Privacy Policy

This Privacy Policy describes how SMASHONE CORPORATION, a corporation incorporated in Florida, United States, registry number P26000023598 ("SmashOne", "we", "us"), collects, uses, shares, and protects information about users of the SmashOne service at https://smashone.us.

The business owner is the controller of data about the owner's customers that the AI employee handles in DMs, calls, and emails; SMASHONE CORPORATION is the processor, acting on the owner's instructions.

At or before the point we collect your personal information, we provide this notice. We collect the categories of information described below to operate, secure, bill, support, and improve the Service. We do not sell your personal information and we do not share it for cross-context behavioral advertising. We retain each category only as long as described in "How long we keep data."

Account details (name, email, business name, optional phone, country of operation); business profile and brand-voice preferences; catalog items and customer content (posts, drafts, images, AI prompts); billing details (processed by Stripe — we store only a tokenized reference and the last 4 digits for display); and support communications you send to info@smashone.us.

Usage data (features used, session activity, click patterns); device information (browser, operating system, language); network information (IP address, city/region-level location, referring URL); and activity logs (login timestamps, actions performed, error events). See "Cookies" for cookie-based collection.

When you connect a social account, we receive only what you authorize via OAuth: profile/account identifiers, page and channel IDs, follower counts, and read-only post analytics from Facebook, Instagram, Telegram, WhatsApp Business, and Google Business Profile. For TikTok we receive only what is described in the paragraph below. You can revoke access anytime from your SmashOne dashboard or the platform's own settings.

TikTok. TikTok is not offered or sold to SmashOne customers. The disclosure below applies only to the separately authorized platform-review build. In that build, when a TikTok account is connected, we receive your account identifiers (open ID and union ID), display name, username, and avatar image (user.info.basic) and an access token that lets SmashOne upload videos to your TikTok inbox for you to finish and publish in TikTok (video.upload). We upload only the videos and captions you or your AI employee prepare in your workspace; we do not publish them directly or read your TikTok inbox, comments, contacts, or analytics. Access tokens are stored encrypted. Disconnecting the account, or revoking access in TikTok settings, immediately stops SmashOne from uploading; the stored credential is erased when you delete your SmashOne account, and account data is removed on the schedule in "How long we keep data" below. The video is streamed to TikTok from your SmashOne media library; the working copy made for the upload is discarded after transfer. The original file stays in your media library until you delete it.

You can connect your SmashOne account to ChatGPT or another AI assistant. The connection starts only when you sign in to SmashOne and allow it on our sign-in page. The assistant can then read and change only the businesses your account can open, with the permissions your role has there. It cannot make payments.

What we send to the assistant. When you ask the assistant something, we return the information that request needs from your workspace: your business profile, hours and knowledge notes; your catalog and FAQ; your AI employees, their channels and settings; your publications; customer conversations, customer cards with names and contact details, and recent calls with a short summary when a transcript exists; bookings; your support tickets; billing summaries such as subscriptions and invoices; and, if you are a partner, your referral and payout records. In ChatGPT we leave out links to payment, checkout and invoice pages.

What the assistant sends to us. The assistant sends us the details of each action you ask for — for example new hours, a catalog item and its photo, a post and its images to schedule or publish, a booking and the customer's details for it, or a support ticket. We save these in your workspace just as if you had made the change in your SmashOne dashboard, and they are kept as described in "How long we keep data." We receive only what the assistant passes in each request, not your whole conversation with it.

Who receives it. The assistant is run by its own company — for ChatGPT, OpenAI — and what we return is processed under that company's own privacy policy and your settings there.

How to disconnect. You can remove the assistant's access at any time in the Security settings of your SmashOne account, where the connection appears in the API tokens list with a Revoke button, or disconnect SmashOne in the assistant's own settings. Once you revoke it in SmashOne, the assistant can no longer read or change your workspace.

When someone calls a line answered by an AI Receptionist, we store the caller's phone number, the telephony provider's call identifier, the written transcript of the conversation, the timestamps of the spoken disclosure and of any consent or opt-out, the call status, the language used, the start time, end time and duration, the reason a call was handed to a person, and per-call cost telemetry (audio-duration, token and stream-minute counters with their USD amounts).

We do not store call audio. The call is transcribed as it happens; the audio is streamed between the caller and our speech provider and is never written to a recording. The duration counters in the cost record measure how long the call ran — they are not audio files.

We use these records to answer the call, to show that the disclosure and any opt-out were given, to pass on the follow-up the caller asked for, to enforce the minutes included with the role, and to reconcile what our providers charge. Written call transcripts are kept for 90 days, then purged; the rest of the call record follows the schedule in "How long we keep data" below. The telephony and speech providers that carry and transcribe these calls are named on the Sub-processors page.

We do not collect full payment card numbers (handled by Stripe), government IDs, Social Security numbers, biometric data, precise geolocation, or health data. The one category the CCPA calls sensitive that we do hold is account credentials: your hashed password and the tokens you authorize for connected accounts. They are stored encrypted, used only to sign you in and to run the connections you asked for, and never to infer anything about you. The Service is not directed to children under 13, and we do not knowingly collect their data.

SmashOne is not a HIPAA-covered service and we do not sign Business Associate Agreements. Use SmashOne for marketing and customer messaging only — do not store or transmit patient data or other protected health information (PHI) through the Service.

To provide publishing, messaging, the AI assistant, and analytics; to authenticate accounts and process billing; to send transactional and (with opt-in) marketing communications; to secure the Service and prevent fraud and abuse; to improve the product; and to comply with legal and tax obligations.

We share data only with vetted providers acting on our behalf under data-processing terms:

We review this list periodically; the current list is always available on this page.

