Privacy Policy

Last updated: May 5, 2026
Home / Privacy Policy
Effective Date: May 2026. InteractXP (“we,” “us,” or “our”) is a brand operated by Chinedu G. Ezeofor, based in New York, NY. Parent company EzeFam Group LLC, registered at 28 Liberty Street, 42nd Floor-NY107, New York, NY 10005. We are committed to protecting your privacy. This policy explains how we collect, use, disclose, and safeguard information when you visit our website, sign up for the waitlist, submit a contact form or audit request, create a user account, comment on the blog, subscribe to push notifications, or interact with our restaurant-marketing services.

1. What Data We Collect

The information we hold about you depends on how you use InteractXP. We collect:

  • Identity & contact: Name, email, phone number, restaurant or business name, city/region, referral source.
  • Account credentials: Email + password hash via our authentication provider; if you choose passkeys, the public-key credential is stored on our servers and the private key remains on your device. We never receive or store passkey private keys.
  • Profile data: Display name, avatar image, banner image, follow lists, and notification preferences if you sign in to our dashboard.
  • Blog engagement data: Comments you post, votes you cast, posts and categories you follow. For anonymous (signed-out) votes we store a salted identifier derived from your IP address and browser user-agent so you can change your vote, but we do not link this identifier to your name or email.
  • Push-notification subscriptions: If you opt in, the push endpoint URL and the cryptographic keys your browser provides so our server can deliver notifications. You can revoke at any time in your browser or account settings.
  • SMS-related data: If you (or a diner of one of our restaurant clients) opts in to SMS, we record the consent text shown, the timestamp, the source page, the phone number, and any STOP/HELP keyword interactions. See §13 below.
  • Service-delivery data (clients only): Information needed to deliver paid services — for example, Google Business Profile location IDs, review content from connected platforms, call transcripts and metadata from our AI phone vendor, contact lists, and campaign content.
  • Payment information: Processed and stored by Stripe (and the Zylvie checkout layer that sits over it). We do not see or store full card numbers.
  • Technical data: IP address, browser type, device type, pages viewed, referrer, timestamps, and cookieless analytics events from VisitorTracking. Server logs from our hosting provider may retain this data for a limited period.

2. How We Use Your Data

We use the information we collect to:

  • Provide, operate, and improve our services and platform.
  • Authenticate users, secure accounts, and prevent fraud or abuse.
  • Send service updates, billing notifications, support communications, and (where you have opted in) marketing emails or push notifications.
  • Deliver SMS messages to customers of our restaurant clients where the restaurant has obtained their prior express written consent.
  • Power AI-assisted features such as the AI phone system and the AI website chatbot. These features are described in §11.
  • Conduct cookieless analytics, debug issues, and understand how the platform is used.
  • Comply with legal obligations and enforce our Terms of Service.

We do not sell personal information. We do not use personal information to train third-party large language models. We may use de-identified, aggregated data (e.g., total reviews delivered across all clients) for product analytics and case studies.

3. Sub-Processors and Third-Party Services

We rely on the following sub-processors to operate the service. Each is bound by its own data-processing terms; we keep our list current at /sub-processors.

  • Supabase — authentication, Postgres database, file storage (avatars, banners). Data hosted in the US.
  • Vercel — application hosting, edge runtime, deployment logs.
  • Stripe — payment processing and subscription billing. Stripe stores cardholder data in PCI-DSS-compliant infrastructure.
  • Zylvie — checkout user-experience layer over Stripe.
  • Twilio — outbound and inbound SMS delivery for our compliance pipeline (transactional review requests and operator-initiated sends).
  • RockstarSMS / “Easy Text” — bulk SMS broadcast delivery for opt-in marketing campaigns.
  • Brevo — transactional and opt-in marketing email delivery.
  • MoreGoodReviews — review-management platform integration; processes review content, ratings, and customer contact details our clients provide.
  • Thoughtly — AI inbound phone agent; processes call audio, transcripts, and call metadata for our restaurant clients.
  • EzeChats / Aminos.ai — AI website chatbot infrastructure; processes chatbot conversations.
  • Boost.space — workflow automation and blog content management.
  • Teable — internal database for forms (waitlist, contact, audit) and content calendar.
  • Google (Places API) — restaurant business search autocomplete in our forms.
  • VisitorTracking — cookieless website analytics. No personal identifiers.
  • Web push services — your browser's push gateway (Apple, Google, Mozilla) routes notifications to your device.

Each sub-processor is contractually obligated to protect the data we send and to use it only for the purposes we specify.

4. Cookies, Storage, and Consent

We use a small number of cookies and browser-storage mechanisms. You can manage your cookie preferences at any time via the “Cookie Preferences” link in the footer.

  • Essential / Functional: Required for sign-in sessions, security, fraud prevention, and remembering your dashboard view (e.g., selected location, date range, theme). Always active.
  • Analytics: Cookieless via VisitorTracking by default. If we ever enable cookie-based analytics (e.g., Google Analytics), we will request your consent before loading them.
  • Marketing: Disabled by default; loaded only with your explicit opt-in.

