Privacy Policy

Baxter Research Group (“BRC,” “we,” “our,” or “us”) operates the TrueStanding platform (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this Privacy Policy carefully. By accessing or using TrueStanding, you acknowledge that you have read, understood, and agree to be bound by the terms of this Privacy Policy.

1. Information We Collect

1.1 Account Information

When you create a TrueStanding account, we collect the following personal information:

• Full name
• Email address
• Company or organization name (optional)
• Sign-in verification codes sent to your email (we use passwordless authentication; no passwords are collected or stored)
• Billing information (processed securely through Stripe; we do not store full credit card numbers)

1.2 Review and Sentiment Data

TrueStanding connects to third-party review platforms on your behalf to collect and analyze customer review data. This data may include:

• Review text, ratings, and timestamps from connected platforms (e.g., Google Reviews, the Apple App Store, and Google Play)
• Reviewer display names and profile information as publicly available on those platforms
• Aggregate sentiment scores and trend data generated by our AI analysis
• Tags, categories, and labels you assign to reviews within TrueStanding

1.3 Usage Data

We automatically collect certain technical information when you access the Service, including:

• IP address and browser user-agent string, recorded in standard web-server logs by our hosting provider and used for security, abuse prevention, and rate limiting
• IP address and user-agent of respondents who submit a public survey you have published, stored with that response
• Error and diagnostic logs generated when something goes wrong, which may include the request path and your account identifier

1.4 Communication Data

If you contact us through email, support tickets, or in-app feedback, we collect the content of those communications along with your contact details and any attachments you provide.

1.5 Connected Social Media Accounts

If you choose to connect a social media account (such as Facebook, Instagram, or LinkedIn) to monitor mentions of your brand, we use that platform's official OAuth authorization flow. We store the account handle and name, an access token (and its expiration) issued by the platform, and the public mentions and engagement data the platform returns. We use these tokens solely to retrieve the data you authorized; we do not post on your behalf. You can disconnect a social account at any time in your dashboard, which revokes our stored token and stops further collection from that source.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, operate, and maintain the TrueStanding Service
• To process and analyze customer review data using our AI sentiment analysis engine
• To generate sentiment reports, trend analysis, and actionable insights for your account
• To send you alerts and notifications about sentiment changes, as configured in your account settings
• To process payments and manage your subscription
• To communicate with you about service updates, security alerts, and support
• To monitor and improve the overall quality, accuracy, and reliability of the Service (using anonymized, aggregated data only)
• To detect and prevent fraud, abuse, and security threats
• To comply with legal obligations and enforce our Terms of Service

3. AI Processing of Review Data

TrueStanding uses artificial intelligence and natural language processing to analyze the review data you connect to our platform. It is important that you understand how this works:

• Our AI processes review text to determine sentiment (positive, negative, neutral), identify themes and topics, detect emerging trends, and flag reviews that may require urgent attention.
• AI-generated insights are derived solely from the review data connected to your account. We do not combine your review data with data from other accounts for analysis purposes.
• We do not train, fine-tune, or otherwise develop artificial-intelligence models using your data. Our analysis is performed by a third-party AI provider (Anthropic) that, under our API terms, does not use your content to train its models. We may use anonymized and aggregated data (with all personally identifiable information removed) to evaluate and improve the quality of the Service. Individual reviews are never shared with other customers.
• You retain full ownership of your review data and the AI-generated insights associated with your account.
• Our AI processing is automated. While we strive for accuracy, AI-generated sentiment analysis should be considered as one input among many for your business decisions.

Large language models and profiling. We do not collect, use, or sell personal data for the purpose of training large language models. We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information or review data to third parties. We may share information in the following limited circumstances:

• Service Providers (Sub-processors): We work with third-party service providers who process data on our behalf to operate the Service. Our current sub-processors include Microsoft Azure (cloud hosting and storage), Stripe (payment processing), Twilio SendGrid (transactional and alert email delivery), and Anthropic, OpenAI, and Perplexity (AI sentiment, language processing, and AI Visibility analysis). These providers are contractually bound (including, where applicable, by data processing agreements) to use your data only as necessary to provide their services to us and to maintain appropriate security measures. An up-to-date list of sub-processors is available on request at privacy@brc.com.
• Legal Compliance: We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe in good faith that such disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.
• With Your Consent: We may share your information with third parties when you have given us explicit consent to do so.
• Aggregated Data: We may share anonymized, aggregated statistics about platform usage and sentiment trends that cannot be used to identify any individual user or their specific review data.

5. Review Platform Data

When you connect a review platform to TrueStanding, you authorize us to access publicly available review data from that platform on your behalf. Please note:

• We access review data through official APIs and authorized access methods where available.
• The review data we collect is limited to what is publicly visible on those platforms or what you have authorized us to access through your platform credentials.
• We do not access private customer data, payment information, or internal business data from connected review platforms.
• You are responsible for ensuring you have the right to authorize TrueStanding to access review data from your connected platforms.
• Disconnecting a review source from TrueStanding will stop future data collection from that source. Previously collected data can be deleted upon request.

6. Cookies and Tracking Technologies

TrueStanding uses cookies and similar tracking technologies to enhance your experience. For detailed information about the cookies we use, please refer to our Cookie Policy.

We use the following categories of cookies:

• Essential Cookies: Required for the Service to function properly, including authentication and session management. These are always active.
• Non-essential cookies: We do not set analytics, preference, advertising, or cross-site tracking cookies.

