Privacy Policy

Primanza LLC is the entity responsible for the Service. Our registered details and data-protection contacts are in Section 18.

Controller data

For personal data about our account holders, their authorized users and website visitors (for example, your name, email, login and billing details), we act as a controller and determine how and why that data is processed. This Policy governs that processing.

Processor data

For the personal data contained in the reviews and profiles you connect to the Service (for example, the names, profile photos and review text of the people who write reviews of your business), we act as a processor on your behalf. You (our customer) are the controller of that data, and we process it only to provide the Service to you, under our Data Processing Agreement. If you are a reviewer and want to exercise rights over a review, please contact the business that owns the listing; we will support that business as its processor.

Data you provide

• Account data: name, email address and a securely hashed password. If you sign in with Google, we receive your name, email and profile image from Google.
• Business and brand data: business name and type, locations and addresses, and the brand profile you configure (tagline, contact channels, service areas, tone, preferred and banned phrases, business facts and signature). Do not include special-category or unnecessary personal data in these free-text fields.
• Support and communications: the content of messages you send us and related metadata.

Data collected on your behalf from Connected Platforms

• Google Business Profile data: the OAuth authorization to your account, connected location details, and the reviews we synchronize, which include the reviewer's display name and photo, star rating, review text and language, and reply history. This is processor data as described in Section 1.

Payment data

Subscriptions are processed by Stripe. Stripe collects and processes your payment-card details directly; we receive limited billing information such as your billing name, country, the last four digits and card brand, and subscription status. We do not receive or store full card numbers.

Data collected automatically

• Technical and usage data: IP address, device and browser type, pages viewed, actions taken, timestamps and diagnostic logs, collected to operate and secure the Service.
• Cookies: strictly necessary cookies used for authentication and security. See our Cookie Policy.

As controller, we use personal data for the purposes below. Where the GDPR applies, we rely on the legal bases indicated.

Where we rely on legitimate interests, we have balanced those interests against your rights and will provide details on request. Where we rely on consent, you may withdraw it at any time without affecting prior processing.

To generate reply drafts, sentiment classifications and insight reports, review content and the brand context you configure are sent to our AI sub-processor, OpenAI, through its business API. We do not use, and we instruct our AI sub-processor not to use, the content of your reviews or replies to train generative AI models. AI Output is generated solely to provide the Service to you.

AI Output is probabilistic and may be inaccurate. The Service does not make decisions that produce legal or similarly significant effects on the reviewers whose reviews are processed; it drafts and, at your election, publishes replies under your control. See Section 16 on automated decision-making, and our Terms of Service and Sub-processors list.

When you connect Google, we request the minimum Google Business Profile scopes needed to read your reviews and locations and to publish replies on your behalf, and, if you use Google sign-in, basic profile information to authenticate you.

You can revoke our access at any time from your Google Account permissions or from the Locations page in your dashboard. Revoking access stops future synchronization; data already synchronized is handled as described in Section 10.

We do not sell your personal data, and we do not "share" it for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA. We disclose personal data only as follows:

• Sub-processors and service providers who process data on our behalf under contract, listed in our Sub-processors page (including hosting, AI, payment and, if you enable it, automation-bridge providers).
• Connected Platforms you direct us to interact with, such as Google, to publish replies.
• Professional advisers, auditors and authorities where necessary to comply with law, legal process or lawful requests, or to establish, exercise or defend legal claims.
• In a corporate transaction such as a merger, acquisition, financing or asset sale, subject to this Policy and appropriate confidentiality.
• With your consent or at your direction.

We are based in the United States and use sub-processors located in the United States and other countries. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country not recognized as providing adequate protection, we rely on appropriate safeguards, principally the European Commission's Standard Contractual Clauses, supplemented for the United Kingdom by the UK International Data Transfer Addendum, together with any supplementary measures required. Where a sub-processor is certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), we may rely on that certification. You may request a copy of the relevant safeguards by contacting us at privacy@primanza.com.

