Privacy Policy

1. Introduction

This Privacy Policy explains how JMatsu Holdings LLC (“Buzzmax,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information in connection with the Buzzmax platform (the “Service”), available at app.buzzmax.ai and related subdomains.

Buzzmax is a business-to-business (B2B) software-as-a-service platform that provides review collection and reputation management tools to multi-location service businesses. Because of how the Service works, it is important to understand the two distinct relationships this policy addresses:

• Buzzmax and our business customers. We sell the Service to businesses (“Customers” or “Tenants”). Our commercial relationship with those Customers, including fees and acceptable use, is governed by our Terms of Service, not this policy.
• Our business customers and their consumers. Our Customers use the Service to request and manage reviews from their own end customers (“Consumers”). When we handle Consumer personal information, we do so on behalf of and under the instructions of the Customer. In that context the Customer is the “controller” (GDPR) or “business” (CCPA/CPRA), and Buzzmax acts as the “processor” or “service provider.”

This policy describes both the information we handle as a controller of our own business relationships and the information we process on behalf of our Customers. Where a Consumer wishes to exercise rights over information collected through a specific business, that business is the responsible party, and we will support them as described in Section 11.

Scope note on how review routing works. A Consumer who opens one of our Customers’ review links is asked for a star rating first, and that rating decides which screen the Consumer sees first: at or above the threshold the Customer has set (four stars by default), the links to public review platforms such as Google; below it, a private feedback form that goes to the Customer. Where the business has connected at least one review platform, the public review option stays available at every rating. The private form carries a button to the same public platforms that is never conditioned on the rating, and those platform links reach every Consumer’s browser however that Consumer rated, so no rating prevents a Consumer from posting publicly. The rating itself reaches us only if the Consumer submits the private feedback form; choosing a star and continuing to a public platform sends us nothing. Section 3.2 of our Terms of Service describes this routing in full.

2. Who We Are and How to Contact Us

Data Controller (for our own business relationships):

For Consumer personal information processed through a specific business’s account, that business is the controller. Please direct requests to that business; we will assist them in responding.

3. Information We Collect

3.1 Business Customer Information (Buzzmax as controller)

When a business signs up for and uses the Service, we collect:

• Account and identity data: business name, business address, the name and job title of account users, and business contact details.
• Login credentials: account email addresses and passwords. Passwords are stored only as salted bcrypt hashes; we never store plaintext passwords.
• Billing information: subscription plan, billing contact, and transaction records. Card and bank details are collected and processed directly by our payment processor (see Section 6); we do not store full payment card numbers on our systems.
• Connected-account data: authorization tokens and profile data from third-party accounts a Customer connects, such as Google Business Profile.
• Usage and support data: actions taken in the dashboard, feature usage, support requests, and correspondence with us.

3.2 Consumer Information (Buzzmax as processor for the Customer)

When a Customer uses the Service to request and manage reviews, we process the following about that Customer’s Consumers, on the Customer’s behalf:

• Consumer contact information: name, email address, and phone number, used to send review-request messages.
• Review content and user-generated content (UGC): star ratings, free-text review and feedback content, and photos or images the Consumer uploads.
• Messaging metadata: delivery status, timestamps, and consent and opt-out status for SMS and email review requests.
• Public review profile data: reviews, ratings, and related data retrieved from or published to connected review platforms such as Google Business Profile.

3.3 Reputation and Visibility Data

To provide reputation and visibility analytics, we collect and generate:

• Keyword rank data and local search ranking scans.
• AI-visibility scan data measuring how a business appears in AI-generated and search responses.
• Google Business Profile data associated with the Customer’s connected locations.
• Public review and listing data from platforms beyond Google: reviews, ratings, replies, posts, photos, listing details and competitor information for the business a Customer connects, collected from public sources such as Yelp, Facebook, Trustpilot and the Better Business Bureau. Most of this information is already public on those platforms.

3.4 Information Collected Automatically

When users interact with the Service, we and our providers automatically collect device and log data such as IP address, browser type, pages viewed, and interaction timestamps, through cookies and similar technologies (see Section 8). We also record sign-in times and error diagnostics, which we use to keep the Service running, to enforce rate limits, and to investigate problems.

