Privacy Policy

Pivony ("we", "our", "us") is Pivony, Inc., a B2B company providing consumer intelligence (Voice of Customer, Market Intelligence, Customer 365) and the Sonic product family for SMBs (Sonic Survey, Sonic Prospect, Sonic Engage, Sonic Advisor).

Registered address: Pivony, Inc., 2093 Philadelphia Pike #4590, Claymont, Delaware 19703, USA.
Contact: privacy@pivony.com

We collect the following categories. Pivony is the controller for website visitors and account holders. For end-customer data that a business client puts into the platform (including Sonic Prospect conversations on that client’s site, WhatsApp, or Instagram), Pivony is the processor.

• Account data: Name, email, job title, company when you register or request access.
• Lead and form data: Contact forms, Free RCA (work email, company, optional file), newsletter signup, partner applications, and Calendly demo bookings.
• Usage data: Pages and features used on the website and platform, including first-party events after analytics consent.
• Technical data: IP address, browser, device identifiers, cookies, and localStorage (see Cookie Policy).
• Sonic Prospect session data: A first-party widget session ID on pivony.com, and conversation content when you (or a visitor on a customer site) use the Engine.
• Customer data (processor): Feedback, tickets, surveys, and prospect conversations that business clients submit or collect through Pivony.

We process your personal data for the following purposes:

• To provide, operate, and improve the Pivony platform and services.
• To communicate with you about your account, demos, and support requests.
• To send product updates and marketing communications (with your consent, which you may withdraw at any time).
• To comply with legal obligations and enforce our Terms of Use.
• To analyze aggregate usage patterns and improve platform performance.

We never use customer data to train AI models. Data processed on behalf of our clients is used solely to deliver the contracted service.

For users in the European Economic Area (EEA) and the United Kingdom, we rely on the following legal bases:

• Contract performance: Accounts, the platform, invoicing, and support.
• Legitimate interests: Security, fraud prevention, and keeping the site working. We do not rely on legitimate interests to set Google Analytics cookies.
• Consent: Marketing emails, newsletter, and non-essential cookies (analytics, marketing, functional extras). Withdraw anytime via footer Cookie preferences or privacy@pivony.com.
• Legal obligation: Compliance with applicable laws.

Customer and platform data is hosted on Google Cloud Platform. GCP (not Pivony as an organization) is certified to ISO 27001, ISO 27017, and ISO 27018. Data is encrypted at rest (AES-256) and in transit (TLS 1.2+).

Data residency: Under an Enterprise Agreement, clients can choose Turkey, the US, the EU, or another requested zone. Turkish hosting on servers physically in Turkey is an enterprise option. Unless that option is selected, the default regions are the US (us-central1 and us-west1).

We retain personal data only as long as necessary for the purpose it was collected, or as required by law. Account data is deleted within 30 days of account termination upon request.

We do not sell your personal data. We share data with processors needed to run the site and products:

• Google Cloud: hosting.
• Google Tag Manager / Google Analytics 4: website measurement after analytics consent (unique IDs; not anonymous).
• Calendly: demo booking on the book-a-demo page.
• Resend: transactional and newsletter email from the website.
• Stripe: payments on the Pivony platform (not on the marketing site).
• Not currently loaded on pivony.com: HubSpot, Intercom, PostHog, Meta Pixel, LinkedIn Insight Tag.
• Legal authorities: when required by law or court order.

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Marketing emails, newsletter, and non-essential cookies. Use footer Cookie preferences or email us — you do not need to email only to change cookies.
• US state privacy (including CCPA where it applies): We do not sell personal information. You may request access or deletion at the address below.

To exercise any of these rights, email us at privacy@pivony.com. We will respond within 30 days.

For users in Turkey, Pivony, Inc. acts as data controller for website and account data and honors the rights in Article 11 of KVKK No. 6698: to learn whether your data is processed, request information, correction, or deletion. This page does not claim a VERBIS registration number.

KVKK requests can be submitted to kvkk@pivony.com.

The default hosting regions are in the United States. If data is transferred outside the EEA, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission. Website analytics (Google) and Calendly also involve transfers to those providers.

Pivony's services are intended for business professionals and are not directed at individuals under the age of 16. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email or prominent notice within the platform at least 14 days before changes take effect. The "Last updated" date at the top of this page will always reflect the most recent revision.

Questions or concerns about this Privacy Policy?
Email: privacy@pivony.com
Address: 2093 Philadelphia Pike #4590, Claymont, Delaware 19703, USA