PRIVACY POLICY
Last updated September 17, 2026
Version 1.1
CHANGELOG
This changelog records every change to this document since the version you agreed to. Version 1.1 adds disclosures and corrections only — it creates no new obligations for you, so there is nothing to accept again. Each entry names the change that introduced it.
v1.1 — September 17, 2026. What changed since v1.0:
- Connected social accounts. We now describe that when a business connects a Facebook Page or Instagram Business account we receive and store the text and author name of comments and direct messages sent to that account, which appear in that business's inbox inside OwnersPal. (PR #2076, August 19, 2026.)
- Campaign attribution on the websites we host for businesses. We now describe that the campaign identifiers that brought a visitor to such a website (gclid, fbclid, utm values and the landing page) are stored with any booking or enquiry they submit, so that business can measure its own campaigns. (PR #2217, September 9, 2026.)
- AI-enhanced photos. We now describe the Brand Photoshoot: which of a business's own photos are sent to OpenAI and fal.ai, the enhancements applied, the record of how each enhanced copy was made, the AI-enhanced label stamped into the image file, and the rule that enhanced copies without their real background are never added to the media library, used for automatic videos, or sent to Google Business Profile. (PR #2256, September 11, 2026.)
- Conversion tracking and ad measurement on the websites we host for businesses. We now describe a business's own Meta and Google Ads tags on its website, the cookies and local-storage entries they use, the marketing consent they require, Global Privacy Control always overriding an earlier acceptance, and the once-a-day upload of an ad click identifier together with a SHA-256 hash of the email address or phone number given with a booking — never the address or number itself. (PR #2267, September 12, 2026.)
- Cookie banner on the websites we host for businesses. We now describe that such a website shows a cookie banner only when the business has connected an ad account with conversion tracking, and that the visitor's choice is stored only in their own browser for 12 months, never on our servers. (PR #2295, September 13, 2026.)
- Card verification on the free Starter plan. We now describe the no-charge card check run through Stripe before the free video, and that we keep only a record that a card was verified plus Stripe's reference for it — never the card number or security code. (PR #2281, September 13, 2026.)
- Records of agreements and choices. We now describe the agreement and consent records we keep (the legal document version, the exact statement agreed to, the time, IP address, browser user agent and sign-in method), the automatic-renewal consent record, the marketing opt-out records behind the email suppression list and the STOP keyword, and the cookie-choice receipts for OwnersPal's own website and app. (PR #2284, September 13, 2026.)
- Other processing described in full. We now describe opt-in diagnostic screenshots attached to problem reports, aggregate website statistics, imported website testimonials, Google reviews shown in videos, voice hooks, website assistant questions, AI search-visibility checks and published service areas. (PR #2284, September 13, 2026.)
- Subprocessors, server location and retention. Runway was added to the AI service providers we use (PR #2076, August 19, 2026); the server location now reads “United States” instead of a blank (PR #1175, July 27, 2026); and specific retention periods are stated for the categories that have one (PR #2284, September 13, 2026).
- Privacy requests on the websites we host for businesses. We now describe the “Your privacy choices” form on such a website: the name, email address, request type and optional message you enter are sent to that business, which decides how to answer, and we keep a service-provider record of the request — its reference, type, message, a one-way fingerprint (salted hash) of your email address and when it was received, but not your name or email address — for 24 months, after which the message and the fingerprint are deleted. Submissions are rate-limited by network address, which is held only for the length of the limit window, at most one day (PR #2406, September 17, 2026).
- Do Not Sell or Share My Personal Information. We now describe the opt-out link in OwnersPal’s own footer: we do not sell personal information, the link turns marketing cookies off in your browser, and a Global Privacy Control signal sent by your browser is always treated as that opt-out, taking precedence over any earlier cookie choice you made in that browser for as long as the signal is sent (PR #2406, September 17, 2026).
- Keeping the same person consistent across video shots. We now describe the optional setting, off unless a business turns it on, that sends one of that business's own uploaded photos of a person to our AI service provider fal.ai as a reference image so the person looks the same in every shot of a video, the private copy of that photo kept with the account while the setting is on, the one-hour expiry of the link sent to fal.ai, and the 90-day limit on how long a stored copy is kept after it was last used as a reference, and the deletion of every stored copy when the setting is turned off or the account is deleted — and that we never create, store or compare face scans, face templates or any other biometric identifiers. (PR #2404, September 17, 2026.)
- Navigation preferences. We now describe that when you pin a shortcut to the navigation sidebar inside OwnersPal, we store that choice on your account so your shortcuts are the same on every device you sign in from, and that we use these stored choices to understand which areas of the product businesses use most. We do not combine them with other businesses’ choices to rank, score or recommend anything to you. They are kept for as long as your account exists and are deleted with it. (PR for rail favourites, September 19, 2026.)
- Styled AI-enhanced photos now appear in the media library. A styled version from a Brand Photoshoot that you approve is now also listed in your media library, always labelled AI-enhanced, and can be downloaded as that same labelled file. This replaces the earlier statement (see the AI-enhanced photos entry above, September 11, 2026) that copies with a generated background are never added to the media library. Such a copy is still never used for automatic videos, your website, your ads or cards, or sent to Google Business Profile. (September 20, 2026.)
