PRIVACY POLICY
Last Updated: May 26, 2026 | Effective Date: January 1, 2026
This Privacy Policy (the “Policy”) explains how Pivotal OS, Inc. (“Pivotal,” “we,” “us,” or “our”) collects, uses, and shares information in connection with our self-service advertising-automation platform and related websites and services (the “Service”). This Policy is incorporated into and forms part of our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.
This Policy applies to information about (a) the businesses that subscribe to and use the Service (“Customers”), including the individuals who administer Customer accounts, and (b) visitors to Pivotal’s own websites. It explains the limited role we play with respect to information about the prospective patients and other individuals who interact with our Customers’ advertisements and landing pages.
1. Scope: Customer and Visitor Information Only
This Policy governs information that Pivotal collects and uses for its own purposes as a business. It does not govern how our Customers (treatment facilities and other advertisers) collect, use, or handle information about their own prospective patients, clients, callers, or website visitors.
When an individual calls a tracking number or submits a form on a Customer’s landing page, any resulting information (“Lead Data”) is processed by Pivotal solely on that Customer’s behalf and at that Customer’s direction, as a service provider. The Customer—not Pivotal—is the party responsible for that Lead Data, including for providing privacy notices, obtaining any required consents (such as consent to record calls), and responding to the privacy rights of those individuals. If you are a prospective patient or other individual who contacted a treatment facility through an advertisement or landing page, please direct your privacy questions and requests to that facility.
Pivotal does not seek, and Customers are prohibited under the Terms of Service from submitting, protected health information or medical or clinical records through the Service. Pivotal is not a “business associate” under HIPAA. The Service is a marketing and advertising tool intended to process marketing, advertising, and prospective-lead contact information only.
2. Information We Collect
2.1 Information You Provide.
When you register for, configure, or use the Service, or contact us, we collect information you provide, which may include:
- Account and contact information: name, business name, email address, phone number, job title, and login credentials.
- Facility and campaign information: facility details, locations, levels of care, services and amenities, brand assets (such as logos and images), website URLs, and the inputs you provide for campaign and landing-page generation.
- Billing information: payment method details and billing contacts. Full payment card numbers are collected and processed by our payment processor (Stripe) and by Google; Pivotal does not directly store full card numbers.
- Support and communications: information you include when you contact support, request help, or otherwise communicate with us.
2.2 Information Collected Automatically.
When you use the Service or visit our websites, we and our service providers automatically collect certain information, which may include:
- Usage and device data: IP address, browser type, device identifiers, pages viewed, features used, referring pages, and dates and times of access.
- Cookies and similar technologies: as described in Section 4.
2.3 Information From Third Parties.
We may receive information about your account and advertising performance from the third-party platforms that power the Service, such as Google Ads, Google Billing, our call-tracking provider, and our payment processor, in order to operate the Service and provide your reporting and dashboards.
3. How We Use Information
We use the information described above to:
- provide, operate, maintain, and secure the Service, including creating and managing campaigns and landing pages and generating your dashboards and reports;
- process payments and administer your subscription, Transaction Fees, and billing;
- communicate with you, including sending service, security, and administrative messages and responding to your requests;
- monitor, analyze, and improve the Service and develop new features, including through aggregated and de-identified analytics;
- provide and improve AI-enabled features, subject to the restrictions in our AI Addendum (including that any model-training use of data is aggregated and de-identified);
- detect, prevent, and address fraud, abuse, security incidents, and technical issues; and
- comply with legal obligations and enforce our agreements.
We do not sell the personal information of our Customers or website visitors, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law.
4. Cookies, Analytics, and Advertising Technologies
We and our service providers use cookies, pixels, tags, and similar technologies on our websites and within the Service to operate and secure the Service, remember your preferences, understand usage, and measure and improve our own marketing. This includes standard analytics and advertising technologies such as Google Analytics and Google Ads conversion tracking, which may collect information about your interactions with our websites.
You can control cookies through your browser settings and, where available, through opt-out tools offered by the relevant providers. Some features of the Service may not function properly if you disable certain cookies. For more information about Google’s practices, see Google’s privacy and advertising disclosures.
