Privacy Policy

Who we are

Regulars Company LLC ("Regulars," "we," "us") is a marketing agency for owner-operated small businesses. We operate this website at regularscompany.com and the Regulars Client Portal at portal.regularscompany.com. This policy explains how we handle information through the website, our messaging programs, the portal, and connected services.

What we collect

Information you give us directly: your name, email address, phone number, business name, and anything you include when you fill out a form on this site, subscribe to our newsletter, or message us through any contact form on this site.

Basic technical information needed to serve the site and portal, such as IP addresses processed by our hosting providers. We do not run advertising trackers on this website.

The Regulars Client Portal processes your login email, account and business workspace membership, session and security records, service setup details, access requests, connection status, selected account or asset labels, and the records needed to provide the portal features available to your business.

Google data the portal accesses

When an authorized user connects Google, the Regulars Client Portal verifies the Google account's subject identifier and email address. The portal receives the granted scopes, access token, refresh token, and token expiration needed to keep the selected connection working.

For Google Analytics, the portal uses the analytics.readonly scope to list account and property metadata. This includes account and property resource names or identifiers, display names, property type, parent account, and whether the connected user has read-only or edit access. We use these details to let an authorized user select a property and check continued access. The current connector does not retrieve Google Analytics report metrics.

For Google Tag Manager, the portal uses the tagmanager.readonly scope to list account and container metadata. This includes account path, account ID and name, plus container path, name, public ID, usage context, and associated domain names. We use these details to let an authorized user select a container and check continued access.

Other Google connections available in the portal may process Search Console site URLs and permission levels. The Business Profile connection may process account identifiers, names, account type and role, plus location identifiers, title, store code, and address. The portal's current Google connections use this data to list, select, and verify access to the exact resource chosen for a business workspace.

How we use information

We use website, messaging, and portal information to respond to inquiries, provide the services a business selected, secure accounts, handle support and access requests, and improve the features our users rely on. We send marketing messages only to people who opted in, and each message includes a way to opt out.

We use Google user data only to provide or improve user-facing Regulars Client Portal features for the selected business workspace. These features include showing eligible Google resources, saving the resource an authorized user selects, checking whether access still works, and supporting the service connected to that resource.

How we protect Google data

The portal sends data over HTTPS. Google access and refresh tokens stay on the server and are encrypted at rest with AES-256-GCM. The encryption context is bound to the tenant and provider. Server-side session, active membership, permission, recent sign-in, and request validation controls protect Google connection actions.

Browser forms use opaque option identifiers instead of Google credentials or raw Google resource identifiers. Within the portal, selected resource labels and connection status are available only to authenticated users whose business workspace membership and permissions allow access.

Sharing and service providers

We share website and messaging information only with service providers needed to operate our services, including our website host (Cloudflare), form processor (Formspree), customer-communication platform (LeadConnector / HighLevel), and the local search report tool behind the free report form on our SEO page (BrightLocal), which builds the report you ask for, emails you its link, and passes us your name, email, phone number and business name so we can follow up. Each provider receives only what it needs to do its job. We never sell your information.

We share Google, Meta, and Microsoft Bing data only as needed to operate the Regulars Client Portal. OpenAI Sites hosts the application, and Cloudflare provides its server runtime and database infrastructure. We may also disclose information when the law requires it or when disclosure is necessary to investigate abuse, protect users, or secure our services. We do not sell data from these connected services, share it with data brokers, or use it for advertising.

Retention, disconnection, and deletion

We keep contact records and consent history for as long as needed to provide services and meet legal requirements. We keep portal account, membership, service, and security records while they are needed to operate the portal, provide the selected service, resolve requests, protect the service, or meet legal obligations.

We keep encrypted Google credentials, Google account identity, granted scopes, and selected resource metadata while a connected Google capability needs them. Disconnecting an individual Google capability removes that capability's selected resource metadata. Google capabilities can share one authorization, so the encrypted Google credential and Google identity may remain while another selected Google capability or an active connection attempt still relies on that authorization. Disconnecting Google as a provider clears the portal's stored Google credentials, Google account identity, granted scopes, pending connection data, and selected resource metadata.