- Details and photos from a Google Maps listing. We now describe exactly what we look up from a business’s Google Maps listing and how long we keep it: the Google Place ID for as long as the account exists; the other details — including Google’s description of the business and its category and types, the copies that fill in the business’s profile and website (also those picked during sign-up or from a Google search when setting an ad area) and translations of Google’s description — for at most 30 days unless the business confirms or edits them, after which unconfirmed details and Google map coordinates are deleted; a map pin the business moves itself is its own. The same limit covers the copies we make of these details in ad-targeting plans and presets, targeting suggestions, listing checks, AI search visibility checks and records of which details generated content used; competitor places picked for ad targeting are kept only as their Place IDs; details the business has not confirmed are not sent to its other listings; and we name the copies that are not deleted with the details — content the business makes and our records of how it was made, its website address made from its business name, and copies held by ad platforms and AI providers. We no longer save the listing’s photos or use them in new videos, photoshoots, ads, cards or posts; the links to them that we had saved were deleted, including in our records of where a business’s details came from and in brand kit logos, except the photo link on posts that were already published; we still keep the copies inside videos and cards that were already made, and photoshoot versions already made from one of these photos, which only that business can see and which can’t be used for anything new; a website with fewer than two photos of its own may show them live, credited, and your browser loads them directly from Google. This replaces the earlier statements that we retrieve customer reviews through these APIs (we do not) and that we cache your device’s location on your device for twelve months (we do not). (PR for Google Places compliance, September 24, 2026.)
- Photos imported from Square. We now describe connecting a Square account to copy the photos from its item library into the media library: the read-only access we ask Square for, what we copy and store, that we never post to Square, and that every copied photo is deleted when the business disconnects Square, removes our access in Square, or deletes its account. (PR for Square photo import and the photo origin question, September 24, 2026.)
- Where uploaded photos came from. We now describe the record we keep when you answer “Where did these photos come from?” before adding photos to your media library: your answer, the exact statement you confirmed and its version, how many photos it covered, the time, your IP address and your browser's user agent. It is deleted together with your account. (PR for Square photo import and the photo origin question, September 24, 2026.)
- Visible AI mark on styled photos. A styled Brand Photoshoot version now also carries a visible “AI-generated scene” mark on the picture itself, in addition to the AI label in the image file’s metadata. (September 24, 2026.)
- Saved Google Maps photos deleted. The links to Google Maps photos that we had saved were deleted, including in our records of where a business’s details came from and in brand kit logos, except the photo link on posts that were already published. That also covers links in businesses’ media libraries (including pictures we had saved from a business’s own website that were Google Maps photos), menu pictures, profile and logo images, team members’ photos on the websites we host for businesses (the published website, edits not yet published, and the saved copy used to undo a website rebuild, which also holds menu pictures), the record of the photo a creative card was made from, posts that were never published, and our internal records of how videos were made. Posts that were waiting to go out with a Google Maps photo are stopped. We still keep the copies inside videos and cards that were already made, including working copies made while producing those videos (cropped frames, enhanced copies, depth maps, crops of a face used to keep a person looking the same across shots, and copies uploaded to a video provider), and photoshoot versions already made from a Google Maps photo, which only that business can see and which can’t be used for anything new. (PR for deleting saved Google Maps photos, September 24, 2026.)
- Deleting enhanced copies. We now say where you delete a Brand Photoshoot copy (its photoshoot, or the media library for a styled copy), that deleting it removes the copy and its file from our storage, that we keep your earlier pick or rejection of it to steer your own later shoots, and that a photo in the trash is deleted together with its file 7 days later. Before this change, photos deleted from the trash kept their file in our storage. (PR for deleting photoshoot copies and their files, September 26, 2026.)
- Account deletion report. We now describe the report you see after deleting your account yourself (what we deleted, where it was stored, and what we keep, why and until when, with a spreadsheet download) and the same summary we email to the address on your account; we keep no copy of the report. (PR for the account deletion report, September 27, 2026.)
- Do Not Sell or Share, restated. OwnersPal's own website and app no longer show a marketing cookie choice, because they set no marketing cookies. The "Do Not Sell or Share My Personal Information" link now says that we do not sell or share your personal information for cross-context behavioral advertising, so there is nothing to opt out of, and that we honor Global Privacy Control by keeping analytics cookies off while your browser sends it. Websites we host for businesses keep their own marketing cookie choice. (PR removing the marketing cookie choice, September 27, 2026.)
- Keeping the same person consistent — Illinois and Texas. We now say that the optional setting that keeps the same person consistent across video shots is not currently offered to businesses located in Illinois or Texas, and that if such a business had turned it on, its stored reference copies are deleted the next time it makes a video, and in any case within 90 days of their last use. (September 27, 2026.)
v1.0 — July 14, 2026. The first version recorded against a server-side record of agreement.