SmashOne does not sell personal information and does not share it for cross-context behavioral advertising under the CCPA/CPRA. Our use of service providers (such as Stripe for payments) for business purposes does not constitute a "sale" or "share."

We are not currently a "business" under the CCPA; we honor deletion and access requests regardless.

When you connect a platform, we disclose the categories of personal information identified below to that independent third party so it can operate the connected account. These recipients process information under their own privacy policies. We do not sell personal information or share it for cross-context behavioral advertising under the CCPA/CPRA. Channel providers receive information only when you connect that channel.

These disclosures describe categories of third parties and categories of personal information shared to provide the Service. You can revoke a connected platform's access in its settings or from your SmashOne workspace.

The AI assistant generates replies from your catalog, FAQ, and configured brand voice. AI messages are clearly disclosed to your customers as your business's AI assistant. You retain editorial control and may switch any conversation to manual mode at any time. We do not train AI models on your specific content; we may use anonymized, aggregated patterns to improve the Service.

• Active account datafor the duration of your subscription plus 30 days after cancellation (for reactivation).
• Cancelled accounts with no reactivationdeleted 12 months after cancellation.
• Billing and payment records7 years (US tax law).
• Activity and error logs90 days.
• AI conversation audit logsa compliance record of AI-assistant conversations (with personal data redacted) is kept for 2 years to meet AI-transparency and dispute-resolution obligations, then deleted. This is separate from the conversation text itself, which is deleted within 90 days.
• Support correspondence3 years.
• Marketing preferencesuntil you unsubscribe.
• Anonymized/aggregated dataindefinitely.

The log of the AI employee's actions is kept for 12 months and then deleted; it is deleted earlier on request from the owner.

If you are a California resident — or a resident of another US state with a comprehensive privacy law (e.g., Virginia, Colorado, Connecticut, Utah, Texas, Oregon) — you may exercise the following rights:

• Right to Know the categories and specific pieces of personal information we collect
• Right to Delete — see our step-by-step Data Deletion Instructions
• Right to Correct inaccurate information
• Right to Opt-Out of any sale or sharing (note: we do neither)
• Right to Limit the use of sensitive personal information (we hold only account credentials, and we use them solely to provide the connections you authorize)
• and the Right to Non-Discrimination for exercising these rights.

If we decline your request. Where your state law gives you an appeal right, email info@smashone.us with "Privacy Appeal" in the subject line. We answer within the period your state law requires — 45 to 60 days depending on the state — and if the appeal is denied we tell you how to bring a complaint to your state attorney general.

When you use our free check at smashone.us/check, we collect only what the check needs:

• The business name and city you enter. Please enter business information only, not personal details about anyone.
• Your email address, if you give it, so we can send the report you asked for.
• The Google place ID of the business. We look the business up in Google's places service to match it. We keep only the place ID and whether the listing's details matched (for example, whether the hours agree), not the listing itself.
• The AI answers we receive about the business, and your IP address and device data, to keep the check secure and stop abuse.

Which AI services we ask. We send questions about the business, the way a customer might ask them, to OpenAI and Anthropic through their official APIs with web search turned on. Only the providers named here are asked. We don't show the AI answers word for word. For each answer we show only signals — whether your business was named, whether other businesses were named, and whether sources were cited — with the name of the service we asked. AI answers can be wrong or out of date; they are not verified facts and not our statements. We do not display unverified negative claims about a business until someone verifies they represent it.

How long we keep it. Report data — the business name and city, your email, the place ID and the AI answers — is kept for 90 days and then deleted. Security logs are kept for 30 days.

Who receives it. Our service providers: hosting, email delivery, the AI providers named above, and Google's places service for the lookup. They process it for us, not for their own marketing.

No sale. We do not sell this data and we do not share it for cross-context behavioral advertising.

Emails. We send the report only to the address you enter. This form doesn't sign you up for marketing emails. Our emails carry our postal address.

What the check is not. It is not a consumer report or a background check and may not be used for credit, employment, housing, insurance or any other FCRA purpose. It shows what these AI services answered at the time of the check. It does not promise and cannot change how any AI service ranks or recommends a business, and a later change in the answers does not show that any action caused it.

How to delete it. Write to info@smashone.us with the subject "Delete my AI check" and the business name and email you used, or by mail to the postal address shown in any email from us. We delete the report data and confirm by email. Your other privacy rights are described in "Your US privacy rights" above.

Who we are. SMASHONE CORPORATION, Florida, United States, document number P26000023598.

We honor opt-out preference signals, including the Global Privacy Control (GPC), as a valid request to opt out of the sale or sharing of personal information for browsers on which the signal is enabled. Because we do not sell or share personal information, your experience is unaffected, but the signal is respected.

Global Privacy Control status will be detected by your browser on this page.

Email info@smashone.us. Please include your account email, full name, and the type of request. We verify your identity (typically by confirming the request matches your account, e.g., the email on file or the last 4 digits of your payment card). We respond within 45 calendar days (extendable by 45 days with notice); opt-out requests are honored within 15 business days. You may designate an authorized agent to submit a request on your behalf with signed written authorization.

We use TLS encryption in transit, AES-256 encryption at rest, tokenized payment data, role-based access controls, multi-factor authentication, audit logging, backups, and an incident-response plan. In the event of a breach affecting your personal information, we will notify affected users and applicable authorities as required by law.

The Service is operated from the United States; your information is processed in the United States. By using the Service you consent to this processing.

We may update this Privacy Policy. For material changes we will give at least 30 days' notice by email to the owner and post the updated version here with a new "Last Updated" date.

Change history

• October 21, 2026 — CCPA status; OpenAI row; 30-day owner notice and change history; customer-data controller/processor roles; 12-month AI employee action log retention.
• August 27, 2026 — Previous published version.