Privacy Policy

IndiBuddy is a brand of Quartrek LLP, a limited liability partnership registered in India ("Technology Owner"). IndiBuddy is operated in the United States by QuarTEQ LLC, a limited liability company registered in the State of Georgia, USA (11720 Amber Park Dr Ste 160, Alpharetta, GA 30009) ("US Operator"), under a technology license from Quartrek LLP. When we say "we," "us," or "our" in this Policy, we mean QuarTEQ LLC as the US contracting entity and Quartrek LLP as the technology owner, collectively operating the Platform.

This Privacy Policy ("Policy") describes how and why we collect, use, store, and share your personal information when you use indibuddy.com, indibuddy.ai, or any associated application (collectively, "Platform" or "Services"). It applies to:

• General Users — individuals browsing, searching, posting, reviewing, or interacting with community content.
• Business / Pro Users — businesses, service providers, and advertisers using paid plans.
• Event Organizers — individuals or organizations creating and managing events through IndiBuddy's Event Management SaaS.
• Influencers & Affiliates — participants in the IndiBuddy referral and affiliate program.

Questions or concerns? Contact us at privacy@indibuddy.com. If you do not agree with this Policy, please do not use the Platform.

We use personal information for the following purposes, based on legitimate interest, contract performance, legal obligation, or consent:

We do not sell your personal information to third parties for their independent use. We do not use sensitive personal information (religious affiliation, dietary preferences) for advertising, profiling, or commercial data sharing.

We share personal information only as described below. We do not sell personal data.

We use cookies, web beacons, pixels, and similar tracking technologies to maintain Platform security, remember your preferences, analyze usage patterns, and support advertising features. Some tracking is performed by third-party partners on our behalf.

To the extent cookies constitute a "sale" or "sharing" under applicable US state law (including for targeted advertising), you may opt out by submitting a request as described in Section 18.

You can manage cookie preferences in your browser settings. Disabling certain cookies may limit Platform functionality.

You may register or log in using your Google account. When you do, we receive your name, email address, and profile photo from Google, as permitted by your Google privacy settings. We use this information only to create and manage your IndiBuddy account.

We are not responsible for how Google or other social providers handle your data. We recommend reviewing their privacy policies. Your Google account privacy settings control what data they share with us.

IndiBuddy includes Arvin, an AI-powered community assistant that helps users discover listings, events, businesses, and community resources. By using Arvin:

• Data Processed: Your queries, conversation history within a session, account details (if signed in), location preferences, and Platform context (current page, recent searches) may be sent to our AI provider (currently OpenAI) to generate responses.
• Third-Party AI Processing: Queries to Arvin are processed by OpenAI in accordance with OpenAI's API privacy terms. We have configured API settings to minimize data retention by the AI provider. We do not use your Arvin conversations to train AI models without your consent.
• Conversation Storage: Session conversations may be temporarily stored to maintain conversation context during your session. We do not permanently store full conversation transcripts linked to your identity beyond what is necessary for session continuity and abuse prevention.
• Anonymous Usage: Arvin is available to users who are not signed in (subject to usage limits). In such cases, queries are associated with a session identifier only, not a personal account.
• No Sensitive Data in AI Queries: Do not submit sensitive personal information (financial account numbers, government IDs, passwords, health data) through the Arvin chat interface. AI query content may be processed by third-party AI infrastructure outside our direct control.

"Review Plates" is IndiBuddy's community review feature. When you submit a review:

• What We Collect: Your review text, star rating, photos (if attached), the date and time of submission, and the business or listing being reviewed. Reviews are associated with your account.
• Public Visibility: Reviews are public by default. Your display name and review content are visible to all Platform users and, in the case of indexed pages, to the general public and AI systems.
• Business Responses: Business owners with Pro accounts may respond to reviews. Their responses are also public and associated with the business account.
• Review Integrity: We may use submission patterns, account age, IP data, and behavioral signals to detect and remove fake, incentivized, or fraudulent reviews. This fraud-detection processing is a legitimate interest use of your data.
• Deletion: You may request deletion of a review you submitted by contacting privacy@indibuddy.com. We may retain anonymized review data for platform integrity purposes after deletion.