This Privacy Notice for VIVE AI, Inc. (doing business as OwnersPal ) (
- Visit our website
at https://ownerspal.app or any website of ours that links to this Privacy Notice
- Use
OwnersPal .OwnersPal is an AI marketing platform for small and local businesses. It generates short marketing videos from real business photos, auto-publishes to social channels (Facebook, Instagram, TikTok, YouTube, Google Business Profile), monitors and replies to customer reviews on Google and Yelp, manages ad campaigns across Google Ads, Google Local Services Ads, Microsoft Ads, Yelp, and Meta, captures and follows up on inbound leads, and reports cross-platform performance and ROI from a single dashboard.
- Engage with us in other related ways, including any marketing or events
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services.privacy@ownerspal.app .
SUMMARY OF KEY POINTS
This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.
What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.
Do we process any sensitive personal information? Some of the information may be considered
Do we collect any information from third parties?
How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.
In what situations and with which
How do we keep your information safe? We have adequate
What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.
How do you exercise your rights? The easiest way to exercise your rights is by https://ownerspal.app/privacy-request
Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.
TABLE OF CONTENTS
1. WHAT INFORMATION DO WE COLLECT?
Personal information you disclose to us
In Short: We collect personal information that you provide to us.We collect personal information that you voluntarily provide to us when you
Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:
billing addresses
contact or authentication data
contact preferences
navigation preferences
passwords
business name and business details (industry, services offered, service area)
names
phone numbers
email addresses
mailing addresses
Sensitive Information.
Payment Data. If you are a business customer on the free Starter plan, we ask you to verify a card before your free video with a no-charge check through Stripe; we keep only a record that a card was verified and Stripe’s reference for that card, never the card number or security code. We may collect data necessary to process your payment if you choose to make purchases, such as your payment instrument number, and the security code associated with your payment instrument. All payment data is handled and stored byStripe https://stripe.com/privacy
Connected Social Accounts. When a business connects a Facebook Page or Instagram Business account, we also receive and store the text and author name of comments and direct messages sent to that account, which we surface in the business's unified inbox inside OwnersPal.
Photos Imported From Square. If a business connects its Square account, we ask Square only for read access to that business's item library (Square's ITEMS_READ permission) and store the access token Square gives us, encrypted. When the business chooses “Sync now”, we copy the photos from its Square item library into its OwnersPal media library, together with each photo's Square item name and identifiers and the business's Square merchant ID, and we add a photo to a menu item only when that item has no photo yet and its name matches the Square item name exactly. We do not copy images made with Square Photo Studio, and we never post anything to Square. When the business disconnects Square, or when we learn that the business removed our access there (as soon as Square notifies us, or at the latest the next time we contact Square), we delete every photo copied from Square, the Square photo identifiers we kept, any photoshoot versions made from those photos, and any menu photos that use them, and we end the connection. They are also deleted when the account is deleted.
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.
Information automatically collected
In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.
Like many businesses, we also collect information through cookies and similar technologies.
The information we collect includes:
- Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called
"crash dumps" ), and hardware settings).
- Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.
- Location Data. We collect location data such as information about your device's location, which can be either precise or imprecise. How much information we collect depends on the type and settings of the device you use to access the Services. For example, we may use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt out of allowing us to collect this information either by refusing access to the information or by disabling your Location setting on your device. However, if you choose to opt out, you may not be able to use certain aspects of the Services.
- Campaign Attribution Data on Hosted Business Websites. When you visit a website that OwnersPal hosts for one of its business customers and accept marketing cookies there, the campaign identifiers that brought you to it (gclid, fbclid, utm values and the page you landed on) are stored with any booking or enquiry you then submit, so that business can measure its own campaigns; VIVE AI, Inc. processes this information on the business's behalf.
- Value of a Won Lead. If you leave your contact details with a business that uses OwnersPal and later become its customer, that business can record what the sale was worth; the amount is kept with your details and is deleted along with them.
