Privacy Policy

1. Who we are

Omnipresent Marketing. 1420 Kettner Blvd, San Diego, CA 92101. Contact: (619) 975-1535.

This policy explains what data we collect from contractors and home service business owners who buy our products, what data we handle on behalf of paying clients, how we use it, who we share it with, and the rights you have over it. Plain English. No security theater.

2. What data we collect

Eight categories. Each one is listed below with the source and the exact fields collected.

Account and billing info (via Stripe)

If you make a payment through Stripe checkout we collect: your name, email, phone number, and billing address. Card information (number, expiry, CVV) is sent directly to Stripe and never touches our servers. We see only the last 4 digits and the card brand.

Free trial form and intake data

When you request your free trial, the form on this site collects your name, phone number, and email, and then lets you book your setup call. If you go on to work with us, a follow-up intake (handled off this website) collects the business details needed to verify a toll-free texting number in your legal business name.

Your customer list (paying clients only)

If you are a paying client, you upload (or give us access to pull) your past customer list. That typically includes: customer names, phone numbers, email addresses, service addresses, and transaction history (job type, date, ticket amount). See Section 5 for how this is handled.

Website analytics

We use Google Analytics 4 to measure page traffic and conversion, Microsoft Clarity for heatmaps and session recordings, and the Meta (Facebook) pixel to measure ad performance and build ad audiences for our own campaigns. The specific cookies and identifiers these set are listed in Section 7.

SMS opt-in records (A2P 10DLC)

When you give us your phone number for SMS communications, we log: the phone number, the consent timestamp, the IP address, the form or source that captured the consent, and the exact disclosure text you agreed to. Same applies to records we hold for clients' customers. These records exist to prove compliance with the TCPA and CTIA messaging guidelines.

Email engagement data

For emails we send through GoHighLevel, we collect opens, clicks, replies, and bounce status. This is standard email-platform telemetry and is used to measure deliverability and campaign performance.

Telegram bot interactions

Our internal alerting system pushes notifications to our team via Telegram (new purchases, support requests, system alerts). This data flow is internal to our team. No client or customer data is exposed in those messages beyond first name and the type of event (for example: "new form submission from Mike at Acme Plumbing").

Cookies on omnipresent.app

The site itself is mostly static. The only cookies that may fire on omnipresent.app today are: Stripe checkout session cookies (only on Stripe-hosted pages you redirect to), Vercel hosting session cookies (used for routing, not analytics), and any GoHighLevel form-embed cookies if you submit a form embedded from GHL. See Section 7 for the full cookies list.

3. How we use the data

Specific use per data type from Section 2:

• Account and billing info: to charge you, send receipts, and contact you about your purchase.
• Free trial form and intake data: to set up your free trial and your setup call, text you about your trial and appointment, verify a toll-free texting number in your legal business name, set up your GoHighLevel system, and stay in touch about your engagement.
• Your customer list (paying clients): only to send YOUR review requests. Period. See Section 5.
• Website analytics: to see which pages convert and which don't, so we can improve the site.
• SMS opt-in records: to prove consent to carriers, regulators, or anyone challenging a message. Retained for the active relationship plus 7 years.
• Email engagement data: to measure deliverability, identify cold or dead contacts, and trigger follow-up sequences (your campaigns if you're a client; our outbound if you're a prospect).
• Telegram interactions: internal alerting only. Not used for any external purpose.

We do not use any of this data to train AI models, build marketing audiences, or sell to data brokers.

4. SMS and phone number handling (TCPA, CTIA, and A2P 10DLC)

This section governs every phone number you give us, every phone number on a list a client uploads, and every SMS consent record we hold.

What we text, and when

Texts about your trial and appointment: when you give your phone number in the free trial form on this website, you agree to receive texts about your trial and appointment from Omnipresent Marketing. Message frequency varies. Message and data rates may apply. Reply STOP to opt out, HELP for help.

Review requests: after a job is marked complete, a client's business asks its own customer for a review by text, sent from that business's own toll-free number.

Opt-out

Reply STOP to any text message and you are opted out. Opt-out is permanent and propagated to our system, GoHighLevel, and Twilio within 24 hours. We honor opt-outs received through any reasonable method: STOP reply or phone call to (619) 975-1535.

Supported opt-out keywords: STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, OPTOUT, REVOKE.
Supported help keywords: HELP, INFO, SUPPORT.

