Privacy Policy

Effective date: September 16, 2026

Oh Local (the "Service") helps local businesses collect, understand, and respond to customer reviews and feedback. This policy explains what data we handle, why, and what your rights are. We have tried to write it in plain English. Where the plain English and the law disagree, the law wins.

Two kinds of people interact with the Service, and their data is treated differently:

• Owners — the businesses that sign up and pay for the Service.
• End customers — people who scan a business's QR code or short link, share their email, or send feedback to a business through the Service.

If you are an end customer, the short version is: your relationship is with the business you gave your email to, not with us. We hold your data on that business's behalf and on their instructions. See Section 8 for how to unsubscribe or be deleted.

1. Controller and processor, in plain words

Privacy law splits responsibility between whoever decides how data is used (the "controller," or "business" under California law) and whoever handles it on their instructions (the "processor," or "service provider").

• For Owner account data (your login, billing, business details), we are the controller. We decide how that data is used, within the limits of this policy.
• For end-customer data collected through a business's QR codes, links, and integrations (emails, feedback, scan activity), the business is the controller and we are their processor. We collect, store, and use that data only to provide the Service to that business and only on their instructions. We do not use their customer list for our own purposes, we do not market to it, and we never sell it.

One deliberate exception to "only on their instructions": if an end customer asks us directly to unsubscribe them or delete their data, we honor it. A business cannot instruct us to keep emailing someone who has opted out.

2. Data we collect

Owner account data

Name, email address, login credentials (stored as a hash, or via OAuth — we never store plaintext passwords), business and location details, connected-platform identifiers, and billing status. Payment card details go directly to Stripe; we never see or store full card numbers.

End-customer emails

When a customer chooses to share their email through a business's capture flow, we store the email, which location it came from, and a timestamp of their explicit consent. This is enforced in code: a contact record with no consent timestamp cannot be sent anything. Every email sent includes an unsubscribe link, and unsubscribes are applied to our records immediately — you will receive nothing further, except at most a message already in transit when you clicked.

Scan telemetry

When someone scans a code or opens a short link, we record the time, which code was used, and a coarse device signal stored as a salted hash that rotates monthly. We do not store IP addresses in scan or analytics records. (Our hosting providers process IP addresses transiently to serve requests, as any website's do.) The hash is first-party only — it is designed so it cannot be used to track anyone across other websites or be turned back into a device identity, and we keep no key that would let us connect old scans to new ones after the monthly rotation. Its purposes are narrow and first-party: helping a business tell "one person scanned five times" from "five people scanned once," and — if someone has joined that business's email list — avoiding asking them for a review after they have already tapped through to leave one. It is never used to work out which review site anyone went to for that purpose, is never shared, and is never combined with anything outside that one business's own records.

Review content from public platforms

We retrieve reviews that are already public on Google, TripAdvisor, Facebook, and Yelp, using official APIs and licensed data providers. This includes the review text, rating, date, and the reviewer's public display name and public profile signals. We store this so the business can read, analyze, and respond to its own reviews. We do not combine it with any other data we hold, and the Service has no way to link a public review to any contact record or scan.

Anonymous feedback

The Service lets end customers send a business private feedback anonymously. This is built with identity isolation: the feedback text is stored with no identifying data attached, and the relay contact information is kept where owner-facing systems have no way to look it up. The business sees the feedback; the Service gives it no way to see or look up who sent it. Identity is revealed only if the customer takes a deliberate, explicit action to reveal it — never automatically, never by owner request, and never by us — the only exception being disclosure a court or valid legal process compels, which the business still never receives through the Service. Where the law allows, we will attempt to notify you of such a demand and to narrow or challenge overbroad ones. Timestamps on anonymous feedback may be deliberately coarsened so a submission cannot be matched to a specific visit. Feedback may also be held and delivered on a randomized delay and batched with other submissions, so that timing cannot identify the sender. This delay is deliberate, platform-controlled, and not configurable by the business.

