Privacy Policy

Pivony ("we", "our", "us") is Pivony, Inc., a B2B company providing consumer intelligence (Voice of Customer, Market Intelligence, Customer 365) and the Sonic product family for SMBs (Sonic Survey, Sonic Prospect, Sonic Engage, Sonic Advisor).

Registered address: Pivony, Inc., 2093 Philadelphia Pike #4590, Claymont, Delaware 19703, USA.
Contact: privacy@pivony.com

We collect the following categories. Pivony is the controller for website visitors and account holders. For end-customer data that a business client puts into the platform (including Sonic Prospect conversations on that client’s site, WhatsApp, or Instagram), Pivony is the processor.

• Account data: Name, email, job title, company when you register or request access.
• Lead and form data: Contact forms, Free RCA (work email, company, optional file), newsletter signup, partner applications, and Calendly demo bookings.
• Usage data: Pages and features used on the website and platform. On pivony.com we also count page views, entry pages by traffic source (for example a search engine or an AI assistant) and site events as anonymous daily totals, without cookies or identifiers; your IP address is used only briefly to block abuse and is not stored with them. Detailed events go to Google Analytics only after analytics consent.
• Technical data: IP address, browser, device identifiers, cookies, and localStorage (see Cookie Policy).
• Sonic Prospect session data: A first-party widget session ID on pivony.com, and conversation content when you (or a visitor on a customer site) use the Engine.
• Customer data (processor, except as described in section 3): Feedback, tickets, surveys, and prospect conversations that business clients submit or collect through Pivony.

We process your personal data for the following purposes:

• To provide, operate, and improve the Pivony platform and services.
• To communicate with you about your account, demos, and support requests.
• To send product updates and marketing communications (with your consent, which you may withdraw at any time).
• To comply with legal obligations and enforce our Terms of Use.
• To analyze aggregate usage patterns and improve platform performance.

We never sell customer data. Data we process on behalf of our clients is used to deliver and improve the contracted service, including training the AI models that power it, and to create aggregated statistics that never identify a client or a person.

For users in the European Economic Area (EEA) and the United Kingdom, we rely on the following legal bases:

• Contract performance: Accounts, the platform, invoicing, and support.
• Legitimate interests: Security, fraud prevention, and keeping the site working. Improving our services, including training our AI models with client data after removing contact details, and creating aggregated statistics that do not identify anyone; for these purposes Pivony acts as an independent controller, and you can object at privacy@pivony.com. We do not rely on legitimate interests to set Google Analytics cookies.
• Consent: Marketing emails, newsletter, and non-essential cookies (analytics, marketing, functional extras). Withdraw anytime via footer Cookie preferences or privacy@pivony.com.
• Legal obligation: Compliance with applicable laws.

Customer and platform data is hosted on Google Cloud Platform. GCP (not Pivony as an organization) is certified to ISO 27001, ISO 27017, and ISO 27018. Data is encrypted at rest (AES-256) and in transit (TLS 1.2+).

Data residency: Under an Enterprise Agreement, clients can choose Turkey, the US, the EU, or another requested zone. Turkish hosting on servers physically in Turkey is an enterprise option. Unless that option is selected, the default regions are the US (us-central1 and us-west1).

We retain personal data only as long as necessary for the purpose it was collected, or as required by law. Account data is deleted within 30 days of account termination upon request.

We do not sell your personal data. We share data with processors needed to run the site and products:

• Google Cloud: hosting.
• Google Tag Manager / Google Analytics 4: website measurement after analytics consent (unique IDs; not anonymous).
• Calendly: demo booking on the book-a-demo page.
• Resend: transactional and newsletter email from the website.
• Stripe: payments on the Pivony platform (not on the marketing site).
• Not currently loaded on pivony.com: HubSpot, Intercom, PostHog, Meta Pixel, LinkedIn Insight Tag.
• Legal authorities: when required by law or court order.

Pivony MCP lets a person in your organization connect Pivony to an AI assistant they use, such as Claude, and ask it about your Pivony data.

• Who connects: each person signs in with their own Pivony account and approves the connection on a consent screen that lists what the assistant may do. The assistant reaches only the dashboards and data that person can open in Pivony.
• What goes to the assistant: only the data a question needs, for example metrics, topics, trends, review texts, KPI values or survey results. Survey results are anonymous: names, e-mail addresses, phone numbers, contact details and videos are never sent.
• What the assistant can change: with the person's permission it can create KPIs and KPI alarms; create, publish and close surveys; create dashboards from public app store reviews; and group dashboards under brands for competitor analysis. Each action stays within your organization's plan. Alarms e-mail only people of your organization. Pivony never sends a survey from an AI assistant, and plans, accounts and teams are never changed from one.
• The AI provider: what the assistant receives is processed by its provider (for example Anthropic for Claude) under the terms your organization or the person accepted with that provider. Pivony does not control that processing.
• Tokens: a connection uses OAuth tokens: an access token valid for one hour and a refresh token valid for 30 days. Pivony stores only their hashes.
• Disconnecting: a person can disconnect at any time in Pivony under Settings → MCP or in the assistant's settings; the account holder of the organization can disconnect anyone in it. Access ends at once.
• Records: Pivony keeps a record of each call (who, which action, whether it worked, how long it took) and counts calls against the organization's monthly allowance, for security and billing. These records are kept for 12 months. Questions asked through Sonic Advisor are saved in the person's Advisor history.

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Marketing emails, newsletter, and non-essential cookies. Use footer Cookie preferences or email us — you do not need to email only to change cookies.
• US state privacy (including CCPA where it applies): We do not sell personal information. You may request access or deletion at the address below.

To exercise any of these rights, email us at privacy@pivony.com. We will respond within 30 days.

For users in Turkey, Pivony, Inc. acts as data controller for website and account data and honors the rights in Article 11 of KVKK No. 6698: to learn whether your data is processed, request information, correction, or deletion. This page does not claim a VERBIS registration number.

KVKK requests can be submitted to kvkk@pivony.com.

The default hosting regions are in the United States. If data is transferred outside the EEA, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission. Website analytics (Google) and Calendly also involve transfers to those providers.

Pivony's services are intended for business professionals and are not directed at individuals under the age of 16. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email or prominent notice within the platform at least 14 days before changes take effect. The "Last updated" date at the top of this page will always reflect the most recent revision.

Questions or concerns about this Privacy Policy?
Email: privacy@pivony.com
Address: 2093 Philadelphia Pike #4590, Claymont, Delaware 19703, USA