- AI-Enhanced Photos. If you are a business customer and run a Brand Photoshoot, photos from your own media library that the shoot considers are sent to OpenAI, one of our AI model providers, so a vision model can read each one. The read is saved with the photo in your account and records what the photo shows: the type of subject and where it sits, how many faces are in it (faces are counted only to keep them out of styled versions; the read does not identify anyone or create a face template), any words printed in the photo, such as on a sign, cup or card, and its exposure, color cast, sharpness and clutter. Text-only OpenAI calls then plan each shot from that record and your business details (name, type, brand colors and voice, words you asked us to avoid, menu item names). Every photo gets a real-background version made on our own servers by cropping and color adjustment only, with no generative AI model. For a styled version, the cropped photo and a text prompt (which quotes any printed words so they stay unchanged) are sent to our AI model provider fal.ai, which runs OpenAI’s GPT Image or, as a fallback, Google’s Nano Banana 2, to add generic set dressing and lighting around your real subject. For a product photo, fal.ai first cuts your real product out with a background-removal model (BiRefNet) so its own pixels can be placed onto a plain studio backdrop, then paints only that backdrop with OpenAI’s GPT Image or, as a fallback, Black Forest Labs’ FLUX Fill. An OpenAI vision model also compares each styled version with your real photo before it is offered to you. When our automated read detects a face, a person or a logo in a photo, or cannot read a photo with confidence, that photo only receives the real-background version. We store each result as an enhanced copy together with a record of how it was made (the original photo it came from, the steps and AI models used, whether the background was kept or generated, and the shot’s scene, lighting and mood tags), label styled copies as AI-generated, both in the image file’s metadata and with a visible “AI-generated scene” mark on the picture itself, and add a copy to your media library once you pick it. A copy that keeps its real background joins the photos your automatic videos, website, ads and cards can use. A styled copy (with a generated background) is shown in your media library with an AI-enhanced label and can be downloaded as that same labelled file, but it is never used for automatic videos, your website, your ads or cards, or sent to your Google Business Profile. The cut-outs and studio versions made by earlier shoots stay with the photoshoot: they are never added to your library, used for automatic videos, or sent to your Google Business Profile. When you pick or reject a result (and the reason you choose, if you give one), we keep that decision with the shoot and use your own earlier decisions to steer your later shoots; they are never combined with other businesses’ decisions, and no engagement data such as likes or clicks is used. You can delete enhanced copies at any time: delete a version from its photoshoot, or a styled copy from your media library. Deleting one removes the copy and its file from our storage for good; we keep your earlier decision to pick or reject it, which only steers your own later shoots. A saved copy that keeps its real background is deleted from your media library like your other photos: it goes to the trash, and 7 days later it is deleted together with its file.
- Privacy Requests on Hosted Business Websites. If you use "Your privacy choices" on a business website that OwnersPal hosts, the name, email address, request type and optional message you enter are sent to that business, which decides how to answer, and appear in its OwnersPal inbox. VIVE AI, Inc. keeps a record of the request as the business's service provider: its reference, type, message, a one-way fingerprint (salted hash) of your email address and when it was received, but not your name or email address. After 24 months we delete the message and the fingerprint. To limit abuse, submissions are rate-limited by network address, which is held only for the length of the limit window (at most one day). To have the record erased sooner, email privacy@ownerspal.app with your reference.
- Do Not Sell or Share My Personal Information. OwnersPal does not sell your personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of. OwnersPal's own website and app set no marketing cookies, and their cookie banner offers essential and analytics cookies only. The "Do Not Sell or Share My Personal Information" link in OwnersPal's footer says so and links to where you can ask for a copy of your data or for its deletion. We honor Global Privacy Control: while your browser sends the signal, analytics cookies stay off on OwnersPal's own website and app, taking precedence over any earlier cookie choice you made in this browser.
- Conversion Tracking & Ad Measurement on Hosted Business Websites. If a business that OwnersPal hosts a website for has connected its own Meta or Google Ads account, and you accept marketing cookies on that website while your browser sends no Global Privacy Control signal, that business's own advertising tags load on its pages. Such a website asks for that choice with its own cookie banner, shown only when the business has connected a Meta or Google Ads account with conversion tracking (a hosted business website without one sets no marketing cookies and shows no banner) and never while your browser sends a Global Privacy Control signal, which is treated as a rejection, even if you accepted earlier. The banner offers Accept all and Reject all with equal prominence and a Settings view, and you can change your choice at any time from the website's "Cookie settings" link. The choice is stored only in your browser (op_site_consent_v1) for that website for 12 months, after which you are asked again; OwnersPal does not keep a record of that choice on its servers, because for that website the business decides how its visitors' data is used. A business website can be reachable at more than one address (for example its ownerspal.app address, its own domain name, and that domain with "www." in front); these tags, like the op_attr cookie, run only at its main address (its own domain name without "www." when it has one, otherwise its ownerspal.app address), so the marketing choice you make there is the one that applies to the whole website, and at its other addresses nothing loads and no click identifier is recorded. Its Google Ads tag stores its own cookies (names starting with _gcl_, such as _gcl_aw, _gcl_au and _gcl_gs) on that address only, plus a _gcl_ls entry in your browser's local storage. Its Meta Pixel loads only when that main address is the business's own domain name itself (such as example.com, not an ownerspal.app address or an address under another domain such as book.example.com), because the Pixel places its _fbp and _fbc cookies on the highest-level domain your browser allows, which anywhere else would be shared with other websites; the Pixel runs with automatic event detection switched off. These tags send Meta and/or Google your IP address, browser and device information, the page you viewed and the page that referred you, and their cookie identifiers. Their requests go to Meta's and Google's own servers (such as