Privacy Policy

We collect information you provide directly and information generated through your use of the platform:

• Account information: your name, email address, and profile details provided through Clerk authentication (Google sign-in or email and password).
• Business information: your business name, type, address, phone number, website, brand voice description, and SEO keywords.
• Review data: Google reviews associated with your business, including reviewer names, star ratings, review text, and platform metadata. We don't collect Facebook reviews now; Facebook reviews collected earlier may be kept in your account.
• AI-generated content: review responses, social media posts, images, and SEO audit results generated on your behalf.
• Information about your customers: the details you or your connected systems give us so we can send review requests for you. See section 4.
• Usage data: actions taken in the platform (for example responses generated or posts created) for plan metering and abuse prevention.
• Billing information: payment method details are handled entirely by Stripe. We store only your Stripe customer ID and current plan.
• Technical data: IP addresses (we keep them only as a one-way hash, for rate limiting; our hosting provider and PostHog also receive your IP address when you visit), browser type, error reports captured by Sentry, and website and dashboard analytics from PostHog (see section 3).

• To generate AI review responses, social posts and images using your brand voice and business context.
• To send review requests to your customers on your behalf, by email and, where they agreed, by text.
• To run local SEO audits, ranking checks and directory listing checks for your business.
• To enforce usage limits and prevent abuse.
• To send weekly digest emails and review alert notifications (if enabled in your settings).
• To process payments and manage your subscription via Stripe.
• To answer support requests. Emails to support@getovation.io may be read and answered with the help of AI (Anthropic), and a person reviews anything it can't answer.
• To monitor application errors via Sentry and to understand how the website and dashboard are used via PostHog.

We do not sell your data to third parties. We do not use your business data or your customers' data to train AI models.

We use PostHog to understand how people use our website and dashboard, including page views and session recordings. Recordings mask all text, typed input and images in your browser before anything is sent to PostHog, and they don't include console logs or network requests. We don't record pages your customers see: review links, the QR sign-up page and consent pages. Before analytics data leaves your browser, links that contain access tokens (such as review links) have those tokens removed.

When a page on our site hits an error, Sentry may keep a short replay of that moment so we can fix it. These replays also mask all text and block images and media.

These are the cookies and browser storage our site uses:

• Clerk (sign-in): cookies such as __session and __client_uat that keep you signed in and protect your session. Required for the dashboard to work.
• PostHog (analytics): a cookie and a local storage entry named ph_…_posthog holding a random visitor ID and the current session ID, so page views and recordings from one visit are grouped together. PostHog runs on our production site only.
• Ovation: ovation_active_business (which of your locations you're working on, 1 year), tz (your time zone, so times show correctly, 1 year), cookie_consent (that you dismissed the cookie notice, 1 year, also kept in local storage), and a short-lived ovation_cookie_reset cookie used only while clearing a damaged cookie.
• Local storage: small dashboard preferences, such as which panels you collapsed and which settings tab you last opened.

To send review requests on your behalf, we receive information about your customers from the sources you choose to use:

• payment and booking systems you connect (Square, Stripe Connect, Clover);
• our Zapier app, the webhook link (for example from Shopify or Lightspeed), and the email-in address;
• the QR sign-up page at your counter, Quick check-in, review requests you send by hand, and CSV uploads.

For each customer this can include their name, email address, phone number, purchase amount and order reference. Each record is stored with where it came from, and, for texts, how and when the customer agreed to be texted and who recorded it. A phone number on its own never counts as agreement to be texted.

We use this information only to send review requests (and, if you turn them on, referral emails) on your behalf, and to show you their results. We don't use it for anything else, and we don't sell it or share it for marketing.

• One request per customer: by default, each customer is asked at most once every 90 days per location, whichever way their details arrive. Each business can change this period in its review request settings.
• Texts: a customer can reply STOP to any text to stop all texts sent through Ovation. They can reply START to receive texts again.
• Emails: every review request email has an unsubscribe link at the bottom. One click, without signing in, stops review request emails from that business to that address, and the customer sees a short confirmation page. If a customer marks a review request email as spam, that business never emails that address through Ovation again either. Customers can also ask the business, or email us at legal@getovation.io, to stop review request emails.
• How long it's kept: customer records are kept while the business's account is active. They are deleted when the business deletes the location or its account, or 90 days after the account is canceled. Phone numbers that replied STOP are kept on our opt-out list so they are never texted again.