4. How We Use Information

We use business Customer information to:

• provide, maintain, secure, and improve the Service;
• authenticate users and manage accounts;
• process subscriptions and billing;
• provide customer support and send service-related communications; and
• comply with legal obligations and enforce our Terms.

We process Consumer information only to provide the Service to the relevant Customer, including to:

• send review-request messages the Customer initiates;
• collect, display, and route Consumer feedback and reviews;
• generate reputation, ranking, and visibility analytics for the Customer; and
• honor messaging consent and opt-out choices.

We do not use Consumer personal information for our own independent purposes, and we do not sell it (see Sections 5 and 10).

The Consumer contact details a Customer supplies for SMS and email review requests belong to that Customer. We do not use them for our own marketing and we do not sell them.

5. Artificial Intelligence (AI) Processing Disclosure

The Service uses third-party large language models (LLMs) to provide certain features. In the interest of transparency, and voluntarily consistent with FTC guidance on AI and endorsements, we describe that use here. There is no binding rule that requires disclosure of AI-assisted content generation; the binding rule is the prohibition on AI-generated fake reviews (16 CFR Section 465.2), which we do not permit.

Features that use AI:

• Review-reply drafting: generating suggested responses to Consumer reviews.
• Social and post content generation: drafting marketing and social content for the Customer.
• AI-visibility analysis: assessing how a business surfaces in AI-generated answers.

Data that touches LLMs. To produce these outputs, the content of reviews, business and location information, and prompt text may be transmitted to our AI subprocessors (Cerebras and OpenRouter, and the model providers they route to). We limit the data sent to what is needed to generate the requested output. AI-generated drafts are suggestions; a human at the Customer reviews and decides whether to use, edit, or discard them.

Our training posture. We do not use Consumer personal information or Customer content to train our own AI models, and we do not permit our AI subprocessors to use data submitted through the Service to train their or any third party’s models. Data is sent to these providers solely to return an output to the Customer (inference), not for model training. AI outputs can contain errors, and we do not guarantee their accuracy.

6. Subprocessors

We rely on the following third-party subprocessors to provide the Service. Each processes information only as needed to perform its function and is bound by contractual data-protection obligations.

We may update this list as our providers change. Material changes will be reflected in an updated version of this policy.

We also publish content on a Customer’s behalf to the platforms it connects, such as its Google Business Profile. That is the Service working as intended, and the Customer controls what gets published. Beyond this, we disclose information only when the law requires it, or to protect the Service against fraud or abuse.

Google user data

When you connect a Google Business Profile, we request access to your business listings, reviews and posts so the service can read reviews, publish replies you approve, and create posts you schedule. We use that data only to provide these features. We do not transfer it to others except as described above, we do not use it for advertising, and no human reads it except where needed for support you request or for security. You can disconnect at any time from Settings, or by revoking access in your Google account, which stops further access immediately.

Buzzmax’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Messaging Consent and Opt-Out (TCPA / CAN-SPAM)

Buzzmax sends messages by SMS and email at the direction of our Customers under two programs: review requests, and missed-call replies, an automatic text to someone who called the Customer’s business and did not reach anybody. Each is described separately below because the consent basis for each is different. Customers are responsible for obtaining any legally required consent from their Consumers before requesting that messages be sent. For marketing or promotional text messages, Customers must obtain each recipient’s prior express written consent as required by the TCPA before requesting that such messages be sent; transactional and relationship messages are handled per applicable law.