facebook.com, google.com, googleadservices.com, googletagmanager.com and doubleclick.net), so your browser also sends those companies any cookies they have already set on their own domains, and they may set or update such cookies (Google, for example, names IDE and NID); OwnersPal cannot read or delete those cookies, which are governed by Meta's and Google's own cookie policies and can be cleared in your browser's settings. If the business has turned on Meta's automatic advanced matching or Google's enhanced conversions in its own ad account, a tag may also send a hash of contact details you enter into the website's forms. If you then make a booking there after arriving from one of its adverts, once a day we send Meta and/or Google the advert click identifier from your visit together with a one-way cryptographic hash (SHA-256) of the email address or phone number you gave that business (never the email address or phone number itself), so that business can measure which of its campaigns led to a real booking. Google receives that hash only when the business's Google Ads account reports that it has accepted Google's customer data terms; otherwise Google receives the click identifier alone. The hash is created at the moment of sending and is never stored by us; a booking is only sent within 30 days of being made, and deleting the booking stops it from being sent. Only a choice you make on that business's own website counts: accepting marketing cookies on OwnersPal's own website never loads these tags or records the click identifier on a business's website. So that it only ever deletes identifiers these tags created, the page keeps a local-storage entry (op_conversion_tags_v1 followed by the website's name) listing which of those identifiers were already in your browser before the tags first loaded there; it holds identifier names only. Each tag starts with its consent withheld (the Meta Pixel with its consent "revoke" command, the Google Ads tag with its ad_storage, analytics_storage, ad_user_data and ad_personalization consent "denied") and is switched to granted, and sends its page view, only once its script has finished loading and your marketing consent for that website still stands at that moment. If you withdraw marketing consent on that website while one of its pages is open, the page immediately sends the Meta Pixel its consent "revoke" command, which stops it sending events, sets the Google Ads tag's ad_storage, analytics_storage, ad_user_data and ad_personalization consent to "denied", under which Google's tag stops reading and writing its cookies, deletes the _fbp, _fbc and _gcl_ cookies and the _gcl_ local-storage entries those tags created at that address (never an identifier that was already in your browser before the tags first loaded there, and never a cookie another website set on a higher-level domain), keeps that list so that any of those identifiers a tag still writes afterwards can be deleted too, and deletes the op_attr cookie that holds the click identifier; the same happens when the page next detects a Global Privacy Control signal from your browser. Whenever you open any page of that website without marketing consent for it at its main address (including on a later visit after withdrawing, while your browser sends Global Privacy Control, after the business has disconnected its ad account, or at one of the website's other addresses), the page deletes whatever of those identifiers the tags created there on an earlier visit or page (including any a tag wrote after you withdrew consent), then deletes that list, and deletes op_attr. A booking or enquiry you make after withdrawing consent, or while your browser sends Global Privacy Control, carries no click identifier and is never sent to Meta or Google; a booking made before you withdrew consent can still be sent unless it is deleted. Neither tag loads on later visits unless you accept marketing cookies on that website again. VIVE AI, Inc. processes this information on the business's behalf.
Other information we process
Depending on the features you or a business use, we also process the following information:
- Agreement and Consent Records. When you create an account, we record, for each legal document you agree to (our Terms of Service, this Privacy Notice and our Data Processing Addendum), the version you agreed to, the exact statement you agreed to, the time, your IP address, your browser's user agent and how you signed in. When you subscribe to a paid plan, we also record your agreement to its automatic renewal: the plan, the price, the exact renewal terms shown to you, the time, your IP address and your browser's user agent. When you add photos through the “Where did these photos come from?” question in your media library, we record the answer you chose, the exact statement you confirmed and its version, how many photos it covered, the time, your IP address and your browser's user agent, and we link each of those photos to that record. When you confirm “This is my own photo” for a photo we had kept out of your videos, posts and website because it looked like a copy of a photoshoot version made from a Google Maps photo, we record the same details for that photo (the exact statement you confirmed and its version, the time, your IP address and your browser's user agent) together with which photo it was (its identifier and a fingerprint of the image, kept even if you later delete the photo), and note that record on the photo. We keep these records so we can show what you agreed to, and they are deleted together with your account.
- Marketing Opt-Out Records. If you unsubscribe from a marketing email that a business sends through OwnersPal (such as a birthday, holiday or review-request email), we keep your email address, the business you unsubscribed from and the time on a suppression list that is checked before every such email, so that business does not email you again even if it later adds your address again. If you reply STOP to a review-request text message sent from our shared sending number, we keep your phone number, the time and how you opted out on a suppression list that is checked before every text message sent from that number, for every business; replying START or UNSTOP removes it.
- Cookie Choice Records. When you accept or reject cookies, or save your cookie preferences, on OwnersPal's own website and app (not on the websites we host for businesses), we store a record of that choice on our server: a random receipt id that your browser keeps with your cookie preferences, the categories you chose, the version of our cookie notice, how you made the choice and the time. The record contains no IP address and no browser details, and nothing is recorded when your choice comes from a Global Privacy Control signal.
- Diagnostic Screenshots in Problem Reports. If you report a problem (for example, a video that failed) and agree, in a prompt shown before anything is captured, to attach diagnostic details, we store a screenshot of the page you were viewing together with a short summary of recent page activity (the paths of recent requests, how long they took and their status, and up to the last 20 browser console messages). The screenshot can show personal information that was visible on the screen. If you decline, nothing extra is attached. The screenshot is used only to diagnose the problem you reported.
