Privacy Policy

Last updated: 16 September 2026

1. Who we are

3 Minute Marketing is a trading style of Lycosa Web Services Ltd, a company registered in England and Wales. 3 Minute Marketing is the name under which this service is marketed and operated; Lycosa Web Services Ltd is the legal entity that owns and runs it.

For the purposes of UK GDPR, Lycosa Web Services Ltd is the data controller for all personal data processed through 3 Minute Marketing.

Lycosa Web Services Ltd
Trading as: 3 Minute Marketing
Website: https://threeminutemarketing.com
Contact: phil@lycosa.co.uk

2. What data we collect

We collect and process the following categories of personal data:

  • Account information — name, email address, mobile number, and business details provided at registration.
  • Post data — descriptions, locations, pricing information, and photographs you upload via the app.
  • Google account data — when you connect your Google account, we receive and store OAuth access tokens and refresh tokens issued by Google. We use these solely to publish posts to your Google Business Profile on your instruction.
  • Usage data — standard server logs including IP address, browser type, and pages visited, retained for up to 30 days.

3. How we use your data

We process your personal data for the following purposes:

Purpose Legal basis (UK GDPR)
Providing the service — managing your account, processing post submissions, and delivering rewritten content Contract (Art. 6(1)(b))
Publishing posts to your Google Business Profile when you give approval Consent (Art. 6(1)(a))
Sending notifications about your posts (approval requests, status updates) Contract (Art. 6(1)(b))
Security and fraud prevention Legitimate interests (Art. 6(1)(f))
Complying with legal obligations Legal obligation (Art. 6(1)(c))

4. Google user data and content moderation

When you connect your Google account, we request access to your Google Business Profile via the https://www.googleapis.com/auth/business.manage scope. This access is used exclusively to:

  • Create posts on your Google Business Profile listing when you approve a post in the app.

All content submitted for posting to Google is automatically checked for compliance with our own standards and with the Google Business Profile content policy. This includes automated and AI-based moderation for prohibited, restricted, or risky material, and an audit trail of moderation actions is maintained.

We do not:

  • Read, store, or analyse your business listing data beyond what is required to post.
  • Share your Google account data with any third party.
  • Use your Google data for advertising or any purpose other than posting on your behalf.

You can revoke this access at any time by visiting your Google Account permissions page or by disconnecting your account from the Profile page in the app.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Data sharing

We do not sell your personal data. We share data only with:

  • Google LLC — when you authorise us to post to your Google Business Profile. Google's privacy policy applies to their handling of this data.
  • Hosting infrastructure — your data is stored on servers operated by Cloudways (DigitalOcean infrastructure), located within the EEA or UK. Appropriate data processing agreements are in place.

6. Data retention

  • Account data — retained for as long as your account is active. Deleted within 30 days of account closure on request.
  • Post data and photos — retained for the duration of your account. You may request deletion at any time.
  • Google tokens — stored securely and deleted immediately when you disconnect your Google account or close your account.
  • Server logs — retained for up to 30 days for security purposes.

7. Your rights under UK GDPR

You have the following rights regarding your personal data:

  • Right of access — request a copy of the data we hold about you.
  • Right to rectification — request correction of inaccurate data.
  • Right to erasure — request deletion of your data ("right to be forgotten").
  • Right to restrict processing — ask us to limit how we use your data.
  • Right to data portability — receive your data in a structured, machine-readable format.
  • Right to object — object to processing based on legitimate interests.
  • Right to withdraw consent — where processing is based on consent (e.g. Google connection), you may withdraw at any time without affecting prior processing.

To exercise any of these rights, contact us at phil@lycosa.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data lawfully.

8. Security

We implement appropriate technical and organisational measures to protect your personal data, including encrypted connections (HTTPS), secure token storage, and restricted access to personal data.

9. Cookies & link tracking

We use only essential session cookies required for authentication and CSRF protection. We do not use tracking, analytics, or advertising cookies.

When a subscriber clicks a link in a 3 Minute Marketing email, the link passes through our server before reaching its destination. We record only an aggregate, non-identifying count of these clicks — which newsletter issue was clicked, which article it belonged to, and which destination was chosen — so that the business sending the email can see what their audience finds useful. We do not record which individual subscriber clicked, and we do not build a profile of an individual's behaviour across emails.

10. Changes to this policy

We may update this policy from time to time. We will notify registered users of material changes by email. The date at the top of this page will always reflect the most recent version.

11. Contact

For any privacy-related questions or to exercise your rights:

Lycosa Web Services Ltd
Trading as: 3 Minute Marketing
Email: phil@lycosa.co.uk
Website: https://threeminutemarketing.com