Privacy Policy

Effective date: October 31, 2026

Last updated: October 31, 2026

This Privacy Policy explains how Zivalo LLC, doing business as Frontage ("Frontage," "we," "us," or "our") collects, uses, discloses, and protects information when you visit https://www.meetfrontage.com (the "Site") or use the Frontage service, which helps local businesses manage their Google Business Profile reviews and listing, request reviews from their customers, and track how AI assistants describe them (the "Service").

Frontage is a business-to-business service for businesses in the United States. The Service is not intended for personal, family, or household use.

1. Summary of key points

• Google data. If you connect your Google Business Profile, we access it only to provide the features you see in Frontage. We do not sell Google user data, do not use it for advertising, and do not allow humans to read it except in the limited cases described in Section 4.
• Limited Use. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements (Section 4).
• AI. We send review text and related business context to AI providers to draft reply suggestions. A listing edit is not applied until you approve it. A review reply is not posted until you approve it, unless you have turned on a rule that publishes replies to 4- and 5-star reviews (Section 6).
• Messages. If you ask Frontage to send review requests to your customers, you are responsible for having permission to contact them. We process their contact details on your behalf (Section 8).
• No sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioral advertising (Section 14).
• You are in control. You can ask us to stop using Google data and to delete your data (Sections 5 and 12).

2. Our role: controller and service provider

• Frontage as a business. For information about you and your staff (account and billing information), visitors to our Site, and investor inquiries, Frontage decides why and how the information is processed.
• Frontage as a service provider. For the contact details of your customers and for the content of reviews and listing data that you process through Frontage, you (the business customer) are the business and Frontage is your service provider. We process that data only to provide the Service to you, as described in these terms and our Terms of Service. A data processing addendum is available on request by emailing support@meetfrontage.com.

If you are a customer of one of our business customers (for example, you received a review-request text or email), that business is responsible for how your information is used. Contact that business first. You may also email us and we will help route your request.

3. Information we collect

3.1 Information you provide to us

Passwords are stored as bcrypt hashes, not as plaintext.

3.2 Information from Google

When you connect Google and approve the consent screen, we use Google OAuth and the Google Business Profile APIs. The only OAuth scope we request is https://www.googleapis.com/auth/business.manage. We do not request separate OpenID sign-in scopes.

We receive, for locations you authorize:

• OAuth access tokens and refresh tokens that let Frontage act on those locations.
• Listing fields Google returns for those locations, such as name, address, phone, website, and category.
• Reviews and replies: review text, star rating, review date, reviewer display name and profile photo URL as shown by Google, and existing owner replies.

We do not currently request Google listing performance insights. Reviewer names and photos are personal information about people who reviewed your business. We process them only to display reviews to you and to help you respond.

3.3 Information about your customers

Contact details you give us (name, email, mobile number), the message we prepare from your template, and the consent attestation you check before a campaign can be saved. In demo mode, messages are stored and are not sent. When a live email or SMS provider is configured, that provider may return a delivery status. We do not add open or click tracking pixels to review-request messages.

3.4 AI-assistant visibility tracking

To show how AI assistants describe your business, we send test prompts built from your business name, category, and city (for example, "best plumber in Grayslake") to ChatGPT (OpenAI), Perplexity, and Gemini. We store the responses. We do not put review text, reviewer names, or your customers' contact details in these prompts. If an API key is missing, the report uses labeled demo samples instead of calling that provider.

3.5 Investor-interest form

If you complete the investor-interest form we collect your name, email, firm, LinkedIn URL, check size, and any note you add. We use it only to respond to you and keep a record of the inquiry. We do not sell it or use it for advertising. Submitting the form is not an offer or sale of securities.

3.6 Automatically collected information

When you use the Site we receive technical data from our host, including IP address, browser type, pages requested, and timestamps, in Vercel request logs. We use a first-party cookie to keep you signed in. We do not use a separate product-analytics or advertising service, and we do not use advertising cookies or cross-site trackers.

