Privacy Policy

This Privacy Policy explains how Accent Infotech Limited, a company incorporated in New Zealand with registered office at 3/84A Wallace Road, Papatoetoe, Auckland, New Zealand ("AllSale", "we") collects, uses, shares, and protects personal data when you visit our websites, create an account, or use the AllSale GEO AI platform (collectively, the "Service").

1. Who We Are & Roles

For the purposes of GDPR/UK GDPR, AllSale acts as a data controller for personal data about its account holders, billing contacts, website visitors, and prospects, and as a data processor for personal data that account holders (customers and resellers) submit into the Service about their own end users or business contacts ("Customer Data").

For CCPA/CPRA purposes, AllSale qualifies as a "service provider" with respect to Customer Data and processes such data on behalf of our customers under documented contract terms (see the Data Processing Addendum).

2. Personal Data We Collect

2.1 Information you provide

• Account data: name, email, phone, business name, password (hashed), photo, marketing preferences.
• Billing data: billing address, tax ID, last 4 digits of payment card, payment method tokens. Full card details are collected and stored by our payment processor, Stripe, never by us.
• Business profile content: Google Business Profile data, photos, posts, hours, services, reviews, prompts you submit to AI features.
• Communications: messages you send to support and feedback you provide.

2.2 Information collected automatically

• Device & usage: IP address, browser type, OS, language, referrer URL, pages visited, feature usage, error logs, timestamps.
• Cookies & similar technologies: see the Cookie Policy for a full list and your controls.

2.3 Information from third parties

• OAuth providers (Google, Meta, TikTok, Microsoft, Stripe Connect): profile, business-listing, and aggregated performance data, scoped to permissions you grant.
• Payment processor (Stripe): subscription status, payout, and high-level fraud signals.

3. How & Why We Use Data

Purpose	Example Activities
Provide the Service	create account, deliver features, sync data with connected platforms
Billing	process subscription charges via Stripe, send invoices, handle refunds
Communications	service emails, product updates, security alerts, support replies
Marketing	promotional emails (opt-out at any time), tailored content (with consent where required)
Safety & security	fraud detection, abuse prevention, audit logging, access controls
Analytics & improvement	aggregated usage analytics, A/B testing, performance monitoring
Legal & compliance	tax reporting, accounting records, responding to lawful requests

4. Lawful Bases (GDPR)

Where GDPR or UK GDPR applies, we rely on one or more of the following lawful bases:

• Contract (Art. 6(1)(b)) — to perform the agreement with you, including delivery of the Service and billing.
• Legitimate interests (Art. 6(1)(f)) — for product improvement, security, fraud prevention, and direct marketing to existing customers, balanced against your interests.
• Consent (Art. 6(1)(a)) — for non-essential cookies, certain marketing communications to prospects, and any special-category data processing. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — for tax, accounting, anti-money-laundering, and similar obligations.

5. Sharing & Sub-Processors

We share personal data only as needed to run the Service and as described below. We do not sell personal data within the meaning of CCPA/CPRA.

Recipient	Purpose	Location
Google Cloud (Firebase, Firestore, Cloud Run)	application hosting, identity, database	United States & global
Stripe, Inc.	payments, payouts, Stripe Connect	United States, EU
OpenAI / Google Gemini	AI text generation	United States
Email delivery providers	transactional & marketing email	United States, EU
Analytics & error monitoring	aggregated product analytics, crash reports	United States, EU
Connected platforms (Google, Meta, TikTok, etc.)	only data you explicitly authorise to be shared	per platform
Resellers	resellers see only the customer accounts they create; AllSale does not transfer your data to other resellers	per reseller
Legal / regulators	where required by law or to protect rights, property, or safety	as applicable
Successors	in the event of merger, acquisition, or asset sale, subject to confidentiality	as applicable

A current list of sub-processors is maintained at dpa.html#subprocessors.

6. International Transfers

AllSale is established in New Zealand. We process personal data on infrastructure located in the United States and other countries. Where required (for transfers out of the EEA, UK, or Switzerland), we rely on the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, supplemented by additional safeguards (encryption in transit and at rest, access controls).

7. Retention

We retain personal data for as long as needed to provide the Service, comply with legal and tax obligations, resolve disputes, and enforce our agreements. Specifically:

• Account data: retained while your account is active, then for up to 24 months after closure unless a longer period is required by law.
• Billing & tax records: at least 7 years (or longer where required).
• Backups: encrypted backups may persist for up to 90 days after deletion from primary storage.
• Audit logs: at least 12 months.

8. Your Rights (GDPR)

If you are in the EEA, UK, or Switzerland, you have the right to:

• access your personal data (Art. 15);
• request rectification of inaccurate or incomplete data (Art. 16);
• request erasure (Art. 17, "right to be forgotten");
• restrict processing (Art. 18);
• receive your data in a portable format (Art. 20);
• object to processing based on legitimate interests, including direct marketing (Art. 21); and
• withdraw consent at any time for processing based on consent.

To exercise any right, email privacy@allsalegeo.com. We respond within thirty (30) days. You can also lodge a complaint with your local supervisory authority — in the EU, the list is at edpb.europa.eu; in the UK, the ICO at ico.org.uk.

9. Your Rights (CCPA / CPRA)

If you are a California resident, you have the right to:

• know what personal information we collect, use, disclose, and sell or share;
• request deletion of your personal information;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioural advertising);
• limit use of sensitive personal information;
• not be discriminated against for exercising your rights.

Categories of personal information we have collected in the past 12 months: identifiers (name, email, IP); commercial information (subscriptions, transactions); internet/network activity (usage logs, cookies); geolocation (city-level, derived from IP); professional information (business name, role); and inferences drawn from the above.

To submit a request: email privacy@allsalegeo.com with the subject "CCPA Request" and identify the type of request. We will verify your identity before fulfilling. You may also use an authorised agent.

10. Children

The Service is not directed to children under sixteen (16) and we do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, contact privacy@allsalegeo.com for prompt deletion.

11. Security

We implement administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit (TLS 1.2+), encryption at rest, role-based access controls, audit logging, principle-of-least-privilege access, multi-factor authentication for administrative access, vulnerability monitoring, and regular backups. No system is perfectly secure; we promptly notify affected users and regulators in the event of a personal-data breach as required by applicable law.

12. Cookies

We use cookies and similar technologies for essential functions (authentication, security), preferences, and aggregate analytics. Where required by law (EEA/UK), we obtain consent for non-essential cookies via our cookie banner. See the Cookie Policy for the full list and your controls.

13. Automated Decision-Making & AI

The Service generates AI suggestions (e.g., draft review responses, content ideas, scheduling recommendations). These are suggestions only — they do not produce legal or similarly significant effects without your review and approval. We do not use personal data for automated profiling or decisions of legal effect within the meaning of GDPR Art. 22.

14. Changes to this Policy

We may update this Policy from time to time. Material changes are announced via email or in-app notice at least 30 days before they take effect. Continued use of the Service after the effective date constitutes acceptance.

15. Contact & Complaints