Privacy Policy
Effective date: August 17, 2026
OhLocal (the "Service") helps local businesses collect, understand, and respond to customer reviews and feedback. This policy explains what data we handle, why, and what your rights are. We have tried to write it in plain English. Where the plain English and the law disagree, the law wins.
Two kinds of people interact with the Service, and their data is treated differently:
- Owners — the businesses that sign up and pay for the Service.
- End customers — people who scan a business's QR code or short link, share their email, or send feedback to a business through the Service.
If you are an end customer, the short version is: your relationship is with the business you gave your email to, not with us. We hold your data on that business's behalf and on their instructions. See Section 8 for how to unsubscribe or be deleted.
1. Controller and processor, in plain words
Privacy law splits responsibility between whoever decides how data is used (the "controller," or "business" under California law) and whoever handles it on their instructions (the "processor," or "service provider").
- For Owner account data (your login, billing, business details), we are the controller. We decide how that data is used, within the limits of this policy.
- For end-customer data collected through a business's QR codes, links, and integrations (emails, feedback, scan activity), the business is the controller and we are their processor. We collect, store, and use that data only to provide the Service to that business and only on their instructions. We do not use their customer list for our own purposes, we do not market to it, and we never sell it.
One deliberate exception to "only on their instructions": if an end customer asks us directly to unsubscribe them or delete their data, we honor it. A business cannot instruct us to keep emailing someone who has opted out.
2. Data we collect
Owner account data
Name, email address, login credentials (stored as a hash, or via OAuth — we never store plaintext passwords), business and location details, connected-platform identifiers, and billing status. Payment card details go directly to Stripe; we never see or store full card numbers.
End-customer emails
When a customer chooses to share their email through a business's capture flow, we store the email, which location it came from, and a timestamp of their explicit consent. This is enforced in code: a contact record with no consent timestamp cannot be sent anything. Every email sent includes an unsubscribe link, and unsubscribes are applied to our records immediately — you will receive nothing further, except at most a message already in transit when you clicked.
Scan telemetry
When someone scans a code or opens a short link, we record the time, which code was used, and a coarse device signal stored as a salted hash that rotates monthly. We do not store IP addresses in scan or analytics records. (Our hosting providers process IP addresses transiently to serve requests, as any website's do.) The hash is first-party only — it is designed so it cannot be used to track anyone across other websites or be turned back into a device identity, and we keep no key that would let us connect old scans to new ones after the monthly rotation. Its only purpose is to help a business tell "one person scanned five times" from "five people scanned once."
Review content from public platforms
We retrieve reviews that are already public on Google, TripAdvisor, Facebook, and Yelp, using official APIs and licensed data providers. This includes the review text, rating, date, and the reviewer's public display name and public profile signals. We store this so the business can read, analyze, and respond to its own reviews. We do not combine it with any other data we hold, and the Service has no way to link a public review to any contact record or scan.
Anonymous feedback
The Service lets end customers send a business private feedback anonymously. This is built with identity isolation: the feedback text is stored with no identifying data attached, and the relay contact information is kept where owner-facing systems have no way to look it up. The business sees the feedback; the Service gives it no way to see or look up who sent it. Identity is revealed only if the customer takes a deliberate, explicit action to reveal it — never automatically, never by owner request, and never by us — the only exception being disclosure a court or valid legal process compels, which the business still never receives through the Service. Where the law allows, we will attempt to notify you of such a demand and to narrow or challenge overbroad ones. Timestamps on anonymous feedback may be deliberately coarsened so a submission cannot be matched to a specific visit. Feedback may also be held and delivered on a randomized delay and batched with other submissions, so that timing cannot identify the sender. This delay is deliberate, platform-controlled, and not configurable by the business.
Owner edits to AI drafts
When an Owner edits an AI-drafted reply before publishing it, we keep the difference between the draft and the published version. This is used to make future drafts for that account better. See Section 4 for what AI providers do and do not get.
3. How we use data
- To run the Service: showing reviews, generating drafts and insights, sending consented emails, producing reports, billing, support, and security.
- AI drafting and analysis: review text and business context are sent to third-party large-language-model providers (currently Anthropic) to generate reply drafts and insights. By default, these providers do not train their models on this data. If that default ever changes for any provider we use, we will not send customer data to that provider without telling Owners first.
- Email sending: digests and reports to Owners; nudges and messages to end customers only where an explicit consent timestamp exists, always with a working unsubscribe.
What we do not do: we do not sell personal information. We do not share it for cross-context behavioral advertising. We do not run third-party ad trackers. We do not use one business's customer list to benefit another business, or ourselves.
