Privacy Policy
Last updated: 18 October 2026
Mapheron is a local SEO tool for businesses. This policy describes what we collect, why, and what we do with it. It is written to be specific about this product rather than generic, because a policy you cannot check against the software is not much use.
If anything here is unclear, email hidayat.rahman@lmara.ai.
Who we are
Mapheron is operated by Lmara FZE LLC ("we", "us"), a free zone establishment registered in Sharjah, United Arab Emirates:
Business Centre, Sharjah Publishing City Free Zone Sharjah, United Arab Emirates Licence No. 4428761.01
We provide the service at mapheron.com and app.mapheron.com. We are the data controller for account information, and a data processor for the business data you connect to us.
What we collect
Your account
Your name, email address and password are handled by our authentication provider, Clerk. We store your name, email and which organisations you belong to. We never see or store your password.
The business information you enter
Business name, address, phone number, website, opening hours, categories and the services you offer. This is the information the product exists to work with, and some of it is published on your behalf — to your Google Business Profile, to your own website, or on landing pages we generate for you.
Photos you upload
Images and their embedded metadata, including GPS coordinates where your camera recorded them. We extract location data deliberately: it is how photos get geotagged for local search. Files are stored in object storage, namespaced per organisation.
Data from services you connect
| Service | What we read | How access is granted |
|---|---|---|
| Google Search Console | Search queries, impressions, clicks, positions, page indexing state | You add our service account as a read-only user, or you grant OAuth consent |
| Google Analytics 4 | Aggregate conversion counts — calls, bookings, form fills | As above (Viewer access, or OAuth) |
| Google Business Profile | Profile fields, posts, reviews, insights | OAuth consent, which you can revoke |
| Review platforms | Public reviews and ratings for your locations | Public data, or credentials you supply |
| Your website (CMS) | Page titles and meta descriptions, so the agent can improve them | Credentials you supply |
Read-only where it can be. Search Console and Analytics access is read-only. We cannot change anything in those accounts.
Access is yours to withdraw. Remove our service account from your property, or revoke the OAuth grant, and our access ends immediately. You do not need to ask us.
Google user data. Mapheron's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. For data read from Google Search Console, Google Analytics and your Google Business Profile, that means specifically:
- we use it only to provide and improve the features described in this policy;
- we do not transfer it to anyone else except where it is necessary to provide those features, or where the law requires it;
- we never use it for advertising, and we never sell it;
- no human at Mapheron reads it except with your permission, to fix a problem you have reported to us, or where security or the law requires it;
- we do not use it to train machine learning models.
Technical data
Pages visited inside the app, API requests, and error reports. Errors are sent to Sentry so we can fix crashes; they include the error and which server handled it, and we do not deliberately send customer content in them.
What we do not do
- We do not sell your data, or share it with advertisers or data brokers.
- We do not use your business data to train machine learning models.
- We do not use one customer's data to benefit another. Every record is scoped to your organisation and queries are filtered by it.
- We do not post, publish or change anything on your behalf outside what the product is configured to do — and higher-risk actions require your explicit approval.
Credentials and encryption
Google refresh tokens and website credentials are encrypted at rest with AES-256-GCM before being written to the database. No API endpoint returns them, and they are not included in logs or error reports. Traffic is served over HTTPS.
Automated decisions
Mapheron's agent decides which SEO changes to make and can carry some of them out without asking first. You control how much it may do:
- Advisor — proposes everything, changes nothing
- Guarded — only low-risk changes unattended
- Autopilot — low and medium risk unattended; high-risk always needs approval
Every action records what it changed and what the previous value was, so it can be undone. These decisions concern your business listings, not individuals, and have no legal effect on any person.
Sub-processors
| Provider | Purpose |
|---|---|
| Hetzner | Servers and database hosting (Germany) |
| Clerk | Authentication |
| Resend | Transactional email |
| Sentry | Error reporting |
| SerpApi | Search-results data for rank tracking |
| Search Console, Analytics and Business Profile, when you connect them |
How long we keep things
Account and business data are kept while your account is open. When an organisation is deleted, everything scoped to it is deleted with it — including stored Google tokens and website credentials — by a cascade in the database rather than a cleanup job that might not run. Backups are encrypted and roll off on their own schedule.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, or restrict what we do with it. Deleting your organisation in the app does this immediately for the data it holds. For anything else, email hidayat.rahman@lmara.ai and we will respond within 30 days.
We handle personal data in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). If you are in the UK or EU, you may also complain to your own data protection authority.
Children
Mapheron is a business tool and is not intended for anyone under 18.
Changes
If we change this policy materially we will say so in the app before the change takes effect, and update the date at the top.
Contact: hidayat.rahman@lmara.ai