Ovation uses the following third-party services to operate. Each service has its own privacy policy:

• Anthropic (Claude): AI model provider. Review text, comments, customer feedback, support emails and business context are sent to Anthropic's API to write responses, posts and analysis. Anthropic's API does not use API inputs to train models.
• OpenAI: creates AI images for your social posts from the image description.
• Supabase: database and file storage. Your business data, reviews, customer records and generated content are stored in Supabase (hosted on AWS us-east-1).
• Vercel: hosts the website and the application.
• Clerk: authentication provider. Manages your account login, session tokens and profile information, including Google sign-in.
• Stripe: payment processing for your Ovation subscription. Ovation never sees or stores your card details. If you connect your own Stripe account (Stripe Connect), we receive the customer details of your payments to send review requests.
• Resend: email delivery and receiving. Sends notification and digest emails to you and review request emails to your customers, and receives emails sent to support@getovation.io and to your email-in address.
• Twilio: text messages. Customers' phone numbers and the message are sent to Twilio only to deliver texts, and the business details you give are sent to Twilio and phone carriers to register your texting number.
• Sentry: error monitoring. Captures application errors with technical details (and masked replays, see section 3) so we can fix bugs.
• PostHog: website and dashboard analytics and masked session recordings (see section 3).
• Google: Google Business Profile (reading your reviews and listing, posting replies and posts when you connect it), Google Maps and Places (address search, business lookups, and the Google rating and reviews shown in your reviews widget, which are fetched live from Google each time and not stored), and Google sign-in through Clerk.
• Meta: Facebook and Instagram, when you connect them, to publish your posts and read and reply to comments.
• Square and Clover: when you connect them, they send us the customer details of your sales so we can send review requests.
• Shopify and Lightspeed: if you set up the webhook link in them, they send us order details. We don't send them your data.
• Zapier: if you use our Zapier app, the sales your Zap sends pass through Zapier to us.
• BrightLocal and DataForSEO: directory listing and search ranking checks. They receive your business name, address, phone number, website and SEO keywords.
• Calendly: the booking calendar on our setup page, if you choose to book a call.

When you connect Google Business Profile, you sign in with Google and allow Ovation to manage your Business Profile (Google's business.manage permission). With that permission we use the Business Profile you link as follows:

• What we read: the Business Profile listings your Google account manages (so you can choose one), and for the listing you link: its name, address, service area, categories, description, phone number, website, opening hours, open status, attributes, the number and dates of its photos, its posts, its reviews (reviewer name and photo, star rating, review text and date) and your replies, and Google's rating and review count. We also read the email address of the Google account you sign in with, to show which account is connected.
• What we change: only what you do in Ovation, or a feature you turn on does for you (such as Auto-Respond or scheduled posts): posting, editing and deleting replies to your reviews, and publishing and deleting posts on your profile. Ovation never changes your profile details, such as your hours, description or categories.

We use this data only to provide Ovation's features to you, the owner of the connected profile: your reviews and replies, your dashboard, reports and emails, your SEO checks and your posts.

Ovation's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We never sell this data.
• We never use or transfer it for advertising, including retargeting and personalized or interest-based ads.
• We never use it to train or improve general AI models. Review text and listing details are sent to Anthropic only to write replies and suggestions for you (see section 5).
• We transfer it only as needed to provide Ovation's features (through the service providers in section 5), to comply with the law, or as part of a merger, acquisition or sale of our business, with notice to you.
• Our staff don't read it unless you ask us to (for example in a support request), it's needed for security or to comply with the law, or it has been aggregated and made anonymous for our internal operations.

Disconnecting and deletion: you can disconnect Google at any time in Settings → Connections (Disconnect on the Google Business Profile row). Ovation then stops reading your profile and deletes its Google access for that location, and when no other location of yours uses the same Google account, we also ask Google to revoke Ovation's access. You can remove Ovation's access yourself at any time at myaccount.google.com/permissions. Reviews and posts already imported stay in your account until you delete them, the location or your account (see section 9). To ask us to delete your Google data, email legal@getovation.io and we'll delete it within 30 days.

A business using Ovation may send you text messages through our platform, such as a request to leave a review, only if you agreed to receive them, for example by ticking the box on the business's QR sign-up page or telling staff yes. A phone number on its own never counts as agreement to be texted.

• Message frequency varies based on your interactions with the business.
• Message and data rates may apply.
• You may opt out at any time by replying STOP to any message. You will receive one final confirmation message.
• For help, reply HELP or contact the business directly.
• We do not sell or share your phone number with third parties for marketing purposes.
• Carriers are not liable for delayed or undelivered messages.

We retain your data for as long as your account is active. Specifically:

• Account and business data is retained until you delete your account, or 90 days after you cancel.
• Review and response data is retained until you delete your account or the individual records.
• Customer records used for review requests are kept as described in section 4.
• Usage logs are retained for 12 months for billing and abuse-prevention purposes, then deleted.
• Error logs in Sentry are kept for 30 days.
• Analytics events in PostHog are kept for up to 1 year, and session recordings for up to 30 days.

You may delete your account at any time from Settings → Account → Delete Account. Upon deletion, all of your data, including your business profile, review history, customer records and generated content, is permanently removed within 24 hours. This action cannot be undone.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data.
• Object to or restrict certain processing.
• Data portability (receive your data in a machine-readable format).

To exercise any of these rights, email us at legal@getovation.io.

We implement industry-standard security measures including row-level security on our database, encrypted connections (TLS), and access controls. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a notice in the dashboard. Continued use of Ovation after changes take effect constitutes acceptance of the updated policy.

For privacy-related questions or requests, contact us at legal@getovation.io.