Privacy Policy

Meritvance LLC, a Florida limited liability company operating Aclamia ("Aclamia," "we," "us," or "our"), provides the growth platform for local businesses available at aclamia.com, together with its mobile applications and browser extension (collectively, the "Service"). This Privacy Policy explains how we collect, use, share, and protect information about you when you use our Service.

By using Aclamia, you agree to the collection and use of information in accordance with this Policy. If you do not agree with this Policy, please do not use the Service.

Effective date: See the header above.

We collect the following categories of information:

Account information. When you register, we collect your name, email address, and (if you sign in with Google) your Google profile data including profile photo. If you enable two-factor authentication, we store the data needed to verify your second factor. If you enable approval or alerts over WhatsApp or SMS, we collect and verify the phone number you provide for that purpose. We also store your time zone, which we use to send messages to you only during permitted hours.

Trial abuse prevention. Each product's free trial is given once per person. To enforce this we keep, for each trial: (a) a one-way SHA-256 hash of a small set of coarse signals your browser or app already exposes to any page — user agent, language, time zone, screen size and colour depth, and the reported CPU count — computed when you create an account and when you start a trial that requires a card; the signals themselves are never stored, the hash cannot be reversed into them, and we do not use canvas, WebGL or audio fingerprinting; (b) your account identifier and, if your email address is on a company domain rather than a free email provider, that domain; and (c) for a trial that requires a card, a one-way hash of the card identifier Stripe gives us (never the card number) and a keyed one-way hash of your full email address, normalized, only if you have verified that address. We also mark your account once it has had a trial, and when you connect a Google Business Profile we record its identifier, so that the same business cannot start a second trial from another account. A trial that requires a card can only be started with a card, and it is not given again to an account, device, card, email address or company domain that has already had one. We use these records only to enforce the one-trial rule — never to track you across websites or for advertising — and keep them for the periods in Data Retention (section 7), which continue after your account is deleted.

Business information. To provide the Service, we collect and store your business name, address, and Google Business Profile data including review content, responses, and account metadata. If you use our website, menu, or advertising tools, we also store the business content you create or upload there (text, images, videos, logos, menus, offers).

Customer contacts. When you use our review request feature, you provide us with your customers' names, phone numbers, and/or email addresses. This information belongs to your customers and is processed on your behalf. We do not use your customers' contact information for any purpose other than delivering review request messages on your behalf.

Payment information. Payments are processed by Stripe. Your full card details are collected by and stored with Stripe, not on Aclamia's servers; we retain only billing metadata (plan, invoices, payment status, last-4 digits as provided by Stripe). For a trial that requires a card, we also keep a one-way hash of the card identifier Stripe provides, as described under Trial abuse prevention.

Referral and promotion data. If you participate in the referral program or redeem a promo code, we record the referral attribution and code usage to grant rewards and prevent abuse.

Usage data. With your consent in the cookie banner, we collect anonymized product analytics via PostHog: pages visited, features used, browser and device type, and referring URL. Analytics events do not identify you, and analytics does not run until you accept it.

Security and audit records. Independently of analytics consent, we record the IP address and browser identifier of certain actions in order to secure the Service and to evidence consent: sign-in and security events, sensitive account operations (kept in an audit log), your acknowledgement when you enable Auto-Publish, and submissions through our contact form, enterprise inquiries, custom website requests, and the lead forms on pages you publish. These records are used only for security, fraud prevention, compliance and support, and never for advertising.

Mobile devices. If you install our mobile app and enable push notifications, we store a push notification token for your device (via Firebase Cloud Messaging) and basic device information needed to deliver notifications.

Visitor data on pages you publish. If you publish a website or digital menu through Aclamia (where available), visitors to those pages may submit information through your lead-capture forms. We collect that data — together with the visitor's IP address, which we keep for spam prevention — on your behalf and deliver it to you; you are responsible for how you use it. We do not use it for our own purposes.

Communications. If you contact us via the contact form or by email, we retain those communications to respond to your inquiry and improve our support.

Agency accounts. If your account is managed by an agency on the Agency plan, the agency account holder can view your business data and reviews and act on your behalf; each of those actions is recorded in an audit log. The agency is responsible for having your authority to do so, and you can ask it to remove your account from its management at any time.