Local browser storage is used to remember your in-app preferences, your anonymous-vote state on the blog, and your cookie-consent decision.

5. Data Retention

We retain your data only as long as we have a legitimate purpose:

  • While your account is active: we retain account, profile, and service-delivery data.
  • After cancellation: 90 days of read-only retention, after which personal data is deleted from our systems. Deletion from sub-processors follows their own published retention windows.
  • Audit reports and contact forms: 12 months for compliance, then deleted.
  • SMS consent records: retained at least 4 years (TCPA statute of limitations) even after a phone number opts out, so we can prove consent existed.
  • Webhook event log: retained 90 days for debugging and audit.

6. Your Data Rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal data, and to object to or restrict certain processing. To exercise any of these rights, email legal@interactxp.com from the address on file. We will verify your identity and respond within 30 days (or the period required by your local law).

  • Access / portability: we provide a copy of the personal data we hold about you in a structured, machine-readable format.
  • Correction: update or correct inaccurate data via your account settings or by emailing us.
  • Deletion: permanently delete your account and personal data, subject to legal retention obligations.
  • Opt-out of marketing: unsubscribe from email by clicking the link in any marketing email. Reply STOP to any marketing SMS.
  • California residents: see §8.

7. GDPR (Where Applicable)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your data under the lawful bases of consent, contractual necessity, or legitimate interest. You have the right to lodge a complaint with your local data protection authority. We will provide Standard Contractual Clauses on request to support transfers to our US-based sub-processors.

8. CCPA / State Privacy Laws

California, Colorado, Connecticut, Virginia, Utah, and other US states grant residents specific privacy rights. We do not sell personal information and we do not share it for cross-context behavioral advertising. You may request access, deletion, correction, and portability via legal@interactxp.com. We will not retaliate against you for exercising your rights. If you are a California resident, you may also designate an authorized agent to act on your behalf.

New York residents are protected by the SHIELD Act's reasonable-security standard. Our security program is described in §10.

9. Restaurant Clients and Diner Data

When a restaurant becomes a client, the restaurant remains the “business” or “controller” of its diner data; InteractXP acts as the restaurant's “service provider” or “processor.” We process diner names, phone numbers, email addresses, ratings, and feedback only on the restaurant's instruction and only to deliver the contracted services. We do not retain or use diner data for our own marketing. Restaurants may request a Data Processing Addendum at legal@interactxp.com.

10. Data Security

We implement administrative, technical, and physical safeguards consistent with industry practice and the New York SHIELD Act's reasonable-security requirements:

  • HTTPS/TLS for all data in transit.
  • Authenticated, role-scoped access via Supabase Auth and row-level security (RLS) policies.
  • Per-vendor secret rotation for inbound webhooks (timing-safe verification).
  • Service-role keys held only in server-side environment variables.
  • Rate-limiting on public endpoints.
  • Limited staff access on a need-to-know basis.

No system is impenetrable. If we discover a security incident affecting your personal information, we will notify you in line with our legal obligations.

11. AI-Assisted Features

InteractXP offers AI-assisted features. We disclose them so you can make an informed choice:

  • AI inbound phone (Thoughtly): When a diner calls a restaurant whose phone is routed through our AI agent, the call is handled by an automated assistant and may be recorded for quality and training. Where required by state law (including CA, CT, DE, FL, IL, MD, MA, MT, NV, NH, PA, WA), the recording and AI handling are disclosed at the start of the call. Callers can request a human at any time.
  • AI website chatbot (EzeChats / Aminos.ai): Conversations may be reviewed to improve service quality. The chatbot is identified as automated; complex requests are escalated to a human.
  • AI-assisted content drafting: Some marketing copy, reports, and review responses are drafted with AI assistance and reviewed by a human before sending.

12. User-Generated Content (Blog Comments)

When you post a comment, vote, follow, or interact with the blog, your display name and avatar are visible to other readers. Do not post content that infringes a copyright, defames another person, or violates our Acceptable Use Policy. We follow the Digital Millennium Copyright Act (DMCA) safe-harbor process; copyright infringement notices may be sent to our designated DMCA agent: see /legal/dmca.

13. SMS Communications

Where the law applies (TCPA in the United States), we send marketing or transactional SMS only with prior express written consent from the recipient. Each campaign is registered through our SMS carrier's 10DLC program. Messages identify the brand, include “Reply STOP to opt out” and “Msg & data rates may apply,” and disclose the expected frequency. STOP requests are honored within 10 business days as required by the FCC's revised opt-out rules. We retain consent records for at least 4 years.

14. Children

InteractXP is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact legal@interactxp.com and we will delete it.

15. Contact for Data Requests

For privacy questions, to exercise data rights, to file a DMCA notice, or to receive our Data Processing Addendum, contact legal@interactxp.com. For account or service questions, contact support@interactxp.com.

16. Policy Changes

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the platform. The “Last updated” date at the top of this page reflects the most recent revision.