• SMS program disclosure: Review-request SMS are sent on behalf of the Customer business whose service you used. Message frequency varies. Msg & data rates may apply. Reply STOP to opt out at any time; reply HELP for help. Every message identifies the sending business. Opt-out and consent status are tracked in the Service and honored. For the program terms and privacy practices, see these Terms of Service and this Privacy Policy.
• Missed-call reply program disclosure: If you call a Customer business at a Buzzmax tracking number and nobody answers, that business may send you one automatic text message from the number you dialled, so your enquiry is not lost. The consent basis is your own inbound call to that business; this is a service reply to that call, and it is never a review request, an advertisement, or a promotion. You may reply to it and your reply is forwarded to the business. Message frequency: at most one message per missed call, limited to one message per caller per business in any six hour period. Msg & data rates may apply. Reply STOP to opt out at any time; reply HELP for help. Every message names the business you called.
• Invoice reminder and receipt program disclosure: If you agree on a form, work order or invoice that shows our wording, or on Buzzmax’s public opt-in page, Buzzmax (JMatsu Holdings LLC) may text you an invoice due-date reminder before an invoice is due and a receipt when you pay, for the business you name. Your consent applies only to Buzzmax’s own messaging program operated by JMatsu Holdings LLC; we do not collect consent for affiliates, other companies, or marketing. These texts are never marketing and are sent only if you agreed. Agreeing is not a condition of purchase. Message frequency varies: at most one reminder before an invoice is due, never more than one in seven days, and one receipt per payment. Msg & data rates may apply. Reply STOP to opt out at any time; reply HELP for help.
• We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.
• Your mobile information is never sold or shared for marketing. Mobile information, mobile phone numbers, and text messaging opt-in or consent data are not shared with or sold to third parties or affiliates for marketing or promotional purposes. They are used only to send the messages described here and to honor your opt-out, and are shared only with the subprocessors that deliver them (Section 6).
• You do not have to use the word STOP. Consistent with 47 C.F.R. § 64.1200(a)(10), you may revoke consent in any reasonable way. As well as STOP and the other standard keywords, we recognize a request to stop written in your own words, for example “please stop texting me”, “remove my number” or “leave me alone”, in English or Spanish, and we treat it as an opt-out. An opt-out applies to the phone number that texted you: we send you no further messages from that number (for a shared Buzzmax number, from any business texting through our shared numbers). Reply HELP to any message and we reply with who is texting you, that message and data rates may apply, how to reach us, and how to stop.
• Sending hours: Messages are sent only during permitted hours (generally 8:00 a.m. to 9:00 p.m. in the recipient’s local time zone), consistent with the TCPA and applicable state quiet-hours laws.
• Email: Review-request emails identify the sending business, use accurate “From” and header information and a non-deceptive subject line, include a working unsubscribe mechanism, and display the sending business’s valid physical postal address in the footer (the Service populates the address from the Customer’s account profile), consistent with the CAN-SPAM Act. We honor unsubscribe requests. Where a message is commercial rather than transactional, it is identified as an advertisement as required.

Consumers who wish to stop receiving messages should use the STOP reply or the unsubscribe link, or contact the business that sent the message.

8. Cookies and Analytics

The Service uses cookies and similar technologies to keep users signed in, remember preferences, secure the Service, and understand how the dashboard is used. Some cookies are strictly necessary for the Service to function; others help us measure and improve performance.

You can control cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of the Service from working. Where required by law, we request consent before setting non-essential cookies and default to the most privacy-protective option.

9. Data Retention

We retain information for as long as needed to provide the Service and for the purposes described in this policy:

• Business Customer account data is retained for the life of the account and for a reasonable period afterward to meet legal, tax, accounting, and dispute-resolution obligations. When an account is closed, we delete or anonymize personal information within 90 days, except where we must keep records longer for tax, accounting or legal reasons. Diagnostic logs are kept for a shorter period.
• Consumer information processed on behalf of a Customer is retained for as long as the Customer maintains its account or instructs us to retain it, subject to the Customer’s own retention decisions. On verified deletion requests, or on termination of the Customer relationship, we delete or return such information as instructed and as described in our agreement with the Customer, except where retention is legally required.
• Messaging consent and opt-out records are retained as needed to demonstrate compliance with messaging laws.
• Backups may persist for a limited period after deletion from active systems and are overwritten on a rolling basis.

If you ask us to delete something, we delete it from our live systems and from backups on the ordinary backup rotation. We do not keep a private copy of material we told you was deleted. Public review content that we collected may persist in aggregate reporting that no longer identifies any individual.

10. Security

We maintain administrative, technical, and organizational safeguards designed to protect information, including:

• storage of account passwords only as salted bcrypt hashes, never in plaintext;
• encryption of data in transit using industry-standard TLS;
• signed sessions that expire, access controls, and tenant isolation in our multi-tenant architecture, with access to production data limited to people who need it; and
• reliance on reputable infrastructure and subprocessors with their own security programs.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Users are responsible for keeping their login credentials confidential. If a breach puts personal information at real risk, we will notify affected users and any regulator we are required to notify.

