Privacy Policy

1. Information We Collect

We collect only the data strictly required to execute local Google Business Profile automation, rank tracking, and hardware standee fulfillment:

• Merchant Account Data: Business entity name, authorized owner name, business contact email, phone number, physical storefront address, and billing coordinates.
• Google Business Profile Data via OAuth: Upon your explicit authorization, we access your Google Place ID, location categories, customer reviews, reviewer display names, star ratings, review timestamps, existing owner responses, and performance metrics via official Google APIs.
• Physical NFC Standee Telemetry: Tap event counts, interaction timestamps, and device operating system (iOS or Android) used to evaluate in-store review conversion. Standees collect zero personal identifying information from guests.
• Technical & Session Logs: IP address, browser type, referral URLs, and session duration captured to ensure infrastructure security and prevent abuse.

2. Google API Services User Data Policy Compliance

Scaliz's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements:

• We request access only to the Google scopes needed to automate review reading and response publishing.
• We do not transfer or disclose your Google user data to third parties, advertising networks, or data brokers.
• We do not use your Google user data to serve targeted advertisements.
• We do not allow human personnel to view your private Google account data unless you explicitly provide consent to diagnose a specific technical issue, or as required by binding law.

3. AI Response Generation & Non-Training Guarantee

When Scaliz generates contextual 14-second review responses, your data is processed through dedicated enterprise inference clusters under strict non-retention agreements:

• Your customer reviews and brand details are never added to foundation model training sets.
• Prompts are processed transiently in volatile memory and purged immediately upon response generation.
• Your brand guardrails, custom menu items, and medical specializations remain strictly confidential to your account.

4. Data Storage, Security & Encryption

We adhere to strict cryptographic standards to protect your data across its lifecycle:

• Encryption at Rest: All databases, OAuth tokens, and configurations are secured with AES-256 encryption.
• Encryption in Transit: 100% of network interactions utilize TLS 1.3 with automated certificate renewal.
• OAuth Key Vaulting: Google API tokens are stored in isolated hardware security modules (HSM) with continuous rotation.

5. Data Retention, Revocation & Your Rights

Under the Digital Personal Data Protection (DPDP) Act 2023, GDPR, and California Consumer Privacy Act (CCPA), you retain full sovereignty over your information:

• Instant Disconnection: You can disconnect your Google Business Profile with one click in the Client Portal. All active OAuth tokens are permanently erased within 60 seconds.
• Direct Google Revocation: You can independently revoke Scaliz permissions anytime via myaccount.google.com/permissions.
• Right to Erasure: You may request full account deletion and complete erasure of all historical activity logs by emailing privacy@scaliz.in.

6. Data Protection Officer (DPO) & Contact Desk

For privacy inquiries, regulatory notices, or data subject access requests (DSAR), please contact our Data Protection Office: