# Pombity Privacy Policy Version 1.0. Effective date: [to be set at launch]. This policy explains what Aric Software & Design, Inc ("Aric," "we," "us") collects when you use Pombity (the "Service"), why, how long we keep it, and what choices you have. It covers account holders and the people who visit the documentation site. It also explains how we handle information about the recipients of our customers' messages, which we process on the customer's behalf. ## 1. Who we are Aric Software & Design, Inc, 1305 Hardeman Ave, Suite 200-115, Macon, GA 31201. Privacy contact: privacy@aricsoftware.com. ## 2. Information we collect from account holders - **Account information:** organization name, contact email address, and the record of your acceptance of the Terms of Service and Acceptable Use Policy (version and time). If you request invoice billing, the billing contact and purchase order details you give us. - **Credentials:** API keys are stored only as cryptographic hashes; the key itself is shown once at creation and cannot be recovered by us. - **Verified destinations:** phone numbers and email addresses you verify as your own, with the time of verification and the consent record it creates. - **Usage and billing:** counts of messages sent by channel and mode, quota standing, and, for paid plans, the transaction records our payment processor returns. Card numbers are entered on the processor's hosted pages and never reach our systems. - **Technical data:** the IP address, time, and endpoint of API requests, used for security, rate limiting, and abuse prevention. ## 3. Information we process for customers When a customer sends messages through the Service, we process the recipients' phone numbers or email addresses, the message content, consent and opt-out records, delivery receipts from carriers, and inbound replies. We process this information as the customer's service provider, under the customer's instructions and the Terms of Service, to deliver the messages and keep the records the law and the carriers require. The customer is responsible for having the recipient's consent. Recipients who want to stop messages from a customer reply STOP; recipients with questions about a customer's messages should contact that customer, or reply HELP for the customer's contact information. ## 4. Information from the documentation site and playground - The documentation site does not use advertising cookies or trackers. If we use analytics, it is privacy-preserving and described on the site. - The playground lets a visitor send one message to a phone number or email address they verify with a code. We store a one-way hash of the verified address, the time, and the visitor's IP address for the purpose of limiting use to one message per address per day and preventing abuse. The message content is not stored beyond the delivery record required to show the visitor their result. ## 5. Why we use information - To provide the Service: authenticate requests, send messages, record consent and delivery, enforce allowances and the Acceptable Use Policy. - To keep the Service and its recipients safe: detect abuse, pumping, and fraud; protect carrier standing. - To bill paid plans and keep financial records. - To communicate with you about your account, security, and changes to the Service. - To comply with law and respond to lawful requests. We do not sell personal information and we do not use message content for advertising. ## 6. Who receives information - **Service providers (subprocessors):** Microsoft (Azure hosting, databases, and Azure Communication Services, which transmits text messages and email); GitHub (source code and build systems; no customer data); our payment processor, when paid plans are offered (card payments); The Campaign Registry and the carriers (business registration details for sending numbers). We list current subprocessors on the documentation site. - **Carriers and recipients:** message content and the sending number or address are necessarily delivered to recipients and the carriers that deliver them. - **Legal:** we disclose information when required by law, subpoena, or court order, or to protect the rights and safety of Aric, our customers, or the public. We notify the affected customer when the law allows. - **Business transfers:** if Aric is acquired or merges, information may transfer to the successor under this policy. ## 7. Retention - Account information: for the life of the account and 30 days after closure, then deleted, except records we must keep for tax, accounting, or legal reasons. - Consent and opt-out records, delivery receipts, and the audit log: one year for developer accounts (longer where a customer's own policy or the law requires it), then purged on schedule. Opt-out records are kept as long as needed to honor the opt-out. - Playground records: hashed addresses are kept 24 hours for the daily limit; request logs for 30 days. - Backups: encrypted point-in-time backups are kept for 7 days. ## 8. Security Each account's data is isolated in the database by row-level security; access by Aric staff requires a stated reason and is written to an append-only audit log; API keys are hashed; data is encrypted in transit and at rest; the environment is monitored. Our incident process commits to notifying affected customers within 72 hours of confirming a security incident involving their data. Details are on the documentation site's security page. ## 9. Your choices and rights - You can view, export, and delete your account data through the Service at any time (export produces a complete package; deletion follows the retention periods above). - You can revoke any API key at any time. - Recipients can stop messages by replying STOP and can ask the sending customer, or us at the privacy contact, about information held about them. Where state privacy laws grant rights to access, correct, or delete personal information, we honor them directly for information we hold as a business, and we forward requests about customer messages to the customer, who decides. - We do not knowingly collect information from anyone under 18, and the Service is not for their use. ## 10. International use The Service is operated from the United States and sends to US and Canadian numbers. Information is stored and processed in the United States. ## 11. Changes We may update this policy. The current version, with its version number and effective date, is always on the documentation site. Material changes are announced to account holders by email at least 15 days before they take effect. ## 12. Contact Aric Software & Design, Inc, 1305 Hardeman Ave, Suite 200-115, Macon, GA 31201. privacy@aricsoftware.com.