Frequency

Message frequency varies by program. For texts about your trial and appointment, message frequency varies. For review requests, typically 1 to 3 messages per completed job: one request after the job is marked complete, then up to two follow-ups a few days apart. Follow-ups stop as soon as the customer clicks the link or replies. Message and data rates may apply.

Retention

Opt-out records are kept indefinitely so we can prove that a STOP was honored if anyone challenges it later (compliance audit, plaintiff lawsuit, carrier review). Consent records (the opt-in itself, the disclosure text shown, the timestamp, the IP) are kept for the duration of the active relationship plus 7 years.

This section satisfies the SMS data-handling content required by the CTIA Messaging Principles and Best Practices and the A2P 10DLC PrivacyPolicyUrl requirement that takes effect June 30, 2026.

5. Client customer data

If you are a paying client, the past-customer list you upload (names, phone numbers, emails, addresses, transaction history) is treated as follows:

• Used only to run your campaign. Never used for another client's campaign.
• Never sold, rented, sublicensed, shared with data brokers, or used to build look-alike audiences.
• You retain ownership at all times. Our role is processor; you are the controller.
• Full export delivered to you within 7 business days of contract cancellation.
• Our working copies are deleted within 7 business days after the export is delivered.
• Subprocessors that touch this data (GoHighLevel, Twilio) are listed in Section 6.

Section 5 of our Terms of Service also covers ownership and deletion of your customer list and applies to every client engagement.

5A. Google Business Profile data

This section applies if you connect your Google Business Profile to our review software from your customer portal. It covers what Google user data we access, why, how we store it, who we share it with, how long we keep it, and how to remove our access.

What we access

When you click Connect Google, Google asks you to sign in and approve access. We request one permission: https://www.googleapis.com/auth/business.manage. With it we access:

• Your Business Profile accounts and locations: the names of your accounts, and the name, title, and street address of each location, so you can pick the listing to connect. We save only the listing you pick (its Google account ID, location ID, and title). The rest of the list is not stored.
• Reviews of the listing you connect: for your most recent reviews, the reviewer's display name (not stored when the reviewer is anonymous), the star rating, the review text, the review dates, any owner reply, and the full review record Google returns.
• Replies: we post replies to your reviews for you. A reply is posted only when you approve it or write it in the portal, or when you have turned on automatic replies. Automatic replies are off until you turn them on. They apply only to 4 and 5 star reviews that arrive after you turn them on. Reviews of 3 stars or fewer are never posted automatically. Automatic replies post AI-drafted replies, so they can be turned on only while AI-drafted replies are on, and turning AI-drafted replies off also turns automatic replies off.

How we use it

We use Google user data only to run the review features in your portal: to show your Google reviews, write suggested replies for you if you turn on AI-drafted replies, post the replies described above, and count new reviews in the email summaries we send you. We do not sell Google user data. We do not use it for advertising. We do not use it to train AI models.

How we store and protect it

After you approve access, Google gives us a refresh token that lets our system keep working without asking you to sign in again. We encrypt that token with AES-256-GCM before we save it. The encryption key is kept outside our database. Short-lived access tokens are created when needed and are never saved. Review data is stored in our database. Our connections to Google use HTTPS.

Who we share it with

• Anthropic: only if you turn on AI-drafted replies in your portal. AI-drafted replies are off until you turn them on, and while they are off we send nothing to Anthropic. You turn them on by ticking a box next to a notice that explains what we send, and we record the time you did it. When they are on, to write a suggested reply we send the reviewer's display name, the star rating, and the review text to Anthropic, which provides the Claude AI model that drafts the reply. We also send your business name (or, if we do not have one, the part of your email address before the @) and your first name if we have it. Suggested replies are written automatically for unanswered reviews that arrive after you connect, and on request for other reviews. You can turn AI-drafted replies off at any time, and we then stop sending review data to Anthropic.
• Google: replies you approve or write, and automatic replies you turned on, are sent to Google and posted publicly on your Business Profile.

Apart from Anthropic, Google, and the service providers that host our website and database and send our emails, we do not share Google user data with anyone.