Owner edits to AI drafts

When an Owner edits an AI-drafted reply before publishing it, we keep the difference between the draft and the published version, along with any reason given for rejecting a draft. This is used to make future drafts for that account better, and — reviewed by our own staff, not by any AI provider — to find and fix systematic problems in how the Service writes. It is never used to train a generalized model, and one business's edits are never used to write for another. See Section 4 for what AI providers do and do not get, and Section 11a for who at our company can see it.

3. How we use data

• To run the Service: showing reviews, generating drafts and insights, sending consented emails, producing reports, billing, support, and security.
• AI drafting and analysis: review text and business context are sent to third-party large-language-model providers (currently Anthropic) to generate reply drafts and insights. By default, these providers do not train their models on this data. If that default ever changes for any provider we use, we will not send customer data to that provider without telling Owners first.
• Email sending: digests and reports to Owners; nudges and messages to end customers only where an explicit consent timestamp exists, always with a working unsubscribe.

About AI output. Reply drafts, insights, recommended actions and scores are generated by statistical models and may be inaccurate, incomplete, or unsuitable — and may not comply with the laws, professional rules, or platform policies that apply to an Owner's business, including HIPAA. They are suggestions. The Owner reviews and approves every reply before it is published and is responsible for validating anything they publish or act on; the Terms of Service (Section 5) set this out in full. Do not put protected health information, or anyone's sensitive personal data, into the Service — it is not built for it, and PAXST LLC is not a HIPAA business associate.

What we do not do: we do not sell personal information. We never share an Owner's customers' data — reviews, contacts, private feedback, anything a customer gave the business — with an advertising platform. For any business, for any reason, ever. We do not use one business's customer list to benefit another business, or ourselves.

There are exactly two things we do share with an advertising platform, both about you as a visitor or buyer of our own service and never about anyone's customers: that a browser visited our marketing pages, and — if you sign up after arriving from one of our ads — that the browser which clicked the ad went on to become a paying account, and which plan it chose. That second one is how we learn which of our advertising actually finds owners who stay, rather than owners who click. Both stop when you opt out at Your privacy choices or send a Global Privacy Control signal, and both are described in full below.

There is exactly one exception, and it is about our own visitors rather than anyone's customers: on our public marketing pages we run advertising tags from our advertising partners — currently Meta and Google — so we can show ads to people who have looked at this site and measure which of our ads work. Under California law that counts as sharing personal information for cross-context behavioral advertising, and you can switch all of it off at Your privacy choices with one click. It is described in full below.

Analytics and Google advertising on our own marketing pages. Our public marketing pages — the home page, pricing, the free audit page, guides, FAQ, comparison pages, sign-up, and these legal pages — use Google Analytics so we can see which pages people find useful. It records the page visited, roughly where in the world the visit came from, and a first-party cookie that distinguishes a returning visit from a new one. Because we also advertise on Google, Google Analytics is linked to our Google Ads account: unless you have opted out, it may tell Google Ads that a browser which clicked one of our ads went on to request a free audit, and may be used to show our ads to people who have visited this site. If you opt out at Your privacy choices or send Global Privacy Control, Google's advertising signals are switched off for you (we tell Google's tag to deny advertising storage and personalisation) and Google Analytics keeps only the page-use measurement.

Meta advertising on our own marketing pages. The same pages carry a Meta (Facebook) advertising pixel. It tells Meta that a browser visited a page of ours, so that we can show ads to people who have already looked at the site. This — like the Google advertising signals above — is sharing for cross-context behavioral advertising as California defines it, and you have an absolute right to stop it:

• Your privacy choices — one click, no account, no email address.
• Global Privacy Control. If your browser sends a GPC signal we treat it as a valid opt-out: we load no advertising pixel at all and deny Google's advertising signals. You do not have to tell us twice, and you do not have to visit that page.

The pixel runs on the marketing pages listed above and nowhere else — never on a signed-in Owner page, never on a customer-facing scan page or a private feedback thread, and never on a page whose address is itself a private link. What the pixel sees is a visit to a public page of our own website.