Because the meaning of certain privacy signals is still developing, we describe our handling of browser-based opt-out preference signals (such as Global Privacy Control) in Section 7.
5. How We Share Information
We share information in the following circumstances:
- Service providers: with vendors and platforms that perform services on our behalf, such as cloud hosting, payment processing (Stripe), advertising delivery and billing (Google), call tracking, analytics, and AI providers, in each case to operate the Service.
- Within the advertising ecosystem: with Google and related platforms as necessary to create, deliver, and bill the advertising you authorize.
- Legal and safety: when we believe disclosure is required by law, regulation, legal process, or governmental request, or is necessary to protect the rights, property, or safety of Pivotal, our Customers, or others.
- Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality protections.
- With your direction or consent: when you ask us to share information or otherwise consent to its disclosure.
We may also share aggregated or de-identified information that does not reasonably identify you for any lawful purpose.
6. Data Retention and Security
We retain information for as long as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements, after which we delete or de-identify it. Following termination of your account, we may delete or retain information in accordance with our retention practices and applicable law, as described in the Terms of Service.
We maintain commercially reasonable administrative, technical, and physical safeguards designed to protect information within the Service. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
7. Your California Privacy Rights
This Section applies to California residents and supplements the rest of this Policy, as required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”). It applies to personal information we collect about our Customers and website visitors. It does not apply to Lead Data, which Pivotal processes on behalf of Customers as a service provider; California residents who are prospective patients or leads should contact the relevant facility to exercise their rights.
7.1 Categories We Collect.
In the preceding twelve (12) months, we have collected the following categories of personal information about Customers and website visitors:
| CCPA Category | Examples |
|---|---|
| Identifiers | Name, business name, email address, phone number, IP address, online identifiers, account credentials. |
| Customer records | Billing contact and payment-related information (full card numbers handled by Stripe and Google, not stored by Pivotal). |
| Commercial information | Subscription plan, transaction and billing history, and services purchased. |
| Internet/network activity | Usage data, pages viewed, features used, and interactions with our websites and the Service. |
| Professional information | Job title and information about your role at the Customer business. |
| Inferences | Limited inferences drawn from the above to operate and improve the Service. |
We collect these categories from the sources, and use them for the purposes, described in Sections 2 and 3. We disclose these categories to the recipients described in Section 5 for business purposes.
7.2 No Sale or Sharing.
We do not “sell” personal information and do not “share” it for cross-context behavioral advertising, as those terms are defined under the CCPA. We do not knowingly collect personal information from individuals under 16.
7.3 Your Rights.
Subject to certain exceptions, California residents have the right to:
- know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of recipients;
- request deletion of personal information we have collected, subject to legal exceptions;
- request correction of inaccurate personal information; and
- not receive discriminatory treatment for exercising these rights.
7.4 How to Exercise Your Rights.
You may submit a request by contacting us using the information in Section 9. We will verify your request, which may require us to confirm information associated with your account. You may use an authorized agent to submit a request on your behalf, subject to verification. We will respond within the timeframes required by law.
7.5 Opt-Out Preference Signals.
Because we do not sell or share personal information for cross-context behavioral advertising, opt-out preference signals such as Global Privacy Control do not change how we handle Customer or visitor personal information. We continue to honor applicable cookie controls as described in Section 4.
8. Additional Information
8.1 Third-Party Services and Links.
The Service relies on, and our websites may link to, third-party services and websites that we do not control, including Google, our call-tracking provider, our payment processor, and our Customers’ own websites. Their privacy practices are governed by their own policies, and we are not responsible for them.
8.2 Business Users Only.
The Service is intended for businesses and is not directed to children or to consumers for personal, family, or household purposes. We do not knowingly collect personal information from children.
8.3 Changes to This Policy.
We may update this Policy from time to time. If we make material changes, we will provide notice, such as by posting the updated Policy with a new “Last Updated” date or notifying you within the Service. Your continued use of the Service after the changes take effect constitutes acceptance of the updated Policy.
9. Contact Us
If you have questions about this Policy or wish to exercise your privacy rights, contact us at:
Pivotal OS, Inc.
251 Little Falls Drive, Wilmington, DE 19808
Email: privacy@pivotalos.com [confirm address]