You may revoke the Regulars Client Portal's access in your Google Account. Revocation stops future authorized Google API access. The portal's disconnect controls clear local portal data; they do not revoke the Google-side app grant. You can use those controls or email hello@regularscompany.com to request deletion of Google user data stored by Regulars. We may retain limited status, security, audit, or legal records after deletion when needed, but those retained records do not contain Google access tokens, refresh tokens, or selected Google resource metadata.

You can unsubscribe from emails through the link in any email, stop texts by replying STOP, or ask us to delete other personal information by emailing hello@regularscompany.com.

Google API Limited Use

Regulars Client Portal's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to train generalized artificial intelligence or machine learning models.

Meta data the portal accesses (Facebook and Instagram)

When an authorized user connects Meta, the Regulars Client Portal asks Facebook Login for four read permissions: pages_show_list, pages_read_engagement, instagram_basic, and ads_read. The portal receives the connecting Meta account's user ID and name, the permissions granted and the Pages or accounts each one covers, an access token, and the token and data-access expiration times.

For Facebook Pages, the portal lists each Page's ID and name and how many Page tasks your role holds. For Instagram, it reads the ID, username, and name of a professional Instagram account linked to a listed Page. For advertising, it lists each ad account's ID, account number, name, and status, and the name of the business that owns it. We use these details only to let an authorized user choose the Page, Instagram account, and ad account for a business workspace and to check that access still works. The current connector does not read posts, comments, messages, insights, or ad performance.

Meta access tokens stay on the server and are encrypted at rest with AES-256-GCM, bound to the business workspace and provider. Once a user chooses assets, the stored permission targets are narrowed to the chosen Page, Instagram account, and ad account. Some services also need Regulars added as a partner in your Meta Business Portfolio; the portal records only whether that partner access was confirmed.

Disconnecting Meta in the portal deletes the stored access token, the connected account's ID and name, the granted permissions, pending connection data, and the selected Page, Instagram, and ad account details. You can also remove the Regulars app in your Facebook settings. When Meta tells us you removed the app or asked for your data to be deleted, the portal erases the same data automatically, and a deletion request returns a receipt link you can check at portal.regularscompany.com/meta/data-deletion. That page also explains how to request deletion directly, or you can email hello@regularscompany.com. We keep a record that the deletion completed, and that record holds no Meta token or account details.

Microsoft Bing data the portal accesses

When an authorized user connects Bing Webmaster Tools, the portal requests the webmaster.read permission. It receives an access token, a refresh token, and the token expiration, and it reads the list of websites the account has verified in Bing Webmaster Tools, keeping each verified site's URL. The portal does not receive the Microsoft account's name or email address.

We use the site list only to let an authorized user choose the website for a business workspace and to check that access still works. The current connector does not read search traffic, keyword, or crawl reports. Bing tokens stay on the server, are encrypted at rest with AES-256-GCM bound to the business workspace and provider, and are refreshed only when they are about to expire.

Disconnecting Bing Webmaster Tools in the portal deletes the stored tokens, the granted permission, pending connection data, and the selected site. Bing Webmaster Tools offers no documented way for us to revoke the grant from our side, so the grant may stay active with Microsoft until you remove it from your account. To request deletion of Bing data stored by Regulars, use the disconnect control or email hello@regularscompany.com.

Text messaging and consent

If you opt in to text messages, we send them through our messaging platform. Message frequency varies; message and data rates may apply. Reply STOP at any time to unsubscribe, or HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Opt-in data and consent records are never sold or transferred for marketing use.

Children

This site, our messaging programs, and the Regulars Client Portal are intended for adults and business owners. They are not directed to children under 13, and we do not knowingly collect information from anyone under that age.

Changes and contact

If we change this policy, we will update this page and the date above. Questions? Email hello@regularscompany.com.