One event is sent from our server rather than from a page: when an account that arrived from one of our ads takes out a paid plan, we tell Meta that the browser which clicked the ad converted, and the monthly price of the plan. No name, no email, no business name, and nothing about the account's customers — the event carries Meta's own browser identifier (the _fbp cookie it set on the marketing page) and a dollar figure. If that cookie is absent — because you opted out, sent Global Privacy Control, or never visited from an ad — nothing is sent. No end-customer data is ever sent to Meta or to any other advertising platform, and the Owner's own data beyond that single conversion event — the dashboard, the replies, the insights — never leaves the service either.

If we add another advertising or analytics vendor later, it will appear in the table in Section 4 and be covered by the same opt-out — the control above turns off advertising sharing generally, not one named company.

It is not on any page where doing so could expose something private, and this is enforced in our code rather than by convention: not on a signed-in Owner page, not on the customer-facing scan page or a private feedback thread, and not on any page whose web address itself contains a private link — a claim, invite, ambassador or report link. Those addresses are secrets, and a measurement tag reports the address of every page it loads on.

4. Who we share data with (subprocessors)

We use a small set of vendors to run the Service. Each receives only what its job requires:

We may add or replace subprocessors; we will keep this table current and notify Owners of material changes. Beyond this table, we disclose data only if required by law, to prevent fraud or abuse, or as part of a business transfer — a merger, acquisition, sale of assets, or an internal reorganization that moves the Service into a different company under common ownership. In any of those, this policy continues to apply to data collected under it, and the receiving company is bound by it.

5. Google API Services — Limited Use disclosure

Oh Local's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What the connection accesses. When an Owner connects Google, we ask for one Google permission — managing Business Profile listings (https://www.googleapis.com/auth/business.manage) — plus the Google account's email address, so the Owner can see which login is connected. With it we list the Business Profile locations that login manages (so the Owner can pick theirs), read that location's reviews (so each reply is posted under the right review), and post a reply only after the Owner approves it. We never create, edit, or remove reviews, and we never change the listing itself.

What we store from it. The connected account's email address; the access credential Google issues (a refresh token), encrypted at rest and never shown to anyone, including us; the identifiers of the chosen location and of its reviews; and Google's moderation status for replies we published. We do not store review text, reviewer details, or listing content obtained through this connection. Disconnecting revokes the credential at Google and deletes it and those identifiers from our systems immediately.

In plain words, for data we access through a business's Google Business Profile connection:

• We use it only to provide the features the business connected it for — reading its reviews and publishing the replies the Owner approves.
• We do not sell it, use it for advertising, or use it to build profiles unrelated to the Service.
• We do not use it to train generalized AI or machine-learning models, and we do not send it to AI providers.
• Humans do not read it except with the Owner's permission or at their request (including support and quality review of the replies drafted for that Owner), for security or abuse investigation, to comply with law, or when it has been aggregated and de-identified.
• A business can disconnect Google at any time from its account settings, and can also revoke access at myaccount.google.com/permissions.

6. Retention

• Owner account data: kept for the life of the account, then deleted on a scheduled wind-down or immediately on request (see Section 7).
• Contacts: kept until the business deletes them, the account is deleted, or the end customer asks us to delete them. Unsubscribed status is retained (as a suppression record) so a deleted contact is not accidentally re-mailed.
• Scan telemetry: device hashes are effectively de-identified every month when the salt rotates; we do not keep any key that could re-identify them.
• Review content: retained while the account is active so history and trends work; deleted with the account.
• After cancellation: the account enters an export window (see the Terms of Service), after which data is deleted. One deliberate exception: so that printed QR codes keep resolving after cancellation, we retain the code itself, the business's name and page branding, and its review destinations — the minimum needed to keep a printed card landing on a working page — and nothing else. A card in a customer's wallet should never hit a dead page while we operate. Post-cancellation scans load that page and are not logged for analytics.

7. Owner rights

Owners can, at any time:

• Access and export — a full export of the account's data, on request, in a portable format.
• Export the contact list — always available, on every tier including Free, with no gate, delay, or upsell. The list belongs to the business, full stop.
• Correct — fix inaccurate account data in settings or by contacting us.
• Delete — request a hard delete of the entire account. We honor it, minus the narrow records law requires us to keep (e.g., billing records), and — unless you ask us to keep your printed codes resolving — a hard delete also retires them: scans land on a neutral 'this code is no longer active' page. Tell us which you want when you ask; keeping codes alive requires keeping the minimal mapping described in Section 6.

