Privacy Policy — iducomm

1. Who We Are

iducomm ("we", "our", "us") is a review management platform that helps businesses collect customer feedback via SMS and email. Our service is operated in compliance with applicable privacy and anti-spam laws, including Canada's CASL and PIPEDA, and the US FCC TCPA and CAN-SPAM Act.

Contact: privacy@iducomm.com

2. Information We Collect

From Business Owners (Subscribers)

Name, email address, and business information provided during registration
Payment information (processed securely by Stripe — we do not store card numbers)
Business name, industry, location, and review platform URL
Usage data: campaigns created, customers added, messages sent

From End Customers (Recipients of Review Requests)

Name and phone number / email address (provided by the business owner)
Star rating and optional feedback text submitted through the review funnel
IP address and browser type (standard server logs)

3. SMS and Email Communications (CASL)

SMS and email messages sent through iducomm are sent on behalf of the subscribing business. The business is responsible for obtaining express or implied consent from their customers before uploading contact information to iducomm.

Every SMS sent through our platform includes a clear opt-out instruction ("Reply STOP to opt out"). Unsubscribe requests are processed immediately and the recipient's number is flagged to prevent further messages.

You may also unsubscribe at any time at iducomm.com/unsubscribe.

4. How We Use Information

To deliver review request messages on behalf of subscribing businesses
To provide and improve the iducomm platform
To process payments and manage subscriptions
To send transactional emails (account creation, receipts, important notices)
To generate anonymized analytics about platform performance

We do not sell personal information to third parties. We do not use customer data for advertising.

5. Data Sharing

We share data only with trusted service providers necessary to operate the platform:

Twilio — SMS delivery (United States)
Resend — Email delivery
Stripe — Payment processing (United States)
Neon / PostgreSQL — Database hosting
Vercel — Application hosting (United States)
Clerk — Authentication (United States)

All third-party providers are bound by data processing agreements. Cross-border transfers to the US are conducted under standard contractual clauses.

6. Data Retention

Account data is retained while your subscription is active
Upon account cancellation, data is deleted within 90 days
Opted-out contact records are retained indefinitely to honour opt-out requests
Payment records are retained for 7 years as required by Canadian tax law

7. Your Rights

Under PIPEDA and applicable provincial law, you have the right to:

Access the personal information we hold about you
Request correction of inaccurate information
Withdraw consent for commercial electronic messages at any time
Request deletion of your personal information (subject to legal retention requirements)

To exercise these rights, email us at privacy@iducomm.com. We will respond within 30 days.

8. Security

We implement industry-standard security measures including TLS encryption for data in transit, encrypted storage for sensitive data, and access controls limiting data access to authorized personnel. No system is 100% secure; we encourage you to use a strong password and notify us of any suspected breach.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify active subscribers via email at least 14 days before material changes take effect. Continued use of the service after changes constitutes acceptance.

10. Contact

iducomm
Email: privacy@iducomm.com
Website: iducomm.com