We use the information we collect to:

• Provide, maintain, and improve the Service.
• Generate AI content you request (review response drafts, website copy, ad creatives) and run automated safety moderation on AI output. This processing uses a third-party AI provider — see section 5.
• Send transactional emails (account notifications, billing receipts, review notifications) via Resend, and occasional product updates, from which you can unsubscribe at any time.
• Send SMS and WhatsApp review request messages to your customers on your behalf via Twilio, and — where you enable them — approval and alert messages to your own phone. See our Carrier/Messaging Policy for full opt-in/opt-out terms.
• Send push notifications to your devices where you have enabled them.
• Process payments via Stripe.
• Operate the referral and promotion programs and detect fraud or abuse.
• Analyze aggregate, anonymized usage patterns to improve product features (via PostHog).
• Respond to your support requests and communications.
• Enforce our Terms of Service, protect the security of the platform, and comply with legal obligations.

We do not use your information to build advertising profiles, sell your data to third parties, or share it with any party not listed in this Policy.

California residents (CCPA/CPRA). Aclamia does not "sell" or "share" personal information as those terms are defined by California law, and does not use personal information for cross-context behavioral advertising. Because no sale or sharing occurs, there is nothing to opt out of today — California law requires a "Do Not Sell or Share My Personal Information" link only of businesses that do sell or share. Your data is not shared with data brokers or advertising networks.

If this ever changes. A privacy policy should be clear and honest, so we want to be upfront: nothing prevents this from changing in the future. If it ever does, we will update this Policy before any such activity begins, tell you plainly what is changing, and give you a real way to opt out.

Aggregated anonymous analytics. Aclamia may produce aggregated, anonymized industry benchmarks derived from usage data — for example, "average review response time for restaurants in a given region." These benchmarks:

• Contain no personally identifiable information.
• Cannot be reverse-engineered to identify individual businesses or users.
• Do not constitute "selling personal data" under any applicable law.

If Aclamia ever publishes or licenses such benchmarks externally, we will update this section with specifics before doing so.

We share data only with trusted service providers acting on our behalf under written data processing agreements:

Each provider is contractually prohibited from using your data for purposes other than providing the relevant service to Aclamia.

About AI processing. When you request AI-generated content, the relevant context (for example, the review text and your business profile details) is sent to OpenAI's API to produce the draft. Under OpenAI's API terms, this data is not used to train their models. We do not send your customers' phone numbers or email addresses to the AI provider.

Platforms you connect. When you connect a third-party account — your Google Business Profile, or an advertising account on Meta, Google or TikTok — we store the access token you authorize, encrypted, and use it only to perform the actions you request, such as reading and replying to reviews or publishing the campaigns you approve. Those platforms process your data under their own terms and privacy policies. You can disconnect a platform at any time from your dashboard or from the platform's own account settings, and we delete the stored token when you do.

We may also disclose information if required by law, court order, or governmental request, or where reasonably necessary to protect the rights, safety, or property of Aclamia, its users, or the public, and in connection with a merger, acquisition, or sale of assets (in which case this Policy continues to apply to previously collected data until updated).

We access your Google Business Profile via OAuth 2.0 on your behalf. We store review data, response history, and account metadata in order to provide the Service. This data is:

• Used solely to provide features within the Aclamia platform.
• Not shared with third parties beyond the service providers listed above.
• Retained for as long as your account is active, plus the data retention period described below.

You may revoke Aclamia's access to your Google account at any time through your Google account settings at myaccount.google.com.

• Active accounts: Your data is retained for the life of your account.
• Deleted accounts: Upon account deletion, your data is retained for 30 days before permanent deletion, allowing for data export or account recovery in case of accidental deletion. You can restore the account yourself at any point during that window.
• Inactive accounts: If you never started a paid subscription and do not sign in for 180 days, we close the account so we are not holding personal data with no purpose. We email you 30 days and again 7 days beforehand, and signing in at any time resets the clock. A closed account then enters the same 30-day recovery window described above before permanent deletion. Accounts that have held a paid subscription are not closed for inactivity.
• Backups: System backups are retained for a limited period after the deletion window, after which your data is gone from them as well.
• Customer contact data: The names, phone numbers, email addresses and message contents of the customers you contact through review requests are erased when your account is permanently deleted. The underlying delivery records are kept in anonymized form (no personal data) for up to 4 years, because US telemarketing rules require us to be able to evidence consent and opt-outs. Phone numbers that reply STOP are the one exception: they are kept on a platform-wide suppression list indefinitely, so that no business using Aclamia can message them again.
• Published content: Websites or menus published through the Service are unpublished when the associated subscription ends, and their content follows the account retention schedule above. The web address (slug) of a deleted site or menu is never reassigned to another business, to prevent impersonation of an address that may already be printed on your materials; the address itself holds no personal data.
• Trial records: The trial-abuse records described in section 2 (the hashes, the company email domain and the account identifier) are kept for 3 years after the trial was given and then deleted automatically, even if you delete your account sooner: keeping them is what stops a deleted and re-created account from repeating a trial. A second record that holds only the card's hash, used so that two trials cannot start on the same card at once, follows the same 3 years. The device hash that a card-trial checkout uses is held for at most 4 days, until the trial is recorded. The mark on your account that it has had a trial is kept while the account exists, and a business profile's identifier for 12 months after it was recorded.
• Website drafts and uploaded videos: A website draft that has never been published and has no plan is deleted, with its photos and videos, after 90 days without activity; we email you before it is deleted, and opening or editing it restarts the period. The original video file you upload is deleted once it has been converted to play in a browser; the converted video is kept like the rest of your website's content.