8. End-customer rights

Your relationship is with the business you gave your email to — we process your data on their behalf. Concretely:

• To stop receiving emails: click unsubscribe in any email. It is applied immediately to our records and requires no login or explanation.
• To be deleted: ask the business directly, or contact us at info@ohlocal.co and we will delete your contact record ourselves.
• Anonymous feedback stays anonymous: the business you wrote to cannot learn who you are unless you explicitly choose to reveal yourself. If you never do, neither will we — with one honest exception: a court order or valid legal process could compel us to disclose what we hold. Where the law allows, we will tell you and push back on overbroad demands. One caution: what you write is shown to the business verbatim — details in your own words ("I was there Tuesday at table 5") may identify you even though the Service never will.
• Public reviews: review content we display comes from the platform you posted it on (Google, TripAdvisor, Facebook, Yelp). To edit or remove a review, do so on that platform; our copy updates to follow it, normally within a day of our next refresh.

9. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it (this policy), to access it, to correct it, to delete it, and to opt out of its sale or sharing for cross-context behavioral advertising. We do not sell personal information. We do share it for cross-context behavioral advertising in one narrow way — the advertising tags of our advertising partners (currently Meta and Google) on our own marketing pages, described in Section 3 — and you can opt out of all of it in one click at Your privacy choices, with no account and no email address. We also honour Global Privacy Control: if your browser sends that signal we treat it as a valid opt-out immediately, load no advertising pixel, and deny Google's advertising signals. For any other request the channel is info@ohlocal.co. We will never discriminate against you for exercising these rights. If you make a request as an end customer of one of our business customers, we may route it to that business, since they are the controller — or handle it directly where we can (unsubscribes and deletions, we handle directly).

10. Cookies

We use a minimal set of first-party cookies: keeping Owners logged in, remembering basic preferences, a 30-day cookie that remembers which of our own ads or links you first arrived by (so we can tell which of our advertising is worth running — it holds campaign labels, nothing about you), and — on our public marketing pages only — the Google Analytics measurement cookie described in Section 3. Our public marketing pages also set Meta's advertising cookie and allow Google's advertising signals, unless you have opted out or your browser sends Global Privacy Control — see Section 3. No cross-site fingerprinting, and no advertising cookie of any kind outside those marketing pages. The customer-facing scan pages set no third-party cookies and carry no analytics tag; they store one small on-device preference (which review platform you already used) and compute the short-lived, first-party device signal described in Section 2.

11. Security

Data is encrypted in transit and at rest. Access is role-limited and logged. The systems a business can access are built with no way to look up who sent anonymous feedback — it is not a rule we follow, it is a lookup that does not exist. No system is perfectly secure; if a breach affects your data, we will notify affected parties as the law requires, and sooner where we can.

11a. Who at our company can see your data

Access is limited to the small number of people who operate the Service, is authenticated separately from any customer login, and is logged. We look at Owner and end-customer data only:

• to provide support, including when you ask us about something specific;
• to keep the Service working and safe — investigating errors, abuse, fraud, or a security issue;
• to review the quality and safety of AI output — reading the drafts the Service produced, the edits Owners made to them, and any drafts flagged as bad, so that a poor or unsafe reply is caught by us rather than by your customers. Changes we make to a draft from these tools are recorded;
• where the law requires it, or where the data has been aggregated and de-identified so that no business or person is identifiable.

We do not read anonymous-feedback identities — the lookup does not exist (Section 11) — and we do not browse customer data for any other reason.

12. Children

The Service is not directed to children under 13, and we do not knowingly collect their personal information. If we learn we have, we will delete it. If you believe a child's data has reached us, contact info@ohlocal.co.

13. Changes to this policy

We will post changes here with a new effective date. For material changes, we will email Owners before the change takes effect. Continued use after the effective date means the new policy applies.

14. Contact

PAXST LLC 7362 University Ave NE Ste 310-5 #114, Fridley, MN 55432, United States info@ohlocal.co