geolocal-io/docs/legal/Data Flow & Privacy.md

Data Flow & Privacy — geolocal.io

Last updated: 2026-07-16

---

1. Overview

This document describes how data flows through the geolocal.io platform, what data we collect, how it's stored, who has access, and how we handle privacy obligations under GDPR and CCPA.

Core principle: We expose only public business data. We do not collect personal consumer data beyond what is necessary for booking transactions (handled by Cal.com and Stripe).

---

2. Data Collection Points

2.1 Business Data (Voluntary)

Businesses (or their agencies) voluntarily provide:

Data	Source	Purpose
Business name, address, phone, website	Business owner / agency	AI discovery
Operating hours	Business owner / agency	AI recommendations
Services & pricing	Business owner / agency	AI recommendations
Story & narrative	Business owner / agency	Differentiation in AI responses
Photos & video	Business owner / agency	Visual discovery in AI
Cal.com booking link	Business owner / agency	Transaction loop

Note: This data is already publicly available on the business's website or Google Business Profile. We do not scrape it without consent.

2.2 Telemetry Data (MCP Interactions)

Every MCP tool call generates:

Data Point	Example
Query terms	"best mechanic in Frisco TX"
Business slug referenced	"frisco-german-auto"
Tool called	"get_business_info"
AI platform used	ChatGPT, Gemini, Claude
Timestamp	2026-07-16T14:23:00Z
Response time	45ms

2.3 Booking Data (via Cal.com / Stripe)

We do NOT handle this directly. Cal.com and Stripe are the providers of record. We pass booking requests to their APIs.

• Cal.com handles: appointment scheduling, calendar data, customer contact info
• Stripe handles: payment processing, billing data, financial records

---

3. Data Storage

Data Type	Where It Lives	Retention
Business profiles	PostgreSQL (Railway)	Until business opts out
Telemetry logs	PostgreSQL + Redis (cached)	24 months, then anonymized
Photos / media	CDN (Cloudflare R2 / AWS S3)	Until business opts out
Booking data	Cal.com / Stripe (external)	Per their retention policies

---

4. Data Sharing

Recipient	What We Share	Why
AI agents (ChatGPT, Gemini, etc.)	Business profile data via MCP	Core product function
Partner agencies	Their client's analytics & commission data	Partner economics
Chambers of Commerce	Member analytics (aggregate)	CoC dashboard
Third-party data buyers (DaaS)	Anonymized telemetry only	Data-as-a-Service revenue

We never sell identifiable consumer data. All DaaS products use aggregated, anonymized telemetry.

---

5. Bi-Directional MCP Data Flow

The "related businesses" handshake creates a bi-directional data exchange:

AI Agent ──┐
           ├──→ geolocal.io MCP Server ──→ Business Database
           │                                ↓
           │                        related_businesses()
           │                                ↓
           │                        Returns: list of related businesses
           │                                ↓
AI Agent ◄─┘───────────────────────────────────┘

Verification flow: AI agents can report data discrepancies back through the MCP protocol. We log these reports and flag business profiles for review.

---

6. Privacy Commitments

6.1 GDPR Principles

• Lawful basis: Processing is based on business consent (they opt in) and legitimate interest (telemetry for service improvement)
• Data minimization: We only collect what's needed for AI discovery and booking
• Right to be forgotten: Businesses can request full data deletion
• Data portability: Businesses can export their profile data at any time
• DPIA: Data Protection Impact Assessment will be completed before EU data processing

6.2 CCPA Principles

• Notice at collection: Clear disclosure of what data we collect
• Right to delete: Businesses can request deletion of their data
• Right to opt out of sale: We do not sell personal data
• Non-discrimination: We do not discriminate against users who exercise their rights

6.3 What We Do NOT Do

• We do not collect consumer PII beyond what Cal.com/Stripe handle
• We do not track individual consumers across sessions
• We do not use cookies for behavioral tracking
• We do not sell individual-level data

---

7. Security

Measure	Status
PostgreSQL connection via SSL	✅ MVP
Rate limiting on MCP endpoints	✅ MVP
Input validation (Zod schemas)	✅ MVP
OAuth 2.1 with PKCE for partner auth	Phase 2
Regular security audits	Phase 3
SOC 2 compliance	Future

---

8. Incident Response

In the event of a data breach:

1. Detect: Automated alerts on anomalous MCP traffic patterns
2. Contain: Rate-limit or disable affected endpoints
3. Notify: Affected businesses notified within 72 hours (GDPR)
4. Remediate: Patch vulnerability, audit for scope
5. Document: Log incident, update this document

---

9. Data Flow Diagram

┌──────────────┐     ┌──────────────────┐     ┌──────────────┐
│  Business     │     │                  │     │  AI Agents   │
│  Owner /      │────→│  geolocal.io     │←───→│  ChatGPT,    │
│  Agency       │     │  MCP Server      │     │  Gemini,     │
└──────────────┘     │                  │     │  Claude,     │
                     │  ┌────────────┐  │     │  Grok        │
                     │  │ PostgreSQL │  │     └──────────────┘
                     │  └────────────┘  │
                     │  ┌────────────┐  │
                     │  │   Redis    │  │
                     │  └────────────┘  │
                     │  ┌────────────┐  │
                     │  │  Telemetry │  │
                     │  └────────────┘  │
                     └──────┬───────────┘
                            │
                    ┌───────┴────────┐
                    │  Cal.com API   │
                    │  Stripe API    │
                    └────────────────┘

---

This document must reference NORTH_STAR.md for principles. Updates require review against current privacy regulations.