Privacy Policy

PatronPen is used by a business (you) to invite your customers to a private interview about their experience. Two different privacy roles exist here, and they’re genuinely different, not just a formality:

• For your own account data (name, email, business details, billing) — PatronPen is the controller. We decide why and how that data is used, same as any SaaS tool you sign up for.
• For your customers’ interview answers, testimonials and feedback — PatronPen processes that data on your behalf, as your service provider. You decide which customers get invited and why. We design how the Service handles that data (for example, which AI model is used and how long interview answers are kept), and you choose to use the Service on those terms.

About you (the business owner): name, email, business name and details, the website of your business if you choose to give one, and basic usage data (sign-ins, actions you take in the dashboard). When you buy conversations, Stripe takes your card details. We don’t store your card number ourselves. We keep Stripe’s references for you and your card, the card’s brand and its last four digits, and a record of each purchase: the date, the amount, the number of conversations added, and Stripe’s payment reference.

Your agreement to automatic top-ups. When you agree to automatic top-ups (and each time you agree again, raise your spending limit, or agree to changed terms), we record the date and time (in UTC), the exact words we showed you (and their version), that you ticked the agreement box, the price and number of conversations of the automatic top-up, the balance trigger, your spending limit, one charge at a time, the 15-minute minimum gap after a successful automatic charge, the brand and last four digits of your card, Stripe’s session reference, whether the first-purchase offer applied, and your owner login. We also keep the spending-limit setting and a record of each automatic charge (date, amount, quantity, and whether it was counted against your limit) so we can apply the limit.

A record of who has already received the free conversations. See section 3 (“Every account: the free-conversations record”).

Documents you send us in a business-ownership review. Only if someone reports that a business was claimed wrongly and we ask you for proof. You may send redacted documents by email to support@patronpen.com. See section 3.

About your customers, during an interview: their spoken/typed answers, the AI-generated draft, and technical metadata (IP address, for rate-limiting and abuse prevention). We do not ask for a customer’s name or any account information — interviews require no account. Afterwards, a customer may choose to give an email address with a testimonial, or, only where the business has allowed it, an email address or phone number with private feedback (see 6B).

What you (the owner) can see about your customers: from interviews, counts only. How many interviews were started, completed, or resulted in a confirmed review. You never see transcript text, draft text, or anything a customer typed in an interview — this is enforced at the database level, not just hidden in the interface. Testimonials and private feedback that customers choose to send you are described in 6A and 6B, and AI assistants you connect in 6C.

Interview answers and drafts are automatically and permanently deleted approximately 10 minutes after a customer stops actively participating. A customer can also delete their own answers immediately, from the last screen of the interview. You (the owner) can delete all interview activity for your business from your dashboard at any time. None of these deletions require contacting support.

What survives deletion: a bare count that an interview happened — never the words. This lets PatronPen show you accurate usage numbers without retaining anything a customer said.

Account data is kept for as long as your account is active, and for 30 days after closure for legal, accounting, and fraud-prevention purposes, after which it is deleted except for billing records we’re required to retain longer by law.

If you never paid us. When you close your account we keep one short closing record, for legal, accounting and fraud-prevention purposes. It holds your business name, your email address, your Stripe customer ID if you had one, the date you signed up and the date you closed the account, and counts of any paid items. Thirty days after you close your account, we clear your business name, your email address and your Stripe customer ID from that record. We keep only the dates, the counts and which kind of account it was. We also delete the free conversations you were given and the counts of how you used them, along with the rest of your account.

If you did pay us. If you bought conversations or made a payment through Stripe, we keep the billing records that go with it, including the closing record with your business name and email address, for as long as the law requires us to keep billing records. That includes your purchases (dates, amounts, conversations added and Stripe’s payment references), the conversations you were given and bought and how they were used (counts, never words), and your agreement records (next paragraph). Only we can read them.

Your agreement to automatic top-ups, after you close your account. We keep the record of each agreement as evidence that you agreed, until three years after the later of the last charge you authorized under it or the end of that authorization. A purchase you make by hand later does not restart that period. When you close your account we remove your owner login and your card’s brand and last four digits from it. What stays is the dates and times, the amounts and numbers of conversations, the balance trigger, your spending limit, one charge at a time, the 15-minute minimum gap after a successful automatic charge, the version of the words we showed you, that you ticked the box, and Stripe’s session reference.