We honor a Global Privacy Control signal as an opt-out of sale or sharing. We do not sell or share personal information.

4. Google user data and the Google API Services User Data Policy

4.1 Limited Use disclosure

Frontage's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4.2 How we use Google user data

We use Google user data only to provide the features you see in Frontage:

1. Displaying your reviews and ratings in the dashboard.
2. Generating draft replies for you to edit.
3. Publishing a reply only after you approve that reply, or after you turn on a rule that publishes replies to 4- and 5-star reviews. Replies to reviews below 4 stars stay drafts unless you separately allow those to publish.
4. Showing listing details, proposing changes, and applying a change only after you approve it, with a history you can roll back.
5. Showing rating, review count, and how fast new reviews arrive, including a comparison with competitors you add.
6. Securing the Service and troubleshooting.

4.3 What we do not do

• We do not sell Google user data.
• We do not use or transfer Google user data for advertising, including retargeting, personalized, or interest-based advertising.
• We do not transfer or sell Google user data to advertising platforms, data brokers, or information resellers.
• We do not use Google user data to determine creditworthiness or for lending.
• We do not use Google user data to train Frontage's own generalized models. We send review text to the OpenAI API only to draft a reply for you. We do not permit that content to be used to train generalized models. OpenAI's own API terms govern how long OpenAI may keep API data for abuse monitoring.
• We do not use Google data for surveillance.
• We do not post a listing edit unless you approve that edit. We do not post a review reply unless you approve it or you have turned on the 4- and 5-star reply rule described above.
• We do not gate reviews. A review request uses one template and the same Google review link for every recipient. The product blocks incentives and sentiment-based wording in that template.

4.4 Who can see Google user data

People at your business who can sign in to your Frontage account can see the Google data for their locations. Humans at Frontage do not have a separate browser for customer review text. We do not read it except:

1. where you ask us, by email, to look at a specific issue;
2. where necessary for security, such as investigating abuse;
3. where necessary to comply with law; or
4. where the data is aggregated and cannot reasonably identify a person, and applicable law allows that use.

4.5 Transfers of Google user data

We transfer Google user data only to the service providers in Section 7, as needed for the feature you are using (for example, review text is sent to OpenAI so it can draft a reply), for security, to comply with law, or as part of a merger, acquisition, or sale of assets. For a merger, acquisition, or sale of assets, we will obtain your explicit prior consent before Google user data is transferred.

4.6 How we store Google user data

Google user data is stored in PostgreSQL hosted by Prisma Postgres (Prisma Data, Inc.), provisioned through Vercel, in the United States. The application is hosted on Vercel. Connections use TLS. The database provider encrypts data at rest. Refresh tokens are stored in that database. We do not add a separate application-layer cipher on top of the database. Access to production systems is limited to people who operate Frontage.

Google Business Profile content is kept only as described in Section 11, and for no longer than 30 days after it was last synced from Google, except for the text of a reply or listing change you approved and the prior value kept so you can roll it back.

4.7 Revoking access

You can stop Frontage's access at any time:

• In your Google Account, open https://myaccount.google.com/permissions, select Frontage, and remove access.
• Email support@meetfrontage.com and ask us to disconnect the location. The Service does not yet include a Disconnect button. We will stop using the stored tokens and delete Google user data as described in Sections 11 and 12.

When you tell us you no longer want Frontage to manage a Business Profile, we will, within seven business days, disassociate that profile from the Service and remove permissions our tool holds, to the extent Google still allows us to revoke them.

4.8 Deletion of Google user data

You may ask us to delete Google user data by emailing support@meetfrontage.com from your account email. See Section 12.

4.9 Changes to how we use Google user data

If we change how we use Google user data, we will update this Policy and obtain your consent before using your Google data in a new way.

4.10 Independence from Google

Frontage is an independent service and is not affiliated with, endorsed by, or sponsored by Google LLC. Google, Google Business Profile, and Gemini are trademarks of Google LLC.