Managing your preferences. TrueStanding sets only essential cookies, so there are no non-essential cookies to accept or decline and we do not display a cookie consent banner. You can block or delete cookies through your browser settings, though blocking essential cookies will prevent sign-in and core features from working. We do not sell or share personal information. If we ever introduce non-essential cookies, we will update this policy and implement a consent mechanism first.

7. Your Rights and Choices

Depending on your location, you may have some or all of the following rights regarding your personal data. We do not discriminate against you for exercising any of these rights.

• Access / Know: Request a copy of the personal data we hold about you and information about how we process it.
• Correction: Request that we correct inaccurate or incomplete personal data.
• Deletion: Request that we delete your personal data, subject to certain legal exceptions.
• Portability: Request your data in a structured, commonly used, machine-readable format.
• Objection / Restriction: Object to or request that we restrict the processing of your personal data in certain circumstances.
• Withdrawal of Consent: Where we rely on consent, withdraw that consent at any time (without affecting prior lawful processing).
• Opt-Out of Marketing: Opt out of marketing communications at any time via the unsubscribe link in our emails or your notification preferences. Transactional and security messages are not marketing and may still be sent.

7.1 California Residents (CCPA / CPRA)

Notice at Collection. We collect the categories of personal information described in Section 1 (identifiers such as name and email; commercial/billing information; internet and usage activity; approximate geolocation; and the review content you connect). We collect it for the business purposes described in Section 2, retain it for the periods described in Section 9, and do not collect sensitive personal information beyond account credentials.

California residents have the right to know, access, delete, and correct their personal information, and to opt out of the “sale” or “sharing” of personal information and to limit the use of sensitive personal information. We do not sell or share your personal information or review data, and we do not use sensitive personal information for purposes that would require an opt-out. You may exercise your rights as described in Section 7.4, and you will not be discriminated against for doing so. You may use an authorized agent to submit requests on your behalf.

7.2 EEA / UK Residents (GDPR / UK GDPR)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following lawful bases: (a) performance of a contract, to provide the Service you sign up for; (b) our legitimate interests in operating, securing, and improving the Service, balanced against your rights; (c) your consent, where requested (e.g., certain cookies or marketing); and (d) compliance with legal obligations. You have the GDPR rights listed above, and you may lodge a complaint with your local supervisory authority. If you are in the United Kingdom, you may also complain directly to us at privacy@brc.com — we will acknowledge your complaint within 30 days and respond without undue delay, as provided by the Data (Use and Access) Act 2025 — or complain to the Information Commissioner's Office (ICO). Where we transfer data internationally, we rely on appropriate safeguards (see Section 10), and a Data Processing Addendum incorporating Standard Contractual Clauses is available to business customers on request at privacy@brc.com.

7.3 Other U.S. State Residents (Virginia, Colorado, Connecticut, Utah, and similar)

Residents of states with comprehensive privacy laws (including the VCDPA, CPA, CTDPA, and UCPA) have rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. We do not sell personal data or engage in targeted advertising or profiling that produces legal or similarly significant effects. Where these laws provide an appeal process, you may appeal a denied request by replying to our decision or contacting privacy@brc.com.

7.4 How to Exercise Your Rights

To exercise any of these rights, email privacy@brc.com or use the in-app account controls. We will verify your identity (typically via your account email) before fulfilling a request, and will respond within the timeframe required by applicable law (generally 30–45 days). These requests are free unless excessive or repetitive.

8. Data Security

We implement industry-standard technical and organizational security measures to protect your information, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Regular security assessments and vulnerability testing
• Access controls limiting data access to authorized personnel only
• Secure cloud infrastructure with SOC 2 compliant hosting providers
• Automated monitoring and alerting for suspicious activity

While we take reasonable measures to protect your data, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security of your information.

8.1 Data Breach Notification

We maintain procedures to detect, investigate, and respond to security incidents. In the event of a personal data breach that affects your information, we will notify affected users and the appropriate regulators without undue delay and within the timeframes required by applicable law (for example, within 72 hours of becoming aware where required under the GDPR, and as required under U.S. state breach-notification laws). Notifications will describe, to the extent known, the nature of the incident, the information involved, and the steps we are taking in response.

9. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service to you. Specifically:

• Account Data: Retained for the duration of your account. Deleting your account in the app immediately deactivates it and ends access to the Service. To have your account and its associated data permanently erased from our systems, email privacy@brc.com; we will process the request within the timeframe required by applicable law.
• Review Data: Retained for the duration of your subscription. After cancellation we stop collecting new data. Previously collected review data is erased on request — email privacy@brc.com.
• AI-Generated Insights: Retained alongside the review data from which they were derived and erased on the same request.
• Server and Error Logs: Retained for up to 12 months for security and troubleshooting, subject to our hosting provider's log-retention settings.
• Billing Records: Retained for up to 7 years as required by tax and accounting regulations.

10. International Data Transfers

TrueStanding is operated from the United States. If you access the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States where our servers are located. By using the Service, you consent to the transfer of your information to the United States. Where we transfer personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum), together with supplementary measures, to ensure your data receives an adequate level of protection. A Data Processing Addendum is available to business customers on request at privacy@brc.com.

11. Children's Privacy

TrueStanding is a business tool not intended for use by individuals under the age of 18, and it is not directed to children. Consistent with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13 (or under 18). If we become aware that we have collected personal data from a child, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at privacy@brc.com.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by posting the updated policy on this page and updating the “Last Updated” date. For significant changes, we may also send you a notification via email or through the Service. Your continued use of TrueStanding after any changes to this Privacy Policy constitutes your acceptance of the updated terms.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Baxter Research Group (BRC)
Email: privacy@brc.com
Website: https://brc.com

We will respond to all privacy-related inquiries within 30 days.