Privacy Policy

1. Information we collect

Account information: your name, sign-in email and authentication records.

Business information you provide: company details, services, service areas, staff and marketing preferences collected through our questionnaires — used to build and run your marketing.

End User Data: information your customers and leads submit through your websites, forms, chat widgets and booking tools that we operate for you — such as names, phone numbers, email addresses, messages, appointment details, consent records and message engagement (delivered/opened/clicked/opt-out).

Usage and technical data: log data, device and browser information needed to operate and secure the Service.

2. How we use information

To provide the Service: build and host websites, store contacts, schedule appointments, send the campaigns and automations you launch, and report their results back to you.

To operate the platform: authentication, support, billing (including pass-through usage charges), abuse and deliverability protection, and product improvement. We do not sell personal information.

3. End User Data — our service-provider role

For your customers' data we act as a service provider/processor: we process it only on your instructions embodied in the Service's features, and we do not use your customers' contact information to market to them on our own behalf. End users who want to access or delete their data with a specific business should contact that business directly; we support our clients in fulfilling such requests.

4. Text-messaging data

Phone numbers and SMS consent collected through client websites are used solely to deliver the messages that business sends through the platform. No mobile information is shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are not shared with any third parties, except for the delivery infrastructure necessary to send the messages.

5. Connected calendar data

If you connect your Google Calendar, we access it only to (a) read free/busy time so online booking never offers a time you are unavailable, and (b) create and remove calendar events for appointments booked through the Service. The events we create contain that appointment's details — the customer's name, phone, email and request — so your calendar shows who is coming. We do not read, store or analyze the contents of your other calendar events (availability is read as opaque busy blocks), and calendar data is never used for advertising or any purpose beyond the booking features described here.

If you connect iCloud Calendar, we temporarily process event data from the calendar you select to calculate busy times, including recurring and all-day events. We cache only start and end times; personal event titles, notes and attendees are not stored in our database or sent to AI. New confirmed appointments are written to that selected calendar with the customer details described above. We store your separate Apple app-specific password using authenticated encryption, delete it when you disconnect, and never ask for your main Apple Account password. You can revoke the app-specific password in your Apple Account. Deleting a synced appointment in the connected calendar can cancel the platform booking and notify the customer; moving its time does not reschedule the platform booking.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Connection tokens are stored in managed, encrypted infrastructure and are deleted when you disconnect your calendar in the portal; you can also revoke the Service's access at any time from your Google account's security settings.

6. Sharing and subprocessors

We share information only with the vendors that run the Service, bound to use it solely for us: Supabase (database and authentication), Vercel (application hosting), Stripe (payments), Twilio (text messaging), Resend (email delivery), Anthropic (AI processing), InstaWP (website hosting), Google (calendar sync, website analytics and search data), Apple (optional iCloud Calendar sync), ScreenshotOne (site previews), Ahrefs (SEO data), Sentry (error monitoring) and Inngest (background processing). We may also disclose information when the law requires it or to protect rights, safety and the integrity of the Service.

7. Cookies

The portal uses essential cookies only — session authentication and security. We do not run third-party advertising trackers in the portal.

8. Security and retention

Data is encrypted in transit, access is scoped per business account, and secrets are stored in managed infrastructure. We retain account and business data for the life of the account and delete or anonymize it within 90 days of a deletion request or account closure, except where the law requires longer retention (for example billing records) or where suppression lists must be kept to honor opt-outs.

9. Your choices and rights

You can access and update your business information in the portal, export your contacts, and close your account by contacting us. Depending on your state (for example under the California Consumer Privacy Act), you may have rights to access, correct or delete personal information — write to us and we will respond within the time the law requires.

10. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect children's data; if you believe a child's data reached us, contact us and we will delete it.

11. The SGP mobile app

The SGP app for iPhone and Android shows the same business data as the portal and is open only to people who already have a login — it has no public sign-up. On top of what section 1 describes, the app keeps your sign-in session in the device's secure keychain and, if you allow notifications, registers a push token issued by Apple or Google together with the device platform.

We use that token only to notify you about your own account: a new lead, someone writing in, a booking, a reply from our support team. A notification can carry the message itself; you can turn that off in the app under Settings, and notifications will then name only the kind of event. The app asks for no location, no address book and no advertising identifier, shows no ads, and carries no third-party advertising or analytics SDKs. Signing out or uninstalling deletes the push token, and we drop tokens that Apple or Google report as no longer valid.

12. Deleting your account and your data

The account owner can remove any single login at any time in the portal under Team. To close a whole account and have its data deleted, write to reception@robertgerov.com from the address on file; we confirm within five business days and then delete or anonymize the data on the schedule in section 8. Uninstalling the app does not close an account — it only removes that device's push token.

13. Changes

We will post any changes here and update the date above; material changes will be announced in the portal or by email.

14. Contact

ELR Management Corp d/b/a Scale Growth Partners, 1 Garvies Point Rd, Glen Cove, NY 11542, United States. Email: reception@robertgerov.com.