Privacy Policy — Google Business Profile

Last updated: October 12, 2026

This policy describes how MINISO Kazakhstan's internal customer-support tool ("MINISO Reviews", "the app") accesses, uses, stores and shares data received through Google APIs.

The data controller is MINISO KAZAKHSTAN LLP (ТОО «MINISO KAZAKHSTAN»), BIN 160940025554, Republic of Kazakhstan.

The app is used only by MINISO Kazakhstan staff to manage customer reviews of our own stores on Google Maps. It is not offered to the public, and the only Google account that signs in to it is our company's Business Profile account.

What Google data the app accesses

From the Google account that signs in

The account's email address — to show our staff which company account is connected;
An OAuth access token and refresh token — technically required to call the Google Business Profile APIs on behalf of that account.

Through the Google Business Profile APIs (scope `business.manage`)

The list of our business accounts and store locations: store name, address, store code, Google Maps link, average rating and number of reviews;
Reviews of our stores: the reviewer's public display name and profile picture link (as Google shows them on Maps), the star rating, the review text, and the date it was posted or changed;
Our existing replies to those reviews and their dates.

The app does not request access to Gmail, Google Drive, Contacts, Calendar or any other Google service, and does not read any data about reviewers beyond what Google publicly displays with their review.

How we use this data

To show our staff the reviews of every MINISO store in Kazakhstan in one place;
To prepare a reply to a review with the help of an AI model;
To publish a reply to a review on Google Maps. A reply may be published automatically or after review by our staff; our staff monitor replies and can edit or replace any of them at any time;
To understand customer feedback about our stores and improve our service.

We do not use Google user data for advertising, we do not sell it, we do not build marketing profiles from it, and we do not use it to contact reviewers outside of a public reply to their review.

We share Google user data only with service providers that process it on our behalf and under our instructions, and only to provide the features described above:

Hosting — the server that runs the app and stores its database;
AI model providers (such as Anthropic, OpenAI and Google) — to prepare a reply, the provider receives the store name and address, the star rating, the reviewer's display name, the review text and, when a reply is being rewritten, our previous reply. Reviewer profile pictures and OAuth tokens are never sent to AI providers.

We do not transfer Google user data to any other third party, except where required by law or in response to valid requests from public authorities.

Limited Use

MINISO Kazakhstan's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, we do not use data received from Google APIs to develop, improve or train generalised AI or machine-learning models, and we do not allow humans to read it except our own staff who handle reviews, where required for security or legal compliance, or with the consent of the data owner.

Storage and retention

Copies of our store locations, reviews and replies are stored in the app's database on our server so that staff can work with them. The refresh token is stored in the same database and is deleted as soon as the account is disconnected in the app.

Reviews and replies are retained while the integration is in use and for up to 5 years from the last update, after which they are deleted. Reviews are public on Google Maps; our copy is updated whenever Google reports a change, and a review removed from Google Maps can be removed from our copy on request.

Revoking access and deleting data

The connected account can revoke the app's access at any time at myaccount.google.com/permissions; the app then stops receiving any data from Google.
To have Google data deleted from our app — for example, if you wrote a review of a MINISO store and want our copy of it deleted — email it@miniso.kz with the store and the name shown on your review. We will delete it within 30 days and confirm by email. To remove the review itself from Google Maps, delete it in Google Maps.

Security

Access to the app is limited to our staff and protected by password. OAuth credentials are kept on our server and are never shown in the app or sent to the browser. Data is transferred to and from Google over encrypted connections (HTTPS). No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Changes to this policy

We may update this policy from time to time. The current version is always published on this page, and the "Last updated" date at the top reflects the most recent change.

Contact

For questions about this policy or how Google data is handled, contact it@miniso.kz.

See also: Privacy Policy · Terms of Service