Business and Pro users are subject to additional data practices related to their commercial use of the Platform:

• Listing Data: Business profile information (name, address, hours, photos, description, category) is public and may be indexed by search engines and AI platforms. By publishing a listing, you consent to this indexing.
• Subscription & Billing: We retain subscription history and billing records for the duration of your account and as required by financial regulations (typically 7 years for tax compliance purposes).
• Advertising Performance Data: We collect and store impression counts, click-through rates, lead interactions, and engagement metrics for your listings to provide you with analytics and to improve Platform ad systems. This data is associated with your business account.
• Fraud & Compliance Monitoring: We monitor business accounts for compliance with our Terms of Service, including detection of fake reviews, prohibited content, payment fraud, and misuse of AI Distribution features. Account activity logs may be retained for this purpose.
• Stripe Connect: If you receive payouts through the Influencer or Affiliate program, your payout account information is managed by Stripe Connect. We retain payout records for tax and compliance purposes and may share them with tax authorities as required by law.
• Reported Content: If your business content is reported by users or flagged by our systems, we retain records of the report, the content in question, and any enforcement action taken for legal defense and compliance purposes.

If you use IndiBuddy's Event Management SaaS features to create and manage events:

• Event Content: All event details you provide (name, description, date, venue, images, ticket info) are treated as public listing content and may be indexed by search engines, AI platforms, and directories once published.
• Attendee Data Responsibility: If you collect attendee registration information (names, emails, contact details) through links or tools associated with your IndiBuddy event listing, you are the data controller for that attendee data. You are responsible for obtaining lawful consent from attendees and for complying with applicable privacy laws governing that data. IndiBuddy does not access or store attendee data collected through your external registration systems.
• RSVP & Interest Data: If IndiBuddy users express interest in or RSVP to your event through the Platform, we collect that interaction data. We may share aggregate interest metrics (e.g., "50 users viewed your event") with you as the organizer but do not share individual user identities without user consent.
• Event Performance Analytics: We provide you with analytics on event page views, click-throughs, and engagement. This data is derived from Platform usage and does not include personal data about individual viewers.
• Event Content Distribution: When AI Distribution is enabled, your event details are syndicated to third-party AI platforms. See Section 11 for details.

IndiBuddy Pro includes an optional AI Platform Content Distribution feature that distributes your business and event content to third-party AI platforms, large language model knowledge bases, search engines, and digital directories to increase discoverability.

• What Is Shared: Business name, category, description, address, hours, services, menu items, photos, event details, and contact information you provide in your IndiBuddy Pro listing. No personal data of consumers or platform users is distributed through this feature.
• Who Receives It: Third-party AI system operators, search indexers, and directory aggregators. The specific recipients may change as the feature evolves. We will update this Policy when material changes occur.
• Your Consent: By enabling AI Distribution in your Pro account settings, you grant us permission to syndicate your content as described. You may disable this feature at any time in your account settings.
• Limitations: Once content is distributed to third-party AI platforms, it may persist in those systems even after you disable the feature. We will make commercially reasonable efforts to request removal from third-party systems upon your request, but cannot guarantee timely or complete removal from external AI knowledge bases.
• No Consumer Data Shared: We do not share personal data of Platform users (general audience) with third-party AI platforms through this feature.

If you participate in the IndiBuddy Influencer or Affiliate Program:

• What We Collect: Your referral link activity (clicks, conversions), earnings history, payout account details (via Stripe Connect), and any promotional content you submit for review.
• Disclosure Requirements: As required by FTC guidelines, you are responsible for disclosing your material connection to IndiBuddy in your content. We may collect and store evidence of your disclosures as part of compliance monitoring.
• Tax Reporting: Earnings paid through the affiliate program may be reported to the IRS and applicable state tax authorities (e.g., via Form 1099-NEC for US participants) as required by law. You are responsible for accurate tax information in your Stripe Connect profile.
• Fraud Detection: We monitor referral activity for click fraud, self-referrals, and manipulation. Suspicious activity patterns may be investigated, and findings may be shared with payment processors.

All user data is stored and processed exclusively within the United States. We do not transfer your personal information outside the United States.

• Primary Database & Authentication: Google Cloud Platform / Firebase — hosted in US data centers (Firestore, Firebase Auth, Cloud Storage, Realtime Database).
• Media & File Storage: Amazon Web Services US East region (S3, SES, EventBridge).
• Payment Data: Processed and stored by Stripe within the United States. We never store raw payment credentials.
• All third-party service providers used by IndiBuddy (including analytics, AI, email, and image services) are US-based and process data within the United States.

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, unless a longer period is required by law.