- Aggregate Website Statistics. Websites that OwnersPal hosts for businesses count page views and button taps per day, together with a coarse traffic source (a referring domain such as google.com, or "direct"). These counters use no cookies and no device identifiers, keep no IP address and cannot be linked to you.
- Website Testimonials. If a business imports the testimonials published on its own website, we store only the text and star rating of each testimonial (the text is extracted with the help of OpenAI). The customer's name is not stored, and the testimonial is shown as coming from a "Customer".
- Reviews Shown in Videos. If a business connects its Google Business Profile, we keep a copy of its Google reviews (the star rating, the review text exactly as written and the reviewer's name) so that its videos can show them. Only a shortened name, such as "Jane D.", is ever shown; the full name is kept internally only to avoid duplicates. A review that is no longer on Google stops being shown.
- Voice Hooks in Videos. If a business turns on voice hooks, a short spoken opening line for its videos is generated from its own business details (such as its name, opening hours and call to action) with a preset synthetic voice from ElevenLabs, provided through fal.ai. No voice is cloned and no customer information is sent.
- Website Assistant Questions. If a business turns on the assistant on the website OwnersPal hosts for it, a question you type into the assistant is screened by OpenAI's moderation service and sent, together with that business's public website information, to OpenAI to generate an answer. We do not store or log your questions or the answers; the conversation stays only in your browser tab. If you choose to send your question to the business, the question and the email address or phone number you give are saved as an enquiry to that business, which VIVE AI, Inc. processes on the business's behalf.
- AI Search Visibility Checks. For businesses on plans that include it, once a month we send the business's own category, city and name to OpenAI as part of everyday search questions, and store each question, whether the business was mentioned in the answer and the names of any other businesses the answer named. No customer information is used, and these records are deleted together with the business's account.
- Service Area on Hosted Business Websites. If a business sets a service location and a service radius, that radius is published in the structured data of the website OwnersPal hosts for it, so that search engines can show the area it serves.
Google API
Our use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.Information collected from other sources
In Short: We may collect limited data from public databases, marketing partners,In order to enhance our ability to provide relevant marketing, offers, and services to you and update our records, we may obtain information about you from other sources, such as public databases, joint marketing partners, affiliate programs, data providers,
2. HOW DO WE PROCESS YOUR INFORMATION?
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.We process your personal information for a variety of reasons, depending on how you interact with our Services, including:
- To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
- To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?
In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e.If you are located in the EU or UK, this section applies to you.
The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:
- Consent. We may process your information if you have given us permission (i.e.
, consent) to use your personal information for a specific purpose. You can withdraw your consent at any time. Learn more about withdrawing your consent.
- Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
- Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.
If you are located in Canada, this section applies to you.
We may process your information if you have given us specific permission (i.e.
In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:
- If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
- For investigations and fraud detection and prevention
- For business transactions provided certain conditions are met
- If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
- For identifying injured, ill, or deceased persons and communicating with next of kin
- If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
- If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
- If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
- If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
- If the collection is solely for journalistic, artistic, or literary purposes
- If the information is publicly available and is specified by the regulations
- We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments
Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents (
The
- AI Service Providers
- Allow Users to Connect to Their Third-Party Accounts
- Cloud Computing Services
- Functionality and Infrastructure
Optimization
- Invoice and Billing
sms delivery
Transactional email delivery
Transactional email delivery (fallback provider)
We
- Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
- When we use Google Maps Platform APIs. When a business links its Google Maps listing, we use Google’s Places API to look up that listing’s public details: business name, address, phone number, website, opening hours, rating, price level, amenities, whether it is open, Google’s description of the business (its editorial summary), the business’s category and types, its location on the map (latitude and longitude), its Google Place ID, and references to the listing’s photos with the names of the people who took them. We keep the Google Place ID for as long as the business has an account. We keep the other details for at most 30 days after we last looked them up, unless the business confirms or edits them in OwnersPal, which makes them the business’s own information; after 30 days, details that were not confirmed are deleted, and so are map coordinates that came from Google. The same applies to the copies of these details that fill in the business’s profile and website: the name, address, location, type of business, phone number and website filled in from the listing (including the name, location and type of business filled in when the business picks its listing during sign-up), the map pin and address picked from a Google search when setting an ad area, and the translations of Google’s description made for the business’s website; and to the copies we make from them: the map pin and name in the business’s ad-targeting plan and saved presets, the targeting suggestions we make from its listing, the phone number and website in our checks of its listings, the questions we ask AI assistants in its AI search visibility check, and our record of which details a piece of generated content used. A map pin the business moves itself is the business’s own and is kept, and so is a targeting suggestion the business accepts (such as a price range), which becomes its own choice. Details the business has not confirmed are not sent to its other listings, such as its Facebook Page. When a business picks competitor places from a Google search to target its ads, we keep only their Google Place IDs: their names and addresses are looked up from Google each time they are shown, and their map locations when a campaign on Meta (Facebook and Instagram) is launched. Some copies are not deleted