-only) to show you how people find your site.

To draft a review reply, we send the review and your confirmed business details to Anthropic, the company that makes the Claude AI model, which writes the draft. That data is used only to write your reply and is not used to train AI models.

Buttermilk’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don’t sell Google data, use it for advertising, or let people read it except where you ask us to, where it’s needed for security or to follow the law.

You can disconnect Google at any time from your dashboard. When you do, we delete the access token and ask Google to cancel the permission. You can also remove access from your Google Account’s security settings.

We use a small number of companies to run Buttermilk. Each gets only what it needs for its job:

• Vercel — hosts this site and the websites we build.
• Supabase — our database.
• Anthropic — writes website pages and review replies from the details you've confirmed.
• DataForSEO — public search results, map listings and AI answers for the free check and weekly checks.
• Resend — sends our emails, including sign-in links and the messages from your website's contact form.
• Google — when you connect your Google accounts.

We don’t sell personal information or share it for advertising. We may disclose information if the law requires it, or to protect Buttermilk, our customers or the public from fraud or harm.

The website we build for your business is public, because that is its job. It shows what you’ve approved: your business details, services, prices and photos. Nothing else about your account is public.

We use one cookie, to keep you signed in. It lasts 30 days, or until you sign out. There are no advertising or tracking cookies, and no third-party analytics on this site.

• Your account and business details: until you ask us to delete them. If you cancel, we keep them so you can come back or download your site, unless you ask us to delete them.
• Free check results: kept so the link to your report keeps working. Ask us and we'll delete yours.
• Google Business Profile content: we don't keep it. If we ever need to, it will be for no longer than 30 days, as Google's rules require.
• Records of what our services cost to run your account: for as long as we need them for accounting.

Everything travels over encrypted connections. Access tokens and passwords for your connected accounts are encrypted before they’re stored, and the encryption key is kept separately from the database. Only you can see your dashboard, and every action in it checks that the business is yours.

• See and change your business details any time in your dashboard.
• Download your whole website from Settings.
• Disconnect Google or any other account from your dashboard.
• Ask us for a copy of your information, or to delete your account and everything in it, by emailing tim@timrichard.co. We'll do it within 30 days.

Buttermilk is for businesses. It isn’t meant for anyone under 18, and we don’t knowingly collect their information.

If we change how we use your information, we’ll update this page and its date. If the change is significant, we’ll email you before it takes effect.