We keep personal data for as long as your account is active and as needed to provide the Service, then for the period required to comply with legal, tax and accounting obligations, resolve disputes and enforce agreements.

If you delete your account, or ask us to delete it, we will permanently delete or de-identify the synchronized reviews, drafts, brand settings and other Customer Data within 30 days, except for limited data we must retain by law (such as invoice records) or hold in routine backups until they expire on a rolling basis. Aggregated or de-identified data that no longer identifies you may be retained.

We maintain technical and organizational measures appropriate to the risk, including encryption of data in transit, hashing of passwords, access controls on a need-to-know basis, and logging and monitoring. Google refresh tokens and similar secrets are protected against unauthorized access. No method of transmission or storage is completely secure; we cannot guarantee absolute security. If we become aware of a personal-data breach affecting you, we will notify you and, where required, the relevant authorities, without undue delay. Report suspected vulnerabilities to security@primanza.com.

Subject to applicable law, you have the right to: access your personal data; rectify inaccurate data; erase data; restrict or object to processing; data portability; and, where processing is based on consent, withdraw consent at any time. You also have the right to lodge a complaint with a supervisory authority.

To exercise these rights, contact privacy@primanza.com. We will respond within the timeframe required by law (generally one month under the GDPR). We may need to verify your identity. There is no fee unless your request is manifestly unfounded or excessive. If you are in the EEA, you may complain to your local Data Protection Authority; in the UK, to the Information Commissioner's Office (ICO).

If your personal data is contained in a review (processor data), we will forward your request to the relevant business (the controller) and support them in responding.

If you are a California resident, the CCPA/CPRA gives you rights regarding your personal information. Over the preceding 12 months we may have collected the categories of personal information described in Section 2 (identifiers, customer records, commercial information, internet/network activity, and, from Google sign-in, an image). We collect it for the business purposes in Section 3 and disclose it to the recipients in Section 6.

Your California rights

• Right to know/access the personal information we collect, use and disclose.
• Right to delete personal information, subject to exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information and to limit use of sensitive personal information. We do not sell or share personal information and do not use sensitive personal information for purposes requiring a limitation right.
• Right to non-discrimination for exercising your rights.

To exercise these rights, contact privacy@primanza.com. You may use an authorized agent. We will verify your request as required by law. Similar rights may apply under the privacy laws of other US states (such as Virginia, Colorado, Connecticut, Utah and Texas), and we honor equivalent requests from residents of those states.

• United Kingdom: the UK GDPR and Data Protection Act 2018 apply; the ICO is the supervisory authority.
• Brazil (LGPD): you have rights of access, correction, deletion, portability and information about sharing; the processing bases mirror those in Section 3.
• Canada (PIPEDA): we obtain consent as required and provide access and correction rights.
• Australia (Privacy Act / APPs): we handle personal information consistently with the Australian Privacy Principles.
• Residents of other jurisdictions with data-protection laws may have similar rights; contact us to exercise them.

Where required, we have appointed representatives for data subjects: EU representative — [EU representative — to be appointed under Art. 27 GDPR]; UK representative — [UK representative — to be appointed under UK GDPR].

The Service is intended for businesses and users aged 18 or older. It is not directed to children, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact privacy@primanza.com and we will delete it.

The Service classifies review sentiment and drafts replies using AI. These are content-generation features under your control; they do not make decisions that produce legal or similarly significant effects on individuals within the meaning of Article 22 of the GDPR. You choose whether to publish replies automatically or after review. If we ever introduce features involving solely automated decisions with such effects, we will provide the disclosures and safeguards the law requires.

We use only strictly necessary cookies to keep you signed in and to secure the Service. We describe them, and how to control cookies, in our Cookie Policy.

We may update this Policy from time to time. We will change the "Last updated" date and, for material changes, provide additional notice by email or in-product notice before they take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

For privacy questions or to exercise your rights, contact our privacy team at privacy@primanza.com, or write to:

Primanza LLC, Primanza LLC, [Registered agent street address], [City], Wyoming [ZIP], United States.