This Privacy Policy is provided by El Hassane, located at RUE 08 N 02 RDC LOT IZDIHAR, BERRECHID, MOROCCO (“Invorant,” “we,” “us,” or “our”), and describes how we collect, use, and protect information when you use our Google Business Profile scanning and reporting platform (the “Service”). This Policy is effective as of August 29, 2026.

We collect the following categories of information:

• Account information— first name, last name, email address, and password (your password is managed entirely by our authentication provider, Supabase; Invorant's own systems never receive or store it in plain text).
• Organization/workspace information — the name of any workspace (organization) you create or join, your role within it (owner, admin, or member), and, if you invite teammates, the email addresses you invite.
• Google Business Profile data — if you connect and import a business, as described in Section 3.
• Subscription and billing information — described in Section 5.
• Usage and security information — IP address, browser/device user agent string, and timestamps of account and security-relevant actions (sign-in, password reset, Google connection, subscription changes), recorded for fraud prevention, abuse prevention, and account security.
• Report content — the scan results Invorant generates for businesses you connect (health scores, review analysis, and recommendations), stored so you can view your report history.
• Lead and marketing information — if you request a downloadable guide or similar resource through a form on our site, the name, email address, and any business details you submit (company, website, industry), together with a record of your consent to receive that resource and related emails and the date that consent was confirmed.

Invorant offers a Google Business Profile connection used to discover and import your business locations and run scans. This uses a standard Google OAuth 2.0 authorization, requesting the business.manage scope (Google does not offer a narrower, read-only scope for these APIs, though Invorant only ever reads business data — it never writes or publishes changes to your Google Business Profile).

The resulting access token, refresh token, and token expiry are stored server-side and are never sent to your browser or exposed in any client-facing response. Business data retrieved through this connection — business name, address, category, store code, and open/closed and verification status — is stored so Invorant can identify and import your locations.

Separately, to generate your scan reports, Invorant also retrieves publicly available information about your business — including ratings, reviews, and photo metadata — directly from the Google Places API. This is independent of the Google Business Profile connection above: it does not use your Google account authorization, and it is the same public data anyone could look up for your business on Google.

You can disconnect the Google Business Profile connection at any time from Settings.

Invorant uses two third-party payment processors: Stripe and Paddle. Depending on when and how you subscribed, your payment may be processed by either one. Payments made through Paddle are processed by Paddle, which acts as the merchant of record for those transactions. In neither case does Invorant's own systems receive, transmit, or store your card number or other raw payment credentials — that is handled entirely by whichever processor handles your payment.

Invorant stores only your subscription plan, status, which processor you are billed through, and the processor-assigned customer and subscription identifiers needed to manage your billing relationship.

Invorant uses a small number of strictly necessary cookies: a session cookie (set by our authentication provider, Supabase) that keeps you signed in, and a short-lived, security-purpose cookie used only during the Google OAuth connection flow to prevent cross-site request forgery. Both are essential to the Service functioning and cannot be disabled while remaining signed in.

Invorant does not use advertising cookies or third-party tracking cookies, and does not have an analytics or telemetry service actively running in production today. If that changes, this Policy will be updated to describe it before it goes live.

Application data is stored using Supabase (database and authentication infrastructure), and the application itself is hosted on Vercel.

We retain your account and workspace data for as long as your account remains active. If you request deletion of your account (see Section 9), we will delete or anonymize your personal data within a reasonable period, except where we are required to retain certain records by law — for example, billing records for accounting or tax purposes.

Invorant applies technical safeguards including encrypted connections (HTTPS) for all traffic, Row Level Security enforced at the database layer so one workspace's data is isolated from another's, rate limiting on sensitive actions (sign-in, sign-up, password reset), and an immutable audit log of security-relevant account events.

No method of transmission or storage is completely secure, and we cannot guarantee the absolute security of information you send to the Service.

Invorant relies on the following third-party services to operate:

• Google — Business Profile connection and Places API (Section 3).
• Stripe — payment processing, subscription billing, and invoicing for subscribers billed through Stripe (Section 5).
• Paddle — payment processing, subscription billing, and merchant-of-record services for subscribers billed through Paddle (Section 5).
• Supabase — authentication and database infrastructure.
• Vercel — application hosting.
• Anthropic— some report features (for example, suggested review replies or business descriptions) send relevant business or review content to Anthropic's AI models to generate suggested text, which you review before using.
• Brevo — email marketing and automation. If you submit a form on our site to request a guide or similar resource, the details described in Section 2 are sent to Brevo so it can email you a confirmation request and, once you confirm, deliver the resource and related communications. Every marketing email includes an unsubscribe link you can use at any time.

Marketing emails operate on a double opt-in basis: you are not added to our marketing list or treated as a confirmed subscriber until you click the confirmation link Brevo sends you. If you never confirm, your address is not added to the list.

You can review and update your account information from Settings at any time, disconnect your Google connection at any time, and delete a workspace you own from Workspace Settings.

To request deletion of your account and the personal data associated with it, email support@invorant.com. We will verify your request and complete the deletion within a reasonable time, except for data we are required to retain by law.

Questions about this Privacy Policy or how your data is handled can be sent to support@invorant.com, or by mail to El Hassane, RUE 08 N 02 RDC LOT IZDIHAR, BERRECHID, MOROCCO.