Privacy Policy

PatronPen is used by a business (you) to invite your customers to a private interview about their experience. Two different privacy roles exist here, and they’re genuinely different, not just a formality:

• For your own account data (name, email, business details, billing) — PatronPen is the controller. We decide why and how that data is used, same as any SaaS tool you sign up for.
• For your customers’ interview answers — the roles are mixed. You decide which customers get invited and why you’re soliciting the review. PatronPen independently decides the technical handling: how the interview is designed, which AI model is used, how long anything is kept, and how it’s deleted.

About you (the business owner): name, email, business name and details, billing information (handled by Stripe — we don’t store card numbers ourselves), and basic usage data (sign-ins, actions you take in the dashboard).

About your customers, during an interview: their spoken/typed answers, the AI-generated draft, and technical metadata (IP address, for rate-limiting and abuse prevention). We do not collect a customer’s name, email, or any account information — interviews require no account.

What you (the owner) can see about your customers: counts only. How many interviews were started, completed, or resulted in a confirmed review. You never see transcript text, draft text, or anything a customer typed — this is enforced at the database level, not just hidden in the interface.

Interview answers and drafts are automatically and permanently deleted approximately 10 minutes after a customer stops actively participating. A customer can also delete their own answers immediately, from the last screen of the interview. You (the owner) can delete all interview activity for your business from your dashboard at any time. None of these deletions require contacting support.

What survives deletion: a bare count that an interview happened — never the words. This lets PatronPen show you accurate usage numbers without retaining anything a customer said.

Account data is kept for as long as your account is active, and for 30 days after closure for legal, accounting, and fraud-prevention purposes, after which it is deleted except for billing records we’re required to retain longer by law.

PatronPen uses IP addresses to apply rate limits and prevent abuse of the interview and AI systems. An IP address can itself be considered personal information under some privacy laws; we use it only for this security purpose, not to identify or track individuals across sessions, and it is not linked to any interview text.

PatronPen uses the following third-party service providers to operate the product. None of them are permitted to use your or your customers’ data for their own purposes, such as training their own general-purpose models on it, beyond what’s needed to provide their service to us.

Interview answers are sent to our AI provider solely to generate the next interview question and, later, the draft review. We do not use customer interview data to train any AI model, ours or a third party’s.

Separately from the review interview described above, a customer may choose to share a written testimonial directly with your business, and may choose to add one photo to it. This is always the customer’s own choice, made on a screen that tells them exactly what happens to their words and their photo before they submit — the photo has its own, separate opt-in. Sage Review never infers a testimonial or a photo from interview or review activity.

What we collect: the testimonial text, the customer’s chosen attribution (first name, initials, or anonymous), and their email address, and, if they add one, their photo. The email address is used for one purpose only — to send the customer a private link that lets them view or delete their testimonial later — and is never shown to you. A photo is re-encoded on our servers before it is stored, which removes location, device, and other metadata; only the picture itself is kept.

What you can see and do: the text, the attribution, the date received, the status, and the photo. You never see the customer’s email address; this is enforced at the database level. A submitted testimonial is private to your dashboard until you choose to publish it on your public testimonial page or embed it on your own website. You can publish, unpublish, or delete a testimonial at any time; you cannot edit a customer’s words or their photo.

Retention and deletion: a testimonial and its photo are kept until the customer deletes them through their private link, you delete them from your dashboard, or your account is closed. Deletion removes the text, the attribution, and the email address, and the photo file, and takes effect on the public page and every embed on the next load. There is no recovery window. Audit records keep only identifiers and timestamps, never the text, the photo, or the email address.

Your responsibility for what you publish: when you publish a customer’s testimonial or photo, you are the one choosing to display it. You are responsible for that display — for looking at it before you publish it, for taking it down promptly when a customer asks, and for complying with any law that applies to your business’s use of a customer’s words or likeness. PatronPen hosts the page and gives every customer a way to remove their own testimonial and photo at any time; it does not review or approve testimonials or photos before you publish them.

On the same screen as a testimonial, a customer may instead choose to send your business private feedback — something you could do better. This is always the customer’s own choice between praise and critique; Sage Review never decides which it is from their words.

What we collect: the feedback text, your business, and the date it was sent. Nothing else. We do not ask for the customer’s name or email address, and we store nothing that links the feedback to their interview.

What you can see and do: the text and the date (not the time of day), in your dashboard only. Feedback can never be published, embedded, exported, or edited. We email you a short notice when new feedback arrives; the notice does not contain the feedback itself.

Retention and deletion: feedback is kept until you delete it from your dashboard or your account is closed. Because the customer gives no email address, they have no link to delete it themselves — they are told this before they send it. Deletion is immediate and has no recovery window. Audit records keep only identifiers and timestamps, never the text.

You can request access to, correction of, or deletion of your own account data at any time by contacting us. Your customers can delete their own interview data immediately, without contacting anyone, from the interview itself.

PatronPen is operated from, and intended for use within, the United States and Canada. We do not currently design the product for, or knowingly direct it toward, users in the European Union or United Kingdom.

PatronPen is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. The interview requires no account and asks only about a customer’s experience with a business — it is not designed for, marketed to, or intended to be used by children. If we become aware that we have collected information from a child under 13 without the consent required by law, we will delete it.

We may update this policy from time to time. Material changes will be communicated by email to the account holder and by a notice inside the app before they take effect, matching the Terms of Service.

Questions about this policy: no-reply@patronpen.com.

Your answers are used to help write a draft review, with AI assistance. You can edit the draft, and nothing is posted until you personally decide to copy and post it yourself. Your answers and the draft are automatically deleted about 10 minutes after you stop answering — you can also delete them immediately from the last screen. The business can see only that an interview happened, never what you typed. Your answers are shared with our AI provider only to help write your draft, and with our database provider to store them temporarily.

If you’re reviewing a medical or wellness practice: feel free to name your procedure and share how it went — we’d just ask you to leave out specific diagnoses, medications, or treatment details.

If you choose to share a testimonial: that is a separate, optional choice, made on its own screen. Your words are sent to the business exactly as you wrote them, and the business cannot edit them. Adding a photo is a further, separate choice with its own checkbox — no photo is ever taken from your testimonial without it, and we remove location and device details from any photo before storing it. We email you a private link that lets you see and delete your testimonial and photo at any time, instantly, without asking anyone. The business never sees your email address.

If you choose to send private feedback instead: only the business reads it, and it is never shown publicly. We don’t ask for your name or email, and we keep only your words and the date. The business may still be able to tell it was you from what you wrote or when you sent it. Without an email there is no private link, so you cannot delete feedback after sending it; the business can.