We do not currently offer a separate early-deletion process. Account deletion follows the 30-day recovery window described above; during that window, the account can be restored, and there is no separate hard-delete request available through the Service. For questions about the process, contact support@aclamia.com.

We protect your data with industry-standard measures, including encryption in transit (TLS) and at rest, network protections and access controls, optional two-factor authentication for your account, and audit logging of sensitive operations. Access to production data by our personnel is restricted to what is necessary to operate the Service and support you.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by applicable law.

You have the following rights regarding your personal data:

Access & correction. You may access and correct your account information at any time through your account settings.

Deletion. You may request deletion of your account and associated data by contacting support@aclamia.com or through your account settings. We will process deletion requests within 30 days.

Data export. You may export your data (reviews, responses, business data) via your account settings or by contacting us.

California residents (CCPA/CPRA). You have the right to know what personal information we collect, to request correction or deletion, and to opt out of any sale or sharing (no sale or sharing occurs — see section 4). We do not discriminate against you for exercising these rights.

EU/EEA and UK residents (GDPR). In addition to the rights above, you have the right to data portability, the right to restrict processing, the right to object to processing, and the right to lodge a complaint with your supervisory authority. Where we process your data, we rely on the performance of our contract with you, our legitimate interests in operating and securing the Service, your consent (for analytics), and compliance with legal obligations. Contact us at legal@meritvance.com to exercise GDPR rights.

Your customers. If one of your customers contacts us directly to exercise rights over data you uploaded (for example, their phone number), we will honor opt-outs directly and otherwise refer the request to you as the controller of that data, assisting as needed.

Aclamia is operated from the United States and your information is processed and stored on servers located in the United States. If you use the Service from outside the U.S., you understand that your information will be transferred to and processed in the U.S., where data protection laws may differ from those of your jurisdiction.

We use cookies and similar technologies to provide and improve the Service. A brief summary:

• Core and preference technologies: Firebase-managed browser authentication state; cookie consent choice in local storage; the session-scoped NEXT_LOCALE cookie set by our internationalization layer; theme preference in local storage; interface-state entries in local or session storage once you are signed in (selected business, sidebar state, dismissed banners); the optional app_ref referral-attribution cookie, set only when a valid ?ref= code is present and retained for up to 90 days; and, where enabled, the Google reCAPTCHA Enterprise cookies that Firebase App Check uses to protect sign-in and API access against bots. Images and files we host are delivered through Cloudflare, which may set a short-lived security cookie such as __cf_bm on that domain. The web app does not issue an Aclamia session cookie or a separate CSRF token; API requests carry Firebase ID tokens in the Authorization header.
• Analytics: PostHog (anonymized, first-party, consent-based, no cross-site tracking) stores data in browser local storage. Withdrawing consent stops future collection; data already stored in the browser is not automatically cleared.
• Payment: Stripe — no Stripe script runs on our site; checkout and billing management redirect you to Stripe's hosted pages, where Stripe sets its own cookies on its domains.

You can manage cookie preferences through the Cookie Settings button on our website. For full details, see our Cookie Policy.

Mobile apps. Our iOS and Android apps collect the same account and business data as the web application, plus a push notification token if you enable notifications. You can disable push notifications at any time in your device settings.

Browser extension. The Aclamia browser extension is an optional companion to your account. It stores your authentication token in session-scoped browser storage (cleared when the browser closes), plus a small local cache (pending review count, last sync time, and your most recent AI drafts) used to render its badge and popup. The extension communicates only with Aclamia's own backend, reads pages only on Google Business Profile management screens to offer the "Use AI Draft" button, and contains no analytics, trackers, or third-party requests. It does not collect your browsing history or the content of other tabs. Signing out from the popup or uninstalling the extension removes all locally stored extension data.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected information from a child, please contact us at support@aclamia.com and we will promptly delete it.

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' email notice to active subscribers before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

Continued use of the Service after the effective date of any change constitutes your acceptance of the updated Policy.

For privacy questions or to exercise your rights, contact us:

• Web: aclamia.com/contact
• Email: legal@meritvance.com
• Response time: We aim to respond within 5 business days.