5. How we use information

• Provide, operate, secure, and support the Service, including the features in Section 4.2.
• Generate AI reply drafts and AI-visibility reports (Section 6).
• Prepare the review-request emails and text messages you instruct us to send, record the consent attestation you check, and include STOP language on SMS (Section 8).
• Process payments and manage subscriptions through Stripe.
• Send service messages such as receipts and security notices. You can opt out of non-essential marketing email from us by using the unsubscribe link in that email or by emailing us.
• Respond to investor inquiries.
• Detect abuse, including attempts to gate or incentivize reviews.
• Comply with law and enforce our agreements.
• Improve Frontage using de-identified or aggregated data that does not identify a person and is not Google user data.

6. Artificial intelligence

• Reply drafting. When an OpenAI API key is configured, we send the review text, star rating, business name, and the tone you saved to the OpenAI API to draft a reply. Reviewer names may appear inside the review text Google provided. If no key is set, Frontage uses a built-in draft and does not call OpenAI. We do not use that content to train Frontage models.
• AI visibility. We send the prompts described in Section 3.4. Those prompts do not contain Google user data other than the business's own name, category, and city. The answers come from those providers and can change from one run to the next.
• Your approval. Listing suggestions are drafts until you approve them. Review replies are drafts until you approve them, unless you turned on the 4- and 5-star publishing rule. You can roll a listing change back.
• No automated legal decisions. We do not use AI to make decisions about a person that produce legal or similarly significant effects.
• Accuracy. AI output can be wrong. You are responsible for what you approve. See the Terms of Service.

7. How we share information

We do not sell your information. We share it with these service providers, only as needed to run the Service:

If a provider key is empty, that provider is not called and the feature stays in demo mode.

We may also disclose information to comply with law, to protect rights and safety, with your direction, or in aggregated form that does not identify a person. A transfer of Google user data in a merger or sale requires your explicit prior consent, as stated in Section 4.5.

We will update this Policy when we add a subprocessor. You can email support@meetfrontage.com to ask for notice of that change.

8. Review requests by SMS and email

Frontage prepares messages at your direction. You are the sender and you are responsible for having permission to contact each person.

SMS. You must have any consent the law requires before you enter a mobile number. The message footer identifies your business and tells the recipient they can reply STOP to opt out. Frontage does not currently receive inbound STOP or HELP replies from the carrier. You must not message anyone who has opted out, and you can email us to record a suppression. Message and data rates may apply. How often you text is up to you. We do not add extra reminder campaigns. You are responsible for sending only during hours the law allows, including 8:00 a.m. to 9:00 p.m. in the recipient's local time where that rule applies, and any stricter state rule. We do not share mobile numbers or text-message consent with third parties for their own marketing. Twilio receives the number only to deliver a message you asked us to send, and only when Twilio credentials are configured.

Email. The footer includes your business name and the postal address stored on the location. You must keep that address accurate. It is your address, not Frontage's. You are responsible for a working unsubscribe method and for CAN-SPAM. We do not publish Frontage's own mailing address on this Site. A mailing address for Zivalo LLC is available on request.

Review integrity. The same template and the same Google review link go to every recipient. Frontage rejects templates that offer a discount or gift, or that ask only happy customers to review. We do not route people to a different page based on sentiment.

If you received a message and want it to stop, reply STOP to a text or use the unsubscribe method in an email, and contact the business that messaged you. You may also email support@meetfrontage.com.

9. Cookies

We use a first-party cookie (frontage_session) to keep you signed in, and a cookie to remember the active location. These cookies are necessary to operate the Service. We do not use advertising cookies. You can block cookies in your browser. Blocking the sign-in cookie will sign you out. We treat a Global Privacy Control signal as a request to opt out of sale or sharing, which we do not do.