Your card. Stripe handles your card. PatronPen never sees or stores your full card number. For automatic top-ups, Stripe saves your card for later charges. We keep Stripe’s reference to it, plus its brand and last four digits, so we can show you which card is saved. When you switch automatic top-ups off, or they switch themselves off (for example because a charge failed, a payment was disputed, or a refund was treated as unauthorized), we clear our reference and ask Stripe to remove the card. If automatic top-ups pause because 12 months passed with no automatic top-up, your card stays saved so you can start again, but we make no charge until you agree again. When you close your account, we ask Stripe to remove the saved card too. What Stripe keeps about your payments is covered by Stripe’s own privacy policy.

Every account: the free-conversations record. Each business gets its 25 free conversations once. To enforce that, including after you close your account or delete your business, we keep a record of who has already received them. This record does not hold your email address or your website address. It holds a one-way “fingerprint”: a scrambled code made with a secret key that only PatronPen holds, so that nobody outside PatronPen can work it out or test a guess against it. It is made from two things:

• the verified email address that created the account (after ignoring capital letters, “+” tags and, for Gmail, dots); and
• if you gave one, the domain name of your business website. Addresses on someone else’s service, such as social-media pages and review-site listings, are ignored.

Next to each fingerprint we keep what kind it is, how the free conversations were given (at sign-up, in an earlier setup, or by a decision of ours), the date, and, if we later cancel a claim, the date and the reason.

A fingerprint can’t be turned back into your email or website address. Because we make it with a secret key, someone who got a copy of the fingerprints could not check a guess against them without that key. We still treat the fingerprints as personal information, and only PatronPen’s operators can read them.

When you delete your account, we remove the link between each fingerprint and your account, and we note the date we did so. We keep the fingerprint itself, because deleting it would let the same email or website claim the free conversations a second time. We use it for nothing else, except to review a report that someone else claimed a business (see “If someone reports that a business was claimed wrongly” below). We keep the fingerprints for as long as PatronPen offers the free conversations, because a shorter period would let a closed account’s email or website claim them again. If we withdraw the free conversations, we delete the fingerprints.

Operational records of grants and changes. We keep separate operational audit records for each grant, void and operator grant of free conversations. These records document the action and its business association for operation and review. When an account is deleted, the business link on an operator audit row is set to null; this severs that business foreign-key link but does not make the retained row anonymous or promise that it cannot be linked using other retained records. The audit records are distinct from business-ownership case evidence and paid billing records. We keep each record for three years, then delete it.

If someone reports that a business was claimed wrongly. If a business tells us that someone else set up its account, or a business tells us we refused its free conversations because of someone else’s account, we may ask the people involved for proof of who is connected to the business. We look at each report one case at a time, and a public web address or review listing does not by itself prove anything. We ask only for what we need. During a dispute, we ask for two independent, reasonable pieces of proof that you control the business (we never ask for this at sign-up). For example, we might ask you to confirm a message sent to an address at the business’s own website, to put a short code on the business’s own website, or to send a document that shows the business’s name and address. You can cover (redact) anything else on a document. We never ask for card numbers, bank login details, tax ID numbers, or passwords for review sites or any other account. You can email redacted documents to support@patronpen.com. Only the person who reviews the case can see them, we use them only to decide the case and any appeal, and we delete them, including the emailed copies, 30 days after the case is closed, or sooner if you ask us once the case is closed. We keep a short record of the case (who reported it, which businesses, what kinds of proof we saw, the outcome and the reason, but not copies of the documents) for three years after the case is closed. Either side can appeal within 14 days after we tell them the decision. We tell the person who reported it and the account holder what we decided. We don’t give either of them the other’s documents or account details.

Internal alerts. To catch mistakes and abuse early, our systems write internal alerts that only PatronPen’s operator sees, and we email the operator a daily summary of the ones still open. An alert can be about a sign-up refused because the website matched, a second payment for the first-purchase offer, a refund we couldn’t match to a reason, or a business with four or more automatic top-ups in 24 hours. An alert names the business and the event. It contains no customer answers. The operator closes an alert with a reason, and we keep the closed alert for one year after it is closed, then delete it.

PatronPen uses IP addresses to apply rate limits and prevent abuse of the interview and AI systems. An IP address can itself be considered personal information under some privacy laws; we use it only for this security purpose, not to identify or track individuals across sessions, and it is not linked to any interview text.