with the details. Content the business makes with OwnersPal while a detail is in its profile keeps it — for example a video’s end card, a card, a post and its caption, a monthly report or marketing text — and so do our records of how that content was made. The web address of the business’s OwnersPal website, which we make from its business name, stays until the business changes it, and its earlier addresses keep working. Copies sent to other services stay with them under their own terms: Meta (Facebook and Instagram) receives the map locations a business targets in the campaigns it runs there through OwnersPal, with their labels, which can include a map pin or business name that came from Google and the map locations of competitor places it picked; TikTok receives only those labels, to find the areas to target; and the AI providers that write or check the business’s content receive the details they work from. We no longer save photos from Google Maps or use them in new videos, photoshoots, ads, cards or posts. The links to Google Maps photos that we had saved were deleted, including in our records of where a business’s details came from and in brand kit logos, except the photo link on posts that were already published. We still keep the copies inside videos and cards that were already made, including working copies made while producing those videos (cropped frames, enhanced copies, depth maps, crops of a face used to keep a person looking the same across shots, and copies uploaded to a video provider), and photoshoot versions already made from a Google Maps photo, which only that business can see and which can’t be used for anything new. When a business’s website hosted by OwnersPal has fewer than two photos of its own, it may show that listing’s photos from Google Maps, credited to the people who took them and to Google Maps. Your browser then loads those photos directly from Google, so Google receives your IP address and information about your browser, as described in the Google Privacy Policy. Maps on those websites are embedded Google maps. If you choose to use your device’s location when setting an ad area in OwnersPal, your browser shares it with us and we store the point you choose with your business profile until you change it. The Google Maps Platform APIs that we use store and access cookies and other information on your devices. If you are a user currently in the European Economic Area (EU countries, Iceland, Liechtenstein, and Norway) or the United Kingdom, please take a look at our Cookie Notice.
We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services
We also permit third parties and service providers to use online tracking technologies on our Services for analytics and advertising, including to help manage and display advertisements, to tailor advertisements to your interests, or to send abandoned shopping cart reminders (depending on your communication preferences). The third parties and service providers use their technology to provide advertising about products and services tailored to your interests which may appear either on our Services or on other websites.
To the extent these online tracking technologies are deemed to be a
Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice
6. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?
In Short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.As part of our Services, we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies (collectively,
Use of AI Technologies
We provide the AI Products through third-party service providers (OpenAI fal.ai
Our AI Products
Our AI Products are designed for the following functions:
AI bots
Video generation
Image analysis
Text analysis
Natural language processing
AI automation
How We Process Your Data Using AI
All personal information processed using our AI Products is handled in line with our Privacy Notice and our agreement with third parties. This ensures high security and safeguards your personal information throughout the process, giving you peace of mind about your data's safety.
How to Opt Out
We believe in giving you the power to decide how your data is used. To opt out, you can:
Contact us using the contact information provided
Log in to your account settings and update your user account
Keeping the same person consistent across video shots (optional)
If you turn on the optional setting to keep the same person consistent across the shots of a video (available on higher OwnersPal plans, off by default), and a person appears in more than one shot, we send one of the photos you uploaded of that person to our AI Service Provider fal.ai as a reference image, so the person looks the same throughout the video. We do this only to produce the video you asked for. We do not create, store, or compare face scans, face templates, or any other biometric identifiers, and we only use photos you uploaded. We keep the reference photo for at most 90 days after the last time it was used as a reference, and delete it sooner if you turn the setting off or delete your account. You should only turn this setting on if the people shown have agreed to appear in your content. This setting is not currently offered to businesses located in Illinois or Texas.
7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
In Short: We may transfer, store, and process your information in countries other than your own.Our servers are located in the United States
If you are a resident in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, then these countries may not necessarily have data protection laws or other similar laws as comprehensive as those in your country. However, we will take all necessary measures to protect your personal information in accordance with this Privacy Notice and applicable law.
8. HOW LONG DO WE KEEP YOUR INFORMATION?
In Short: We keep your information for as long as necessary toWe will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).
When we have no ongoing legitimate business need to process your personal information, we will either delete or
Some information has a specific retention period: aggregate website statistics are kept for 13 rolling months; diagnostic screenshots are deleted automatically after at most 90 days, and screenshots never attached to a report within about 24 hours; the hashed email address or phone number used for conversion measurement is never stored, and a booking can only be sent within 30 days of being made (7 days for Meta); agreement, automatic-renewal consent, photo-origin and AI search visibility records are deleted together with the account they belong to; photos copied from Square are deleted when the business disconnects Square or deletes its account; and marketing opt-out records are kept for as long as they are needed to keep honoring the opt-out.
Reference photos used to keep the same person consistent across video shots: when that optional setting is on, a private copy of the reference photo is stored with your account so the video can still be finished if you delete the original photo, and the temporary link we send to fal.ai expires after one hour. Each stored copy is deleted 90 days after the last time it was used as a reference — using it again in a new video restarts that 90 days — and sooner than that when you turn the setting off or delete your account. The setting is not currently offered to businesses located in Illinois or Texas; if such a business had turned it on, its stored copies are deleted the next time it makes a video, and in any case within those 90 days.
