Who will have access to our Business Profile?
Google designed Business Profile so that each user has their own Google Account and nobody needs to share a password. Owners have full control, including adding and removing users and deleting the profile. Managers can edit information and respond to reviews but cannot add or remove users or remove the profile. A provider should ask for manager access through its own account and leave the primary owner role with you. Google also makes new owners wait 7 days before they can transfer primary ownership or remove other users, so a request for ownership deserves a clear reason.
Warning signs: a request for your Google password, a request to become primary owner, or an offer to create a new profile for you while your existing one is still active.
Will anything be published without our approval?
Ask exactly what happens between a review arriving and a reply appearing. A clear answer names who drafts, who approves, how you approve from a phone and what happens if you do not respond. Some tools can publish replies automatically. If a provider offers that, ask which review types it applies to and how you switch it off. For complaints, the reply can commit you to a refund or state facts about what happened, so a person in your business should approve every one. Ask to see sample drafts written for three reviews you already have.
How do you handle reviews that break platform policy?
A good answer describes Google's process: report the review with the matching policy reason, track it in the Reviews Management Tool and use the one-time appeal when it is justified. It should also be honest that genuine negative reviews stay up. The ACCC warns that removing genuine negative reviews can mislead consumers, and that a business needs an adequate basis before treating a review as fake. Be wary of any provider that promises removals, charges for each review removed or suggests flooding a profile with reports.
How will you get us more reviews?
A good answer is a request sent to every customer, at a set point after the job or visit, with no reward attached. Google allows businesses to ask for reviews that reflect a genuine experience, but prohibits incentives, selective requests to happy customers and reviews from people with a conflict of interest. The ACCC says it is against the law for a business to arrange for others to create fake or misleading reviews, and using a provider to do it is still arranging them. Walk away from any offer to supply reviews, write them for customers or swap reviews with other businesses.
Where does our customer data go?
A provider handling replies will see review text, and often booking or job details used to check what happened. Ask where that information is stored, who can see it and which AI tools process it. The OAIC recommends due diligence before using a commercially available AI product, including how human oversight is built in, the privacy and security risks and who will have access to the information. It also recommends, as best practice, not entering personal information into publicly available generative AI tools. Ask for the provider's privacy policy and read the section on AI.
What happens when we leave?
Ask for the exit steps before you sign. Google says that when a user is removed from a Business Profile, their earlier replies, posts and other actions stay on the profile, so your reply history remains public after the provider goes. What you need from the provider is a record of what was published and when, the return or deletion of any customer data they hold, and confirmation that their access has been removed. Check the notice period and whether there is any exit fee, and remove their manager access yourself on the last day.
How will we know it is working?
Agree on measures you can check yourself: the share of reviews with a reply, the time from review to published reply, how many drafts needed heavy editing, and the themes that keep appearing in complaints. Monthly reporting should cover those. A provider that reports only star averages is leaving out the work you are paying for. Be cautious about promises of map positions or ranking gains, which no provider controls, and ask how any claimed result would be measured.