Privacy

Who operates this service

Legal business identity and contact details have not been confirmed in the app code.

• Business identity: [PLACEHOLDER: legal business name, entity type, and mailing address]
• Privacy contact: [PLACEHOLDER: monitored email address or other privacy contact method]
• Effective date: [PLACEHOLDER: effective date]

Information the app records

The app stores records in its PostgreSQL database. Depending on the feature used, records can include:

• Demo and business inquiry forms: book-a-demo submissions include name, business, phone, email, and service interest. Vertical forms can include a contact name, phone, email, business or firm name, industry or practice area, pain point, and, on the qualified med spa form, monthly call volume. Some submissions are also copied into a prospect record with source and notes.
• ROI tools: the ROI calculator records an email address, industry, average client value, calls per day, hours closed, and submitted or calculated missed-call, lost-client, and lost-revenue values. The ROI audit can also record business name, phone, monthly call volume, average client value, its revenue estimate, and UTM source, medium, and campaign values.
• Customer onboarding: submitted onboarding records include customer email, customer name when provided, plan, survey responses, and a Stripe payment-intent ID when provided.
• Interactive demos: the receptionist demo records session messages and can record a lead's name, phone, email, intent, booking reference, and notes. The homepage chat demo records user and AI messages, session and exchange details, and an optional quick prompt.
• Checkout records: after a completed checkout event, the app records customer name and email, plan, amount, currency, and transaction-related event, checkout-session, and payment-intent IDs when supplied. The app code does not store payment card numbers.
• Lead-finder searches: searches record the requested location and industry, query, status, and returned business results such as company name, industry, address, phone, website, and description.
• Prospect, outreach, response, and call records: these operational records can include business and contact names, email addresses, phone numbers, industry, research notes, outreach subjects and message bodies, reply content, call notes and outcomes, source details, and timestamps.

The homepage lead-capture widget currently displays a success message without sending its entered form values to an app endpoint. Clicking its submit button is counted as a demo CTA event as described below.

How information is used and sent

• Form and calculator records support responding to inquiries, producing ROI estimates, and maintaining the app's prospect and customer workflows.
• When OpenAI is configured, the receptionist and homepage chat demos send the current message and conversation input to OpenAI to generate a response.
• Lead-finder search details are sent to the Polsia agent to run a business search; returned results are saved by the app.
• Checkout takes place through Stripe-hosted payment links. The app receives completed-checkout metadata through its webhook and stores the metadata listed above.
• The app sends ROI audit emails and payment-related customer emails through the Polsia email proxy.

Provider terms, provider roles, and where providers process or store information have not been confirmed here: [PLACEHOLDER: confirm relevant provider terms, roles, and processing locations].

Browser analytics and demo CTA events

If POLSIA_ANALYTICS_SLUG is configured, the page script creates or reuses a visitor ID named polsia_vid in browser localStorage and sends the configured slug and visitor ID to the Polsia analytics beacon.

When a visitor clicks a control marked as a demo CTA, the browser sends the current local page path to this app. The app stores a demo_cta_click event, that path, and a database timestamp. This includes the homepage lead-capture widget's submit control.

Retention and privacy requests

The app code does not establish how long records are retained, how they are deleted, or how an individual can make a privacy request. These practices need confirmation:

• Retention and deletion periods: [PLACEHOLDER: confirmed retention periods and deletion process]
• Access, correction, deletion, or other requests: [PLACEHOLDER: request steps, verification method, and response timeline]
• Legal basis, if applicable: [PLACEHOLDER: confirmed legal basis by purpose and applicable jurisdiction]
• Marketing and outreach messages and preferences: [PLACEHOLDER: confirmed email preference, unsubscribe, and outreach handling process]

Security and location

The security controls and geographic processing locations for the app and its providers have not been verified for this draft.

• Security controls: [PLACEHOLDER: confirm applicable technical and organizational controls]
• Processing and transfer locations: [PLACEHOLDER: confirm where the app and providers process or store data, including any cross-border transfers]
• Applicable jurisdictions: [PLACEHOLDER: confirm jurisdictions and any location-specific terms]