Brand Photoshoot records: the note a vision model makes about each photo is stored with that photo in your account and is removed when the photo is permanently deleted or when you delete your account. Photoshoot records, including the record of how each enhanced copy was made and your picks and rejections, are deleted when you delete your account.
9. HOW DO WE KEEP YOUR INFORMATION SAFE?
In Short: We aim to protect your personal information through a system ofWe have implemented appropriate and reasonable technical and
10. DO WE COLLECT INFORMATION FROM MINORS?
In Short: We do not knowingly collect data from or market toWe do not knowingly collect, solicit data from, or market to children under 18 years of ageprivacy@ownerspal.app
11. WHAT ARE YOUR PRIVACY RIGHTS?
In Short:In some regions (like
We will consider and act upon any request in accordance with applicable data protection laws.
If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority.
If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.
Withdrawing your consent: If we are relying on your consent to process your personal information,
However, please note that this will not affect the lawfulness of the processing before its withdrawal nor,
Opting out of marketing and promotional communications: You can unsubscribe from our marketing and promotional communications at any time by
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with third parties.
Account Information
If you would at any time like to review or change the information in your account or terminate your account, you can:Log in to your account settings and update your user account.
Contact us using the contact information provided.
Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements. When you delete your account yourself in your account settings, we then show you a deletion report: what we deleted, where it was stored, and what we keep, why and until when. You can download it as a spreadsheet, and we email the same summary to the email address on your account. We create the report from the deletion itself and do not keep a copy of it.
Cookies and similar technologies: Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Services.
If you have questions or comments about your privacy rights, you may email us at privacy@ownerspal.app .
12. CONTROLS FOR DO-NOT-TRACK FEATURES
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for
13. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
In Short: If you are a resident ofCategories of Personal Information We Collect
The table below shows the categories of personal information we have collected in the past twelve (12) months. The table includes illustrative examples of each category and does not reflect the personal information we collect from you. For a comprehensive inventory of all personal information we process, please refer to the section| Category | Examples | Collected |
|---|---|---|
A. Identifiers | Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, and account name |
B. Personal information as defined in the California Customer Records statute | Name, contact information, education, employment, employment history, and financial information |
Gender, age, date of birth, race and ethnicity, national origin, marital status, and other demographic data | ||
Transaction information, purchase history, financial details, and payment information | ||
Fingerprints and voiceprints | ||
Browsing history, search history, online | ||
Device location | ||
Images and audio, video or call recordings created in connection with our business activities | ||
Business contact details in order to provide you our Services at a business level or job title, work history, and professional qualifications if you apply for a job with us | ||
Student records and directory information | ||
Inferences drawn from any of the collected personal information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics | ||
We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:
- Receiving help through our customer support channels;
- Participation in customer surveys or contests; and
- Facilitation in the delivery of our Services and to respond to your inquiries.
- Category A -
As long as the user has an account with us
- Category B -
As long as the user has an account with us
- Category
D - As long as the user has an account with us
- Category
F - As long as the user has an account with us
- Category
G - As long as the user has an account with us
- Category
I - As long as the user has an account with us
- Category
K - As long as the user has an account with us
Sources of Personal Information
Learn more about the sources of personal information we collect inHow We Use and Share Personal Information
Will your information be shared with anyone else?
We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information to in the section,
We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be
- Category A. Identifiers
- Category B. Personal information as defined in the California Customer Records law
- Category
D . Commercial information
- Category
F . Internet or other electronic network activity information
- Category
G . Geolocation data
- Category
I . Professional or employment-related information
The categories of third parties to whom we disclosed personal information for a business or commercial purpose can be found under
Your Rights
You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:- Right to know whether or not we are processing your personal data
- Right to access your personal data
- Right to correct inaccuracies in your personal data
- Right to request the deletion of your personal data
- Right to obtain a copy of the personal data you previously shared with us
- Right to non-discrimination for exercising your rights
- Right to opt out of the processing of your personal data if it is used for targeted advertising
(or sharing as defined under California’s privacy law) , the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ( "profiling" )
Depending upon the state where you live, you may also have the following rights:
- Right to access the categories of personal data being processed (as permitted by applicable law, including the privacy law in Minnesota)
- Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in
California, Delaware, and Maryland )
- Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in
Minnesota and Oregon )
- Right to obtain a list of third parties to which we have sold personal data (as permitted by applicable law, including the privacy law in Connecticut)
- Right to review, understand, question, and depending on where you live, correct how personal data has been profiled (as permitted by applicable law, including the privacy law in
Connecticut and Minnesota )
- Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including the privacy law in California)
- Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including the privacy law in Florida)
How to Exercise Your Rights
To exercise these rights, you can contact usUnder certain US state data protection laws, you can designate an
Request Verification
Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.If you submit the request through an privacy@ownerspal.app California
California Civil Code Section 1798.83, also known as the
Appeals
Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us atCalifornia
California Civil Code Section 1798.83, also known as the 14. GOOGLE API SERVICES USER DATA POLICY
15. DO WE MAKE UPDATES TO THIS NOTICE?
In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.We may update this Privacy Notice from time to time. The updated version will be indicated by an updated