11. Your Privacy Rights

Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to delete it, to receive a portable copy, and to opt out of certain uses. Residents of California, Colorado, Connecticut, Virginia and other US states with comprehensive privacy laws have these rights by statute, as do individuals in the UK and EEA.

11.1 California Residents (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know / access the categories and specific pieces of personal information we have collected about you;
• Delete personal information we hold about you, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information; and
• Non-discrimination for exercising your rights.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding twelve months. Where required by law, we honor opt-out preference signals, including the Global Privacy Control (GPC). We do not use or disclose sensitive personal information (as defined by the CCPA/CPRA) for purposes that would trigger the right to limit its use; any such information is used only to provide the Service.

For Consumer personal information that we process on behalf of a business Customer, we act as a service provider and use that information only to perform the Service for that business. If you submit a request to us directly, we will refer it to, and cooperate with, the relevant business, which acts as the “business” under the CCPA/CPRA.

Categories of personal information we collect (CCPA/CPRA).

We do not sell or share any of these categories. We retain each category per Section 9.

11.2 Individuals in the European Economic Area and United Kingdom (GDPR / UK GDPR)

If applicable data protection law covers you, you have the right to access, rectify, erase, restrict processing of, and port your personal information, and to object to certain processing. You also have the right to withdraw consent at any time where processing is based on consent (without affecting prior processing), and the right to lodge a complaint with your supervisory authority. We do not make decisions producing legal or similarly significant effects about Consumers based solely on automated processing (no Article 22 automated decision-making). Where we process personal information on behalf of a business Customer, that Customer is the controller and directs how these rights are fulfilled; we act as processor and support the controller in responding.

EU / UK Representative. The Service is offered to businesses in the United States only and is not directed to data subjects in the EU or UK, so no Article 27 representative is appointed.

11.3 How to Exercise Your Rights (DSAR)

To submit a data subject access or rights request:

• Email us at team@buzzmax.ai with the nature of your request, or
• If your request concerns information collected through a specific business, contact that business directly; if you contact us, we will forward your request to them and assist.

We will verify your identity before acting on a request, which may require confirming information you have previously provided. We respond within the timeframes required by applicable law (generally 45 days under CCPA/CPRA and one month under GDPR, each extendable where permitted). You may use an authorized agent where the law allows. If we decline a request, we will explain why, and you may have the right to appeal or to lodge a complaint with your supervisory authority or attorney general.

Exercising these rights never costs you anything and we will not degrade your service for asking.

12. User-Generated Content and DMCA

Consumers may upload text, photos, and other content through the Service. This UGC is submitted by Consumers and managed by our Customers. If you believe content accessible through the Service infringes your copyright, you may send a notice under the Digital Millennium Copyright Act (DMCA) to our designated agent at team@buzzmax.ai, including the elements required by 17 U.S.C. § 512(c)(3). We respond to valid notices, including by removing or disabling access to allegedly infringing material, and we maintain a policy of terminating repeat infringers where appropriate. We will forward counter-notifications as provided by law.

13. International Data Transfers

We are a United States company, and information we process is handled in the United States and in the locations where our subprocessors operate. Where personal information is transferred from the EEA, the UK, or other regions, we rely on appropriate transfer mechanisms, such as Standard Contractual Clauses, where required by law.

14. Children’s Privacy

The Service is intended for businesses and is not directed to children under 13 (or the applicable age in your jurisdiction). We do not knowingly collect personal information from children, and in practice we do not knowingly collect personal information from anyone under 16. If you believe a child has provided personal information, contact us at team@buzzmax.ai and we will take appropriate steps to delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will revise the “Last Updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after an update constitutes acceptance of the revised policy.

Where a change affects how we handle your information, we will notify account holders by email before the change takes effect. The version you agreed to at signup is recorded with your account.

16. Governing Law and Dispute Resolution

This Privacy Policy and any dispute arising out of or relating to it or the Service are governed by the laws of the State of Utah, without regard to its conflict-of-laws principles. Any dispute that cannot be resolved informally will be resolved through binding arbitration seated in Utah, except where prohibited by law. Nothing in this section limits any non-waivable statutory right you may have.

17. Contact Us