Privacy Policy

Petunia, Inc. is the data controller responsible for your personal information. This means we determine the purposes and means of processing your personal data.

2.1 Information You Provide Directly

• Account Information: Name, email address, phone number, password (encrypted), and business details when you create an account.
• Profile Information: Business name, industry, preferences, and settings you configure.
• Lead & Contact Data: Names, phone numbers, email addresses, and communication history of your business contacts.
• Communications: Messages, conversations, and call transcriptions processed through our platform.
• Payment Information: Billing details processed securely through Stripe (we do not store full card numbers).
• Support Requests: Information you provide when contacting our support team.

2.2 Information Collected Automatically

• Usage Data: Features used, pages visited, actions taken, and performance metrics.
• Device Information: Browser type, operating system, device identifiers, and IP address.
• Log Data: Access times, error logs, and referral URLs.
• Cookies & Similar Technologies: See our Cookie Policy for details.

2.3 Information from Third Parties

• Integration Data: Information from services you connect (Yelp, Google Business, Facebook, etc.) with your explicit consent.
• Review Platforms: Business reviews and ratings synced from connected review platforms.
• Communication Providers: Call logs and voice data from Twilio, RingCentral, or other connected services.

2.4 Voice & AI Data

• Voice Recordings: Call recordings when enabled, processed for transcription and analysis.
• AI Training Data: Anonymized interaction patterns used to improve our AI models (with your consent).
• Transcriptions: Automated transcriptions of voice calls for searchability and analysis.

Under GDPR, we process your personal data based on the following legal bases:

• Provide Services: Operate and maintain the Petunia platform, process communications, and deliver features.
• Improve Services: Analyze usage patterns, develop new features, and enhance user experience.
• Communications: Send service updates, security alerts, and (with consent) marketing messages.
• AI & Automation: Power intelligent features like auto-responses, lead scoring, and conversation insights.
• Security: Detect and prevent fraud, abuse, and security threats.
• Legal Compliance: Meet regulatory requirements and respond to legal requests.
• Customer Support: Respond to inquiries and resolve issues.

We retain your data only as long as necessary for the purposes outlined in this policy. Our retention periods are:

Data retention is enforced automatically through daily scheduled jobs. You can request immediate deletion at any time, subject to a 30-day grace period to prevent accidental data loss.

Depending on your location, you have the following rights regarding your personal data:

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

7.1 Supervisory Authority

You have the right to lodge a complaint with a supervisory authority in your country of residence. For a list of supervisory authorities, visit the European Data Protection Board.

7.2 International Data Transfers

When we transfer personal data outside the EEA, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs): EU-approved contractual terms with data processors.
• Adequacy Decisions: Transfers to countries the EU Commission has deemed adequate.
• Data Processing Agreements: Binding agreements with all third-party processors.

7.3 Automated Decision-Making

We use automated systems to power features like lead scoring and intelligent responses. You have the right to:

• Request human review of automated decisions that significantly affect you.
• Express your point of view and contest automated decisions.
• Opt out of automated decision-making where legally required.

When you book an appointment on a Petunia-powered public booking page and optionally check the SMS consent box, you agree to receive appointment confirmations and service-related text messages from that business. Message frequency varies. Message and data rates may apply.

You can opt out at any time by replying STOP. For help, reply HELP.

Mobile phone numbers collected for SMS and your opt-in consent data will not be shared or sold to third parties or affiliates for marketing or promotional purposes. Your mobile information is used solely to deliver the service messages you requested from the business you booked with, and SMS consent is not a condition of purchase.

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights:

8.1 Right to Know

You can request information about:

• Categories of personal information collected in the past 12 months.
• Sources from which we collected the information.
• Business purposes for collecting or selling the information.
• Categories of third parties with whom we share the information.
• Specific pieces of personal information we collected about you.

8.2 Right to Delete

You can request deletion of your personal information, subject to certain exceptions (legal obligations, security, completing transactions).

8.3 Right to Correct

You can request correction of inaccurate personal information we maintain about you.

8.4 Right to Opt-Out of Sale/Sharing

8.5 Right to Limit Use of Sensitive Personal Information

If we collect sensitive personal information (SSN, precise geolocation, etc.), you can limit its use to what is necessary for providing services.

8.6 Right to Non-Discrimination

We will not discriminate against you for exercising your privacy rights. You will receive the same service quality and pricing regardless of your privacy choices.

8.7 Authorized Agents

You may designate an authorized agent to submit requests on your behalf. We will require verification of the agent's authority.

8.8 Categories of Personal Information

Under CCPA, we collect the following categories:

• Identifiers: Name, email, phone number, IP address, account ID.
• Commercial Information: Subscription history, payment records.
• Internet Activity: Browsing history, feature usage, interactions.
• Geolocation Data: General location derived from IP address.
• Professional Information: Business name, industry, role.
• Audio/Visual: Call recordings (when enabled with consent).
• Inferences: Profiles reflecting preferences and behavior.

9. Other US State Privacy Laws

We also comply with privacy laws in other US states:

9.1 Virginia (VCDPA)

Virginia residents have rights to access, correct, delete, and obtain a copy of their data, as well as opt out of targeted advertising and profiling.

9.2 Colorado (CPA)

Colorado residents have similar rights including access, correction, deletion, portability, and opt-out of targeted advertising.

9.3 Connecticut, Utah, and Other States

As new state privacy laws take effect, we ensure compliance with applicable requirements. Contact us for state-specific information.

10.1 Brazil (LGPD)

Brazilian users have rights under the Lei Geral de Proteção de Dados including access, correction, anonymization, and deletion.

10.2 Canada (PIPEDA)

Canadian users have rights under the Personal Information Protection and Electronic Documents Act including access and correction of personal information.

10.3 Australia (Privacy Act)

Australian users have rights under the Privacy Act 1988 and Australian Privacy Principles.

11. Consent Management

We provide granular control over how your data is processed. You can manage the following consent preferences:

Manage your consent preferences in your account settings or contact us to update your preferences.

We provide multiple ways to exercise your privacy rights:

We will respond to verified requests within 30 days (or sooner as required by law). For complex requests, we may extend this by an additional 60 days with notice.

We implement industry-leading security measures to protect your data:

• Encryption: All data encrypted in transit (TLS 1.3) and at rest (AES-256).
• Access Controls: Role-based access with multi-factor authentication.
• Infrastructure: Hosted on SOC 2 Type II certified cloud infrastructure (AWS, Vercel).
• Monitoring: Continuous security monitoring and incident response.
• Auditing: Regular security assessments and vulnerability testing.
• Employee Training: All staff trained on data protection practices.

14. Third-Party Services

We work with trusted third-party providers to deliver our services. All providers are bound by data processing agreements:

15. Children's Privacy

Petunia is designed for business use and is not intended for children under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately at privacy@gardenpatch.xyz.

16. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by:

• Posting the new policy on this page with an updated date.
• Sending an email notification for significant changes.
• Displaying an in-app notification.

We encourage you to review this policy periodically. Continued use of our services after changes constitutes acceptance of the updated policy.

17. Contact Us

If you have questions, concerns, or requests regarding this privacy policy or our data practices, please contact us:

• Privacy Team: privacy@gardenpatch.xyz
• Data Protection Officer: dpo@gardenpatch.xyz
• General Inquiries: hello@gardenpatch.xyz
• Support: Visit our Support page

We aim to respond to all privacy-related inquiries within 5 business days.