• Account Data (Categories A, B): Retained while your account is active. Deleted or anonymized within 90 days of account closure, except where retained for legal or fraud-prevention purposes.
• Billing & Payment Records (Category D): Retained for 7 years as required for financial and tax compliance.
• Analytics Data (Category F): Up to 26 months (Google Analytics standard retention period); aggregated/anonymized data may be retained indefinitely.
• Location Data (Category G): Precise GPS data retained for the duration of your session; approximate IP-based location retained for up to 12 months.
• User Content & Media (Category H): Retained while your account is active or until you delete the content. Backup copies may persist for up to 30 days after deletion.
• Review Data: Retained indefinitely for platform integrity, unless deletion is requested and no legal hold applies.
• Business & Event Listing Data: Retained while the account is active. Removed from public display within 30 days of account termination; may be retained in archived form for legal compliance.
• Fraud & Compliance Logs: Retained for up to 5 years to support legal claims and enforcement.
• Arvin AI Session Data: Session conversations not retained beyond 30 days unless necessary for abuse investigation.
• Sensitive Data (Category L): Retained while your account is active. Deleted promptly upon account closure or opt-out request.

When no ongoing legitimate business need exists, we delete or anonymize data. If immediate deletion is not technically feasible (e.g., backup archives), we isolate the data from further processing until deletion is possible.

We implement reasonable technical and organizational security measures to protect your personal information, including:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Firebase Authentication for secure account management
• Stripe for PCI-compliant payment processing (raw card data never touches our servers)
• Access controls limiting employee and contractor access to personal data on a need-to-know basis
• Security monitoring and fraud detection systems
• Session management and authentication token protections

No security system is perfect. Despite our efforts, no electronic transmission over the internet or data storage system can be guaranteed 100% secure. We cannot promise that unauthorized parties will never defeat our security measures. Transmission of personal information to and from our Platform is at your own risk. Use the Platform only from secure networks and environments.

If you believe your account has been compromised, contact us immediately at hello@indibuddy.com.

The Platform is intended for users aged 18 and older for account creation and transactional features. We do not knowingly collect, use, or disclose personal information from individuals under 13 without verifiable parental consent, in compliance with the Children's Online Privacy Protection Act (COPPA).

Users aged 13–17 may browse public content only under the supervision of a parent or legal guardian. We do not knowingly permit minors under 18 to register accounts or use transactional features.

If we learn that we have inadvertently collected personal information from a child under 13, we will take immediate steps to delete that information. Parents or guardians who believe their child has provided personal information to us should contact privacy@indibuddy.com and we will address the request promptly.

For questions about your privacy rights, email privacy@indibuddy.com.

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the following rights regarding your personal information:

• Right to Know: Whether and how we process your personal data
• Right to Access: A copy of the personal data we hold about you
• Right to Correct: Inaccuracies in your personal data
• Right to Delete: Your personal data, subject to legal retention obligations
• Right to Portability: Receive your data in a portable format
• Right to Opt Out: Of targeted advertising, sale of personal data, and profiling for significant decisions
• Right to Non-Discrimination: We will not discriminate against you for exercising privacy rights

Depending on your state, you may also have:

• Right to obtain a list of categories or specific third parties we shared data with (California, Delaware, Maryland, Minnesota, Oregon)
• Right to limit use of sensitive personal data (California)
• Right to review how personal data has been profiled (Minnesota)

Most web browsers include a Do-Not-Track ("DNT") feature. Because no uniform technology standard for recognizing DNT signals has been finalized, we do not currently respond to DNT browser signals. If a legally recognized standard is adopted that applies to us, we will update this Policy to reflect our practices.

California law requires us to disclose how we respond to DNT signals. As stated above, we do not respond to DNT signals at this time.

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. Material changes will be communicated via:

• Email notification to your registered email address, and/or
• A prominent notice on the Platform at least 14 days before the changes take effect.

The "Last Updated" date at the top of this Policy indicates when it was last revised. Your continued use of the Platform after the updated Policy takes effect constitutes acceptance of the revised terms. We encourage you to review this Policy periodically.

For privacy questions, data requests, or to exercise your rights:

To review, update, or request deletion of your personal data:

• Log in to your account and update your profile directly in account settings.
• Email privacy@indibuddy.com with subject line "Data Request" — include your name and the email address associated with your account.

We respond to verified requests within 45 days. Complex requests may take up to 90 days with notice. We may retain certain data as required by law, for fraud prevention, or to resolve disputes even after deletion requests.