Privacy Policy

We collect information you provide directly and information generated through your use of the platform:

• Account information — your name, email address, and profile details provided through Clerk authentication (Google OAuth or email/password).
• Business information — your business name, type, city, brand voice description, and SEO keywords.
• Review data — Google and Facebook reviews associated with your business, including reviewer names, star ratings, review text, and platform metadata.
• AI-generated content — review responses, social media posts, and SEO audit results generated on your behalf.
• Usage data — actions taken in the platform (e.g. responses generated, posts created) for plan metering and abuse prevention.
• Billing information — payment method details are handled entirely by Stripe. We store only your Stripe customer ID and current plan tier.
• Technical data — IP addresses (for rate limiting), browser type, and error logs captured via Sentry.

• To generate AI review responses and social posts using your brand voice and business context.
• To run local SEO audits against your Google Business Profile data.
• To enforce free plan usage limits and prevent abuse.
• To send weekly digest emails and review alert notifications (if enabled in your settings).
• To process payments and manage your subscription via Stripe.
• To monitor application errors and performance via Sentry.
• To improve the platform based on aggregate, anonymised usage patterns.

We do not sell your data to third parties. We do not use your business data to train AI models.

Ovation uses the following third-party services to operate. Each service has its own privacy policy:

• Anthropic (Claude) — AI model provider. Review text and business context are sent to Anthropic's API to generate responses and content. Anthropic's API does not use API inputs to train models.
• Supabase — Database hosting. Your business data, reviews, and generated content are stored in Supabase (hosted on AWS us-east-1).
• Clerk — Authentication provider. Manages your account login, session tokens, and profile information.
• Stripe — Payment processing. Handles all payment card data. Ovation never sees or stores your card details.
• Resend — Transactional email. Used to send notification and digest emails to your address.
• Sentry — Error monitoring. Captures application errors including request metadata and stack traces to help us fix bugs.

We retain your data for as long as your account is active. Specifically:

• Account and business data is retained until you delete your account.
• Review and response data is retained until you delete your account or the individual records.
• Usage logs are retained for 12 months for billing and abuse-prevention purposes.
• Error logs in Sentry are retained for 90 days.

You may delete your account at any time from Settings → Account → Delete Account. Upon deletion, all of your data — including your business profile, review history, and generated content — is permanently removed within 24 hours. This action cannot be undone.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data.
• Object to or restrict certain processing.
• Data portability (receive your data in a machine-readable format).

To exercise any of these rights, email us at privacy@ovationapp.com.

We implement industry-standard security measures including row-level security on our database, encrypted connections (TLS), and access controls. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a notice in the dashboard. Continued use of Ovation after changes take effect constitutes acceptance of the updated policy.

For privacy-related questions or requests, contact us at privacy@ovationapp.com.