Privacy Policy

This Privacy Policy describes how Advosec LLC, doing business as The Pylon Group (“we,” “us,” or “our”), collects, uses, and shares information when you use the Pylon platform and related services (collectively, the “Service”) available at thepylongroup.com.

By using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

1. Information We Collect

Account Information

When you create an account, we collect your name, email address, and authentication credentials. If you sign up using a third-party provider (such as Google), we receive your name and email from that provider.

Business Profile Information

We collect information about your business that you provide during onboarding and through your account settings, including your business name, category, description, address, phone number, and website.

Google Business Profile Data

When you connect your Google Business Profile, we access and store customer reviews, reviewer names, star ratings, review text, and review dates. We also store OAuth tokens necessary to maintain the connection and post responses on your behalf.

Phone Numbers and SMS Data

Through our After Hours feature, we collect phone numbers of individuals who call your Pylon-provisioned business number. We store SMS message content exchanged between your business and callers, including automated initial messages and subsequent replies. Call metadata such as timestamps and call duration may also be collected.

Voice and Tone Preferences

We collect the voice and tone settings you configure, including preferred tone, phrases you want included or excluded from responses, example responses, and custom instructions. This data is used to personalize AI-generated content.

Payment Information

Payment processing is handled by Stripe. We do not store your full credit card number, CVV, or other sensitive payment details on our servers. We receive and store your Stripe customer ID, subscription status, plan type, and billing period information.

Usage Data

We collect activity logs related to your use of the Service, including actions such as reviews received, responses generated, responses approved, and responses posted. We may also collect standard web analytics data such as IP address, browser type, and pages visited.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Generate AI-drafted review responses tailored to your voice and tone
• Send automated SMS messages to callers on your behalf through the After Hours feature
• Post approved responses to your Google Business Profile
• Process payments and manage your subscription
• Send transactional emails such as new review notifications
• Improve the quality of AI-generated responses based on your edits and feedback
• Monitor and analyze usage trends to improve the Service
• Comply with legal obligations

3. Third-Party Services

We share data with the following third-party service providers, each of which processes data solely to help us deliver the Service:

• Supabase — Database hosting, authentication, and data storage. Your account data, business profiles, reviews, and responses are stored in Supabase-managed PostgreSQL databases.
• Anthropic — AI processing. Review text, business context, and voice settings are sent to Anthropic's Claude API to generate draft responses. Anthropic processes this data according to their data usage policies and does not use your data to train their models when accessed via their API.
• Twilio — Voice and SMS services. Phone numbers, call metadata, and SMS message content are processed through Twilio to power the After Hours feature. Twilio provisions and manages your business phone number.
• Stripe — Payment processing. Your payment method and billing information are handled by Stripe. We do not have access to your full payment card details.
• Resend — Transactional email delivery. Your email address and notification content are shared with Resend to send you new review alerts and other service-related emails.
• Vercel — Application hosting. Standard web request data (IP addresses, request logs) is processed by Vercel as part of hosting the Service.
• Google — We access the Google Business Profile API using OAuth credentials you authorize to sync reviews and post responses.

We do not sell your personal information to third parties. We do not share your data with third parties for their own marketing purposes.

4. Data Retention

We retain your data for as long as your account is active and as needed to provide the Service. Specifically:

• Account and business profile data is retained while your account is active.
• Reviews and responses are retained while your account is active to support response history and voice learning.
• SMS conversations and call records are retained while your account is active.
• Payment records are retained as required by applicable tax and financial regulations.

Upon account deletion or upon your request, we will delete your personal data within 30 days, except where retention is required by law. To request deletion of your data, contact us at support@thepylongroup.com.

5. Cookies and Tracking

We use minimal cookies, limited to what is necessary for authentication and session management. We do not use third-party advertising cookies or cross-site tracking technologies. Our authentication cookies are strictly functional and are required for the Service to operate.

6. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS/SSL), encrypted storage of sensitive credentials (OAuth tokens), and access controls through row-level security policies in our database. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your personal data (subject to legal retention requirements)
• Export your data in a portable format
• Withdraw consent for data processing where consent is the legal basis

To exercise any of these rights, please contact us at support@thepylongroup.com. We will respond to your request within 30 days.

8. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA). You have the right to:

• Know what personal information we collect, use, and disclose
• Request deletion of your personal information
• Opt out of the sale of your personal information (we do not sell personal information)
• Not be discriminated against for exercising your privacy rights

To submit a CCPA request, email us at support@thepylongroup.com with the subject line “CCPA Request.”

9. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have rights under the General Data Protection Regulation (GDPR). Our legal bases for processing your data include:

• Contract performance — processing necessary to provide the Service you have subscribed to
• Legitimate interests — improving and securing the Service
• Consent — where you have given explicit consent, such as connecting your Google Business Profile

You may exercise your GDPR rights (access, rectification, erasure, restriction, portability, and objection) by contacting us at support@thepylongroup.com.

10. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will take steps to delete that information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at: