Privacy Policy
Last updated October 29, 2026
This Privacy Policy explains how Coi ("we", "us") collects, uses and protects personal data when you visit our website at https://presap.com and when you use Presap at https://app.presap.com (together, the "Service").
In short: we use your data to run the Service you signed up for — managing your Google Business Profile. We do not sell personal data, we do not use it for advertising, and data we receive from Google is used only to provide the features you see in the app.
1. Who we are
The controller responsible for personal data processed through the Service is Coi, Hacarmel 12, Ganne Tikva, Israel. You can reach us about privacy at [email protected].
Presap is a business tool. Your Business Profile contains personal data of other people — for example the names, photos and texts of people who review your business. For that data, you (the business using the Service) are the controller (a "business" under U.S. state privacy laws) and we process it on your behalf as your processor and service provider, under our Data Processing Addendum. This policy describes the data we handle for our own purposes and, for transparency, how we handle that customer data.
2. Information we collect
Account information
Your name, email address, password (stored only as a one-way hash) or your Google account identifier if you sign in with Google, your language and theme preferences, and the time of your last sign-in.
Workspace and team information
Workspace names, the members of a workspace and their roles, and the email addresses of people you invite.
Google account and Business Profile data
When you connect Google, you choose to grant us access through Google's consent screen. We request:
- Basic profile (
openid,email,profile): your Google account ID, name and email address, to sign you in. - Business Profile management (
business.manage): the Business Profile accounts and locations you connect, including business details (name, address, phone number, website, categories, description), reviews (reviewer display name, profile photo link, rating, text and date) and replies, posts, photos, and performance metrics (such as profile views, calls, direction requests and website clicks). - Access tokens issued by Google, which let the Service act on your behalf for the locations you connected (for example to publish a reply you approved).
Content you create
Business details and brand-voice settings, reply drafts, posts, schedules, automation rules, images you upload and images generated for you.
Website scan
If you enter your website address during setup, we fetch publicly available pages of that website to suggest business details such as services and opening hours.
Billing information
Payments are handled by Paddle (see section 7). We receive your Paddle customer and subscription identifiers, your plan, the subscription status and billing period, and invoice details such as amounts and dates. We never receive or store your full card number.
Usage and technical information
Records of actions in the Service (for example AI generations used, posts published, automated replies sent), and server logs that include IP addresses, browser information and timestamps, which we use for security and troubleshooting.
Email assistant
If you use the email assistant, the emails we send you (review alerts, post requests, previews and weekly summaries) and your replies to them: the sender and recipient addresses, the subject, the text of your reply without the quoted email, and photos you attach. Photos become part of your media library; we re-encode them and remove their metadata, including location data, before storing them. Emails from addresses that do not belong to a member of a workspace are discarded without being stored.
Communications
Messages you send to us, for example support requests.
3. Where the information comes from
- From you and the members of your workspace: account details, settings, content, uploads, emails and support requests.
- From Google, when you connect your account: your Google profile and the Business Profile data described above, which includes information that your customers chose to publish in reviews.
- From Paddle: subscription and transaction details.
- From your website, if you ask us to scan it during setup.
- Automatically, from your device and our servers when you use the Service: technical and usage information.
4. How we use information and legal bases
We use personal data only for the purposes below. Where the GDPR or UK GDPR applies, the legal basis is shown for each.
| Purpose | Legal basis |
|---|---|
| Creating and running your account and workspace, connecting Google, syncing reviews, drafting and publishing replies and posts, insights | Performance of a contract |
| AI-assisted drafting of replies, posts, descriptions and images | Performance of a contract |
| Billing, subscription management, tax and accounting records | Performance of a contract; legal obligation |
| Service emails (password reset, invitations, trial and payment notices) | Performance of a contract |
| Email assistant: asking you about reviews and posts by email, reading your replies and acting on them, weekly summaries | Performance of a contract |
| Security, preventing abuse and fraud, troubleshooting | Legitimate interests |
| Improving the Service using aggregated usage statistics | Legitimate interests |
| Complying with legal requests and obligations | Legal obligation |
We do not send marketing emails unless you have opted in, and you can opt out at any time.
5. AI processing
To draft review replies, posts, business descriptions and images, we send the relevant information to Google's Gemini API: for example the review text, rating and reviewer display name, your business details and brand-voice settings, and — for image features — the images you upload. We use the Gemini API as a paid service; under Google's terms for paid API services, Google does not use this content to improve its products, and processes it under its data processing terms. Google keeps prompts and responses for a limited period (currently up to 55 days) solely to detect abuse of its services, during which authorized Google personnel may review content that its systems flag.
AI output is a draft. You can review and edit it before anything is published. Replies and posts are published automatically only for the locations and ratings where you have switched on automatic publishing, and you can switch it off at any time.
6. Google user data and Limited Use
Presap's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We request only the access needed for the features you use and use Google user data only to provide and improve those user-facing features.
- We do not sell Google user data and do not use or transfer it for advertising.
- We do not use Google user data to develop, improve or train generalized AI or machine learning models.
- We transfer Google user data only as needed to provide the features you use: to Google's Gemini API to draft the replies, posts and descriptions you request or have switched on, and to the providers that host and run the Service (section 7). We do not transfer it to anyone else, except to comply with the law or as part of a merger or acquisition with your prior consent.
- Our staff do not read your Google user data unless you ask us to and agree to it (for example in a support request), it is necessary for security or to investigate abuse, or to comply with the law. Access through our admin tools is logged.
- Storage and deletion. Google user data is stored on our servers in the region of our hosting provider, over encrypted connections, for as long as the location is connected, and refreshed on each sync. When you disconnect a location, its Google access tokens are deleted immediately and syncing stops; data already synced stays in your workspace until you delete the workspace or ask us to delete it, which we do within 30 days.
You can disconnect a location in the app at any time, and you can revoke the Service's access to your Google account at myaccount.google.com/permissions.
8. International transfers
Some providers process data outside the European Economic Area and the United Kingdom, for example in the United States. Where this happens we rely on an adequacy decision (such as the EU–U.S. Data Privacy Framework for certified providers) or on the European Commission's Standard Contractual Clauses and the UK addendum, together with additional safeguards where needed.
9. Retention and deletion
- We keep account and workspace data for as long as your account or workspace exists.
- When an owner deletes a workspace, its businesses, connected locations, reviews, posts, media and usage records are deleted from our production systems straight away and from any backups within 30 days.
- When you disconnect a location, its Google access tokens are deleted immediately.
- To delete your user account entirely, contact [email protected].
- Server logs are kept for a short period, no longer than 90 days, unless needed to investigate a security incident.
- Email assistant: the text of your replies and the rendered emails are cleared after 90 days, records of closed questions are deleted after 180 days, and emails in the assistant mailbox are deleted after 30 days. You can turn assistant emails off at any time with the link in each email or in your settings.
- Billing and tax records are kept for as long as the law requires; Paddle keeps its own records under its privacy notice.
10. Security
We protect personal data with appropriate technical and organizational measures, including encrypted connections (HTTPS), passwords stored only as salted hashes, role-based access within workspaces, the minimum Google permissions needed, signature checks on payment and Google notifications, and restricted staff access. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the authorities of a personal data breach where the law requires.
11. Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data;
- have your data deleted;
- receive your data in a portable format — workspace owners and admins can export a workspace in the app under Settings, Data and privacy;
- restrict or object to processing based on our legitimate interests;
- withdraw consent where processing is based on consent;
- lodge a complaint with your data protection supervisory authority.
Residents of U.S. states with privacy laws, including California, also have the rights described in section 12.
To exercise your rights, email [email protected]. If your data is part of a customer's Business Profile (for example a review you wrote), we will forward your request to that business, which controls the data.
12. U.S. state privacy rights (including California)
This section applies to residents of California and of other U.S. states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Texas, Oregon and others), to the extent those laws apply to us. It also serves as our notice at collection under the California Consumer Privacy Act (CCPA). In the 12 months before the date of this policy, we collected and disclosed the following categories of personal information:
| Category | Examples | Disclosed to (for a business purpose) | Retention |
|---|---|---|---|
| Identifiers | Name, email address, Google account ID, IP address, account ID | Hosting and email providers; Google; Paddle (billing) | While the account exists; IP addresses in logs up to 90 days |
| Customer records | Business name, address and phone number; billing details held by Paddle | Hosting provider; Google (publishing); Paddle | While the account exists; billing records as the law requires |
| Commercial information | Plan, subscription and transaction history | Paddle; hosting provider | As long as the law requires for tax and accounting |
| Internet or network activity | Actions in the app, server logs, browser information | Hosting provider | Usage records while the workspace exists; logs up to 90 days |
| Audio, electronic or visual information | Photos you upload or email to the assistant; emails you send us | Hosting and email providers; Google (AI drafting and publishing) | Until you delete them or the workspace; assistant email text 90 days |
| Professional or employment-related information | Your role in a workspace, business details | Hosting provider | While the account exists |
| Sensitive personal information | Account sign-in credentials (password stored as a hash) | Hosting provider | While the account exists |
We collect this information from the sources in section 3, for the purposes in section 4. We use sensitive personal information only to provide the Service and keep it secure, and not to infer characteristics about you. We do not sell or share personal information (as those terms are defined in the CCPA), including of anyone under 16, and we do not use it for targeted advertising or for profiling with legal or similarly significant effects.
Your rights
Depending on your state, you have the right to:
- know what personal information we collect, use and disclose, and access a copy of it in a portable format;
- correct inaccurate personal information;
- delete personal information we collected from you;
- opt out of the sale or sharing of personal information, targeted advertising and certain profiling (we do none of these);
- limit the use of sensitive personal information (we use it only for permitted purposes); and
- not be discriminated against for exercising these rights.
How to make a request
Email [email protected] from the address on your account, or tell us the address your request is about. We will verify your request by confirming that you control that email address, and may ask for more information where needed. You may use an authorized agent; we will ask the agent for proof of your signed permission and may ask you to confirm your identity directly. We respond within 45 days, which we may extend by another 45 days where reasonably necessary, and we will tell you if we do.
Appeals
If we decline your request, you can appeal by replying to our decision or emailing [email protected] with the subject "Privacy appeal". We will respond in writing within the time your state's law requires (generally 45 to 60 days). If the appeal is denied, you can contact your state's Attorney General.
Information in our customers' profiles
If your personal information is part of a customer's Business Profile — for example a review you wrote about a business — that business controls it. We will forward your request to the business and help it respond. You can also manage or delete your review directly on Google.
California residents may also ask, once a year, about disclosures of personal information to third parties for their direct marketing purposes ("Shine the Light"); we make no such disclosures.
13. Emails we send
- Service emails, such as sign-in links, invitations, trial and payment notices and security alerts, are part of the Service and are sent as needed.
- Email assistant messages (review alerts, post requests, previews and weekly summaries) are sent only when the assistant is on for you. Each one has a link to stop them, and you can change them in your settings.
- Marketing emails are sent only if you opt in. They identify us as the sender, include our postal address and an unsubscribe link, and we honor unsubscribe requests promptly, as the CAN-SPAM Act requires.
15. Children
The Service is intended for businesses and may be used only by people aged 18 or older. It is not directed at children, and we do not knowingly collect personal information from children under 13 (or under 16 where stricter rules apply). If you believe a child has given us personal information, contact [email protected] and we will delete it.
16. Changes to this policy
We may update this policy, for example when we add features or providers. We will post the new version here with a new "last updated" date and, for material changes, notify workspace owners by email or in the app before they take effect. Our Terms of Service explain how changes to the terms work.
17. Contact
Coi, Hacarmel 12, Ganne Tikva, Israel. Privacy questions and requests: [email protected]. General questions: [email protected].