4. Who we share data with (subprocessors)
We use a small set of vendors to run the Service. Each receives only what its job requires:
| Subprocessor | What they do for us | Data they handle |
|---|---|---|
| Vercel | Application hosting and delivery | Request data passing through the app |
| Supabase | Database, authentication, storage | Stored Service data (encrypted at rest) |
| Stripe | Billing and payments | Owner billing details and payment status |
| Resend | Email delivery | Recipient email addresses and message content |
| Anthropic | AI drafting and insights | Review text and business context (no model training on this data by default) |
| DataForSEO | Retrieval of public review data | Public business identifiers we query; they return public review content |
We may add or replace subprocessors; we will keep this table current and notify Owners of material changes. Beyond this table, we disclose data only if required by law, to prevent fraud or abuse, or as part of a business transfer (in which case this policy continues to apply to data collected under it).
5. Google API Services — Limited Use disclosure
OhLocal's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In plain words, for data we access through a business's Google Business Profile connection:
- We use it only to provide the features the business connected it for — reading its reviews and publishing the replies the Owner approves.
- We do not sell it, use it for advertising, or use it to build profiles unrelated to the Service.
- We do not use it to train generalized AI or machine-learning models.
- Humans do not read it except with the Owner's permission, for security or abuse investigation, to comply with law, or when it has been aggregated and de-identified.
- A business can disconnect Google at any time from its account settings, and can also revoke access at myaccount.google.com/permissions.
6. Retention
- Owner account data: kept for the life of the account, then deleted on a scheduled wind-down or immediately on request (see Section 7).
- Contacts: kept until the business deletes them, the account is deleted, or the end customer asks us to delete them. Unsubscribed status is retained (as a suppression record) so a deleted contact is not accidentally re-mailed.
- Scan telemetry: device hashes are effectively de-identified every month when the salt rotates; we do not keep any key that could re-identify them.
- Review content: retained while the account is active so history and trends work; deleted with the account.
- After cancellation: the account enters an export window (see the Terms of Service), after which data is deleted. One deliberate exception: so that printed QR codes keep resolving after cancellation, we retain the code itself, the business's name and page branding, and its review destinations — the minimum needed to keep a printed card landing on a working page — and nothing else. A card in a customer's wallet should never hit a dead page while we operate. Post-cancellation scans load that page and are not logged for analytics.
7. Owner rights
Owners can, at any time:
- Access and export — a full export of the account's data, on request, in a portable format.
- Export the contact list — always available, on every tier including Free, with no gate, delay, or upsell. The list belongs to the business, full stop.
- Correct — fix inaccurate account data in settings or by contacting us.
- Delete — request a hard delete of the entire account. We honor it, minus the narrow records law requires us to keep (e.g., billing records), and — unless you ask us to keep your printed codes resolving — a hard delete also retires them: scans land on a neutral 'this code is no longer active' page. Tell us which you want when you ask; keeping codes alive requires keeping the minimal mapping described in Section 6.
8. End-customer rights
Your relationship is with the business you gave your email to — we process your data on their behalf. Concretely:
- To stop receiving emails: click unsubscribe in any email. It is applied immediately to our records and requires no login or explanation.
- To be deleted: ask the business directly, or contact us at hello@ohlocal.co and we will delete your contact record ourselves.
- Anonymous feedback stays anonymous: the business you wrote to cannot learn who you are unless you explicitly choose to reveal yourself. If you never do, neither will we — with one honest exception: a court order or valid legal process could compel us to disclose what we hold. Where the law allows, we will tell you and push back on overbroad demands. One caution: what you write is shown to the business verbatim — details in your own words ("I was there Tuesday at table 5") may identify you even though the Service never will.
- Public reviews: review content we display comes from the platform you posted it on (Google, TripAdvisor, Facebook, Yelp). To edit or remove a review, do so on that platform; our copy updates to follow it, normally within a day of our next refresh.
9. California privacy rights (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect and how we use it (this policy), to access it, to correct it, to delete it, and to opt out of its sale or sharing for cross-context behavioral advertising. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of — but the request channel exists regardless: hello@ohlocal.co. We will never discriminate against you for exercising these rights. If you make a request as an end customer of one of our business customers, we may route it to that business, since they are the controller — or handle it directly where we can (unsubscribes and deletions, we handle directly).
10. Cookies
We use a minimal set of first-party cookies: keeping Owners logged in and remembering basic preferences. No cross-site tracking, no third-party advertising cookies, no cross-site fingerprinting. The customer-facing scan pages set no third-party cookies; they store one small on-device preference (which review platform you already used) and compute the short-lived, first-party device signal described in Section 2.
11. Security
Data is encrypted in transit and at rest. Access is role-limited and logged. The systems a business can access are built with no way to look up who sent anonymous feedback — it is not a rule we follow, it is a lookup that does not exist. No system is perfectly secure; if a breach affects your data, we will notify affected parties as the law requires, and sooner where we can.
12. Children
The Service is not directed to children under 13, and we do not knowingly collect their personal information. If we learn we have, we will delete it. If you believe a child's data has reached us, contact hello@ohlocal.co.
13. Changes to this policy
We will post changes here with a new effective date. For material changes, we will email Owners before the change takes effect. Continued use after the effective date means the new policy applies.
14. Contact
PAXST LLC 7362 University Ave NE Ste 310-5 #114, Fridley, MN 55432, United States hello@ohlocal.co