Privacy Policy

TwoTop (the "Service"), operated by Parallax Strategies ("we," "us"), is a review-intelligence platform for restaurant operators. It collects publicly available reviews of our customers' business locations, helps draft and publish replies, and surfaces operational analytics. This policy describes what we collect, how we use it, and the choices you have. The Service is a business tool; our customers are companies, and the "you" in this policy is primarily the people who operate accounts on their behalf.

Account data. When you create an account we collect your name and email address through Clerk, our authentication provider, along with authentication identifiers and your role within your organization.

Business data. Brand names, location names and addresses, platform identifiers (such as a Google Place ID or Yelp business URL), brand voice preferences, and other configuration you provide.

Public review data. For the locations you submit, we collect publicly available reviews from review platforms: review text, star ratings, posting dates, the reviewer's public display name and public profile photo URL, and any owner replies. Where a review mentions a staff member or menu item by name, our analysis may extract that mention (for example, a first name and whether the mention was positive) to power staffing and menu analytics.

Point-of-sale data. If you connect a Square account, we collect order summaries (amounts, taxes, tips, timestamps, and dining options — not customer names, payment card details, or other diner information) and labor data (employee names, roles, and shift times) to power sales and labor analytics.

Usage data. Server logs, request identifiers, and application error reports used to operate, secure, and debug the Service.

If you connect your Google Business Profile, we request the business.manage scope so the Service can list the business accounts and locations you manage and, when you approve a drafted reply, publish that reply to your Google Business Profile on your behalf. We store the Google account identifier, location metadata (names, addresses, place IDs), and OAuth tokens. Tokens are encrypted at rest with AES-256-GCM and are never written to logs.

We use Google user data only to provide these user-facing features. We do not sell it, do not use it for advertising, do not use it to train AI or machine-learning models, and do not share it with third parties except the infrastructure subprocessors listed below as needed to operate the Service. You can disconnect Google at any time in Settings — disconnecting immediately deletes your stored tokens — or revoke access from your Google account permissions page.

TwoTop's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use third-party AI models to classify reviews (themes, sentiment, urgency) and to draft suggested replies. Review text, ratings, and the reviewer's public display name are processed by our AI provider (listed under subprocessors below) for this purpose; it does not use data submitted through its API to train its models. AI-drafted replies are suggestions: a person on your team reviews and approves them before anything is published.

We use the information described above to operate the Service: aggregating reviews, generating draft replies, computing analytics and alerts, sending service notifications (such as critical-review alerts), securing and debugging the platform, and complying with legal obligations. We may use aggregated, de-identified data to improve the Service.

We do not sell personal information, and we do not share it for advertising. We rely on the following providers, each of which handles data only as needed to perform its function:

• Clerk — authentication and session management
• Anthropic — AI review classification and reply drafting
• Apify — collection of publicly available review data
• Google — Business Profile integration (when you connect it)
• Square — point-of-sale integration (when you connect it)
• Resend — transactional and alert email
• Sentry — application error monitoring
• Vercel — web hosting
• Railway — API hosting
• Neon — database hosting
• Cloudflare — content delivery and image storage

We may also disclose information if required by law or to protect the rights, safety, or property of TwoTop, our customers, or others.

We retain account and business data for as long as your account is active. When you close your account or submit a verified deletion request, we delete your data from production systems within 30 days; residual copies in encrypted backups expire on a rolling basis within a further 30 days. Disconnecting an integration (Google or Square) deletes the associated access tokens immediately. Aggregated, de-identified data may be retained.

Depending on your jurisdiction, you may have the right to access, correct, delete, or receive a copy of your personal information. Contact us at privacy@parallaxstrategies.ai and we will respond within the timeframe required by applicable law.

If you are a reviewer whose public review appears in the Service and you would like it removed from our systems, contact us at the same address. Note that we collect reviews from public platforms, so removing a review at its source is handled by that platform.

We use only the cookies essential to operating the Service, including authentication session cookies. We do not use marketing or advertising cookies.

The Service is not directed to children under 16 and we do not knowingly collect their data.

We use industry-standard administrative, technical, and physical safeguards, including encryption in transit, encryption of integration credentials at rest, and role-based access controls. No system is perfectly secure, and we cannot guarantee absolute security.

We may update this policy from time to time. Material changes will be communicated via email or an in-app notice.

For questions, contact privacy@parallaxstrategies.ai.