PatronPen uses the following third-party service providers to operate the product. None of them are permitted to use your or your customers’ data for their own purposes, such as training their own general-purpose models on it, beyond what’s needed to provide their service to us. AI assistants you connect yourself are not subprocessors; see 6C.

Interview answers are sent to our AI provider solely to generate the next interview question and, later, the draft review. We do not use customer interview data to train any AI model, ours or a third party’s. This section is about PatronPen's own AI provider. AI assistants you connect are covered in 6C.

Separately from the review interview described above, a customer may choose to share a written testimonial directly with your business, and may choose to add one photo to it. This is always the customer’s own choice, made on a screen that tells them exactly what happens to their words and their photo before they submit — the photo has its own, separate opt-in. PatronPen never infers a testimonial or a photo from interview or review activity.

What we collect: the testimonial text, the customer’s chosen attribution (first name, initials, or anonymous), and their email address, and, if they add one, their photo. The email address is used for one purpose only — to send the customer a private link that lets them view or delete their testimonial later — and is never shown to you. A photo is re-encoded on our servers before it is stored, which removes location, device, and other metadata; only the picture itself is kept.

What you can see and do: the text, the attribution, the date received, the status, and the photo. You never see the customer’s email address; this is enforced at the database level. A submitted testimonial is private to your dashboard, and to any AI assistant you connect (6C), until you choose to publish it on your public testimonial page or embed it on your own website. You can publish, unpublish, or delete a testimonial at any time; you cannot edit a customer’s words or their photo. We email you a short notice when a new testimonial arrives; the notice does not contain the testimonial.

Retention and deletion: a testimonial and its photo are kept until the customer deletes them through their private link, you delete them from your dashboard, or your account is closed. Deletion removes the text, the attribution, and the email address, and the photo file, and takes effect on the public page and every embed on the next load. There is no recovery window. Audit records keep only identifiers and timestamps, never the text, the photo, or the email address.

Your responsibility for what you publish: when you publish a customer’s testimonial or photo, you are the one choosing to display it. You are responsible for that display — for looking at it before you publish it, for taking it down promptly when a customer asks, and for complying with any law that applies to your business’s use of a customer’s words or likeness. PatronPen hosts the page and gives every customer a way to remove their own testimonial and photo at any time; it does not review or approve testimonials or photos before you publish them.

On the same screen as a testimonial, a customer may instead choose to send your business private feedback — something you could do better. This is always the customer’s own choice between praise and critique; PatronPen never decides which it is from their words.

What we collect: the feedback text, your business, and the date it was sent. We do not ask for the customer’s name, and we store nothing that links the feedback to their interview. If you have switched on reply contact (it is off unless you turn it on), the customer may also choose to leave an email address and/or phone number so you can reply. Leaving it is optional; if they leave it blank, the feedback is anonymous.

What you can see and do: the text and the date (not the time of day), in your dashboard or through an AI assistant you connect (6C), plus any email address or phone number the customer chose to leave. You may use that contact only to reply to that feedback, not for marketing or any other purpose. Feedback can never be published, embedded or edited, and it leaves PatronPen only when an AI assistant you connect asks for it (6C). We email you a short notice when new feedback arrives; the notice does not contain the feedback or any contact details. It only says whether the customer left a way to reach them.

Retention and deletion: feedback is kept until you delete it from your dashboard or your account is closed. Any email address or phone number left with it is erased automatically 30 days after the feedback was sent, even if you keep the feedback. The customer has no link to delete feedback themselves, even if they left contact details — they are told this before they send it. Deletion is immediate and has no recovery window. Audit records keep only identifiers and timestamps, never the text or contact details.

You can connect an AI assistant, such as ChatGPT, Claude, Gemini or Meta Muse, to your PatronPen account. When you do, PatronPen sends that assistant’s company the information your assistant asks for, within the permissions you chose: your business and account details, counts, dates and settings, and, if you allow “Read what customers wrote”, the text, date and attribution of testimonials and the text and date of private feedback. We never send your customers’ email addresses or phone numbers, customer photos, interview answers or drafts, or your payment details.

That company is not our subprocessor. It receives the information because you told us to send it, and it handles it under its own terms and your settings with it, which may include keeping it, having people review it, and using it to improve its AI. Deleting something in PatronPen does not delete a copy your assistant has already received.