10. Do Not Track

The Site does not respond to browser Do Not Track signals, because there is no common industry standard for them. We do honor Global Privacy Control, as stated above. We do not track you across other companies' sites for advertising.

11. Data retention

We may keep information longer when the law requires it, to resolve a dispute, or to enforce an agreement.

12. Deleting your data

• Disconnect Google. Remove Frontage at https://myaccount.google.com/permissions and email support@meetfrontage.com. We stop using the tokens and delete Google user data on the schedule in Section 11.
• Delete your account. Email support@meetfrontage.com from your account email and ask us to delete the account. There is not yet a delete button in Settings. We will delete or de-identify your information within 30 days, except the retention rows in Section 11.
• End customers. Contact the business that messaged you, or email us. We will pass the request to that business and, where we can identify the address or number, record a suppression so it is not used again.

We will confirm when deletion is finished if you ask.

13. Security

We use TLS in transit, rely on the database provider's encryption at rest, store passwords only as bcrypt hashes, and limit production access to people who operate Frontage. No system is perfectly secure. If we learn of a breach that the law requires us to report, we will notify you and regulators as required, including Google's requirements where Google user data is involved. If you believe your account is compromised, email support@meetfrontage.com.

14. California and other U.S. state privacy rights

Frontage may not meet the revenue or volume thresholds in the California Consumer Privacy Act. We still extend the rights in this section to California residents and, as a courtesy, to other U.S. users, except where a request has to go to the business customer who controls the data.

14.1 Roles

For account holders, Site visitors, and investor-form submissions, Frontage is the business. For end-customer contacts and reviewer data processed for a business customer, Frontage is a service provider and that customer is the business. We do not use that data outside the service we provide to that customer, except as privacy law allows.

14.2 Categories collected

14.3 Purposes

We use these categories for the purposes in Section 5 and disclose them to the providers in Section 7 for those purposes only.

14.4 No sale or sharing

We have not sold personal information and have not shared it for cross-context behavioral advertising. We do not knowingly sell or share the personal information of anyone under 16. We do not offer a "Do Not Sell or Share" link because we do not sell or share.

14.5 Your rights

You may ask to know, delete, or correct personal information we hold about you, and you will not be charged a different price for asking. If deleting data makes a feature impossible, that feature will stop. We use account credentials only to provide the Service.

14.6 How to ask

Email support@meetfrontage.com with the subject "Privacy Request." We will match the email to the account. We respond within 45 days and may extend once by another 45 days if we tell you why. An authorized agent may write with your signed permission, and we may still ask you to confirm. We will explain any denial the law allows.

If you are a customer of one of our business customers, we will refer the request to that business and help them as the law requires.

If we deny a request, you may reply to that email with the word Appeal. We will answer within the time your state's law requires.

14.7 No financial incentive

We do not offer money or a discount in exchange for personal information.

14.8 Other states

Residents of states that grant access, correction, deletion, or opt-out rights can use the same email. We do not do targeted advertising, sell personal information, or profile people for decisions that have legal effects.

14.9 Shine the Light

We do not disclose personal information to third parties for their own direct marketing.

15. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, email support@meetfrontage.com and we will delete it. Do not upload contact information of anyone you know is under 13, or under 18 where the law requires parental consent for a text message.

16. Where data is processed

Frontage is operated from the United States for U.S. businesses. Information is processed and stored in the United States. If you access the Service from outside the United States, you understand that your information will be processed in the United States.

17. Contact us

Zivalo LLC, doing business as Frontage

Email: support@meetfrontage.com

Privacy requests: support@meetfrontage.com, subject "Privacy Request"

A mailing address is available on request. We do not publish a street address on this Site.

Website: https://www.meetfrontage.com

18. Changes to this Policy

We may update this Policy. We will post the new version with a new "Last updated" date. For a material change we will email you or show an in-app notice at least 30 days before it takes effect, where we can do so. If a change affects how we use Google user data, we will get your consent before using Google user data in the new way.