Sign-in for connected assistants is handled by our authentication provider (section 5). We keep a record of each request an assistant makes (which action, when, whether it worked, and the IDs of the items involved, never customer words) for 90 days, and a record of each approval you gave or declined for one year. A record of each connection (which AI app, and when it was connected, last used and disconnected) is kept for one year after it ends.

You can see connected assistants, change what they may do, or disconnect them at any time under AI assistants in your dashboard. A disconnected assistant is refused on its next request. An assistant that is not used for 90 days stops working until you connect it again.

You can request access to, correction of, or deletion of your own account data at any time by contacting us. Your customers can delete their own interview data immediately, without contacting anyone, from the interview itself.

Deleting your account removes your data as described in section 3. Some records remain for the purposes and periods described there: grant eligibility fingerprints; agreement records; paid purchases, wallet usage and billing closing records (including any refund we paid you on closing your account); operational alerts and business-ownership case records (the minimal case record for three years; documents 30 days after closure); and, only if a refund to your card failed when you closed your account or when we shut the Service down, a pending-refund record (your email address, the amount we owe you and the refund details), kept until we pay you. Account links are removed where described, but a paid closing record may permit an operator to link a fingerprint back to an email. The fingerprints and retained records may therefore remain linkable to you. We also ask Stripe to remove your saved card. Evidence documents and case records have separate deletion and retention rules described in section 3. Once a case is closed, you can ask us at support@patronpen.com to delete your evidence documents sooner than 30 days, and we will. If we shut the Service down, we delete your information after the shutdown date, keeping only the records we need for billing, any refund we still owe you, and any open dispute, and you can email support@patronpen.com to have it deleted sooner.

PatronPen is operated from, and intended for use within, the United States and Canada. We do not currently design the product for, or knowingly direct it toward, users in the European Union or United Kingdom.

PatronPen is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. The interview requires no account and asks only about a customer’s experience with a business — it is not designed for, marketed to, or intended to be used by children. If we become aware that we have collected information from a child under 13 without the consent required by law, we will delete it.

We may update this policy from time to time. Material changes will be communicated by email to the account holder and by a notice inside the app before they take effect, matching the Terms of Service.

PatronPen is operated by Avigdor Azamir, doing business as “PatronPen,” 325 Venice Way, Venice, CA 90291.

Questions about this policy: support@patronpen.com.

Your answers are used to help write a draft review, with AI assistance. You can edit the draft, and nothing is posted until you personally decide to copy and post it yourself. Your answers and the draft are automatically deleted about 10 minutes after you stop answering — you can also delete them immediately from the last screen. The business can see only that an interview happened, never what you typed. Your interview answers and draft are never available to the business or to any AI assistant it connects. Your answers are shared with our AI provider only to help write your draft, and with our database provider to store them temporarily.

If you’re reviewing a medical or wellness practice: feel free to name your procedure and share how it went — we’d just ask you to leave out specific diagnoses, medications, or treatment details.

If you choose to share a testimonial: that is a separate, optional choice, made on its own screen. Your words are sent to the business exactly as you wrote them, and the business cannot edit them. Adding a photo is a further, separate choice with its own checkbox — no photo is ever taken from your testimonial without it, and we remove location and device details from any photo before storing it. We email you a private link that lets you see and delete your testimonial and photo at any time, instantly, without asking anyone. The business never sees your email address. The business may also read your testimonial through an AI assistant it has connected to its PatronPen account; the company that runs that assistant receives your words and keeps its own copy under its own terms. Your private link removes it from PatronPen, the business’s page and every embed, but not a copy an AI assistant has already read.

If you choose to send private feedback instead: only the business reads it, and it is never shown publicly. The business may read it in PatronPen or through an AI assistant it has connected to its PatronPen account, such as ChatGPT, Gemini, Meta Muse or Claude. If it does, the company that runs that assistant receives your words and the date, keeps its own copy under its own terms, and, depending on the business’s settings, may use it to improve its AI. Deleting the feedback in PatronPen does not delete that copy. An email address or phone number you leave is never given to an AI assistant. We don’t ask for your name. Some businesses let you leave an email address or phone number so they can reply. That is optional, only that business sees it, it may be used only to reply to you, and it is erased 30 days after you send it. Leave it blank and your feedback is anonymous: we keep only your words and the date. The business may still be able to tell it was you from what you wrote or when you sent it. There is no private link to delete feedback after sending it, so you cannot delete it yourself; the business can.