How long we keep it

• Review content: the reviewer's name, the review text, the reply text, the full review record, and any suggested reply are deleted once 30 days have passed since we last read that review from Google. We keep the star rating, the review and reply dates, Google's ID for the review, and whether it was answered, so your review counts stay correct.
• Your connection: we keep the encrypted token, the listing you picked, and your AI-drafted reply and automatic reply settings until you click Disconnect or your subscription ends. If Google stops accepting the token, we delete the token at that point.
• Activity log: we keep a record of when you connected and disconnected, including the listing's Google ID and title, and of when you turned AI-drafted replies and automatic replies on or off.

When you disconnect or cancel

When you click Disconnect, we ask Google to revoke our access, delete the stored token, and delete your connection settings. We stop reading your reviews and can no longer post replies. Review content we already hold is deleted on the 30-day schedule above.

If you cancel your subscription, we stop checking Google for new reviews. When the subscription ends, we do what Disconnect does: we ask Google to revoke our access, delete the stored token, and delete your connection settings. If Google does not confirm the revoke, we still delete the token and settings. Review content we already hold is deleted on the same 30-day schedule.

How to remove our access

• In your portal: open the Reviews page and click Disconnect.
• In your Google Account: go to myaccount.google.com/permissions, choose our app, and remove its access. The next time we try to use the connection, Google refuses it. We then delete the stored token and show Google as disconnected in your portal.

6. Third parties we share data with (data processors)

We use the following vendors to deliver our services. Each one signs (or contractually agrees via Terms) to act as a processor, use the data only for the service we've hired them for, and meet their own security and privacy obligations.

• Stripe (payment processing). Shares: name, email, billing address, card data. Purpose: charge you, store payment method, run the Customer Portal. stripe.com/privacy
• GoHighLevel (CRM, email and SMS campaign delivery). Shares: your contact info; for clients, your full uploaded customer list. Purpose: campaign orchestration, automation, reporting. gohighlevel.com/privacy-policy
• Twilio (SMS delivery and toll-free number verification). Shares: phone numbers, opt-in records, message content, and the business details needed to verify a toll-free texting number in the client's legal business name. Purpose: carrier-compliant SMS delivery. twilio.com/legal/privacy
• Google Workspace (our email infrastructure). Shares: any email correspondence with us. Purpose: email sending and storage. policies.google.com/privacy
• Vercel (hosting and DNS for omnipresent.app). Shares: standard web request logs (IP, user agent, URL). Purpose: serving the site, basic operational logging. vercel.com/legal/privacy-policy
• Cloudflare (DNS and edge protection, where applicable). Shares: standard web request metadata. Purpose: DDoS protection, DNS resolution. cloudflare.com/privacypolicy
• Telegram (internal alerts to our team only). Shares: event metadata in alert messages (purchase event, contact first name, event type). Purpose: real-time notifications. telegram.org/privacy

As required by the CTIA messaging guidelines and the June 30, 2026 A2P 10DLC requirement, none of these processors receive SMS opt-in data or phone numbers for the purpose of marketing to those numbers on behalf of any other party. The data is used only to deliver the messages the consumer agreed to receive.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. The above excludes text messaging originator opt-in data and consent; this information will not be shared with any third parties.

7. Cookies and tracking on omnipresent.app

Here is the full list. The tracking that runs on omnipresent.app today:

• Google Analytics 4 (cookies: _ga and _ga_*). Used for aggregate traffic and conversion measurement.
• Meta (Facebook) pixel (cookie: _fbp). Used to measure our ad performance and build ad audiences for our own campaigns, including retargeting of site visitors.
• Microsoft Clarity (cookies: _clck and _clsk). Used for heatmaps and session recordings so we can improve the site.
• Stripe checkout cookies (only on stripe.com pages you are redirected to during checkout). Used for fraud prevention and session state.
• Vercel session cookies. Set by our hosting provider for routing and basic operational use, not for tracking individuals across sites.
• GoHighLevel form-embed cookies (only if you submit a form that is embedded from our GHL workspace). Used to associate your submission with your contact record.

You can opt out of this tracking with standard browser controls (blocking third-party cookies, ad blockers), through Meta's Ad Preferences for the pixel, or by calling the number in Section 8 with a privacy request.

8. Your privacy rights

You have the following rights over data we hold about you:

• Right to know what personal information we hold about you, where we got it, and who we shared it with.
• Right to delete your personal information.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell personal information. Our use of the Meta pixel for ad measurement and ad audiences may count as "sharing" for cross-context behavioral advertising under the CCPA; you can opt out by calling the number below with a privacy request, or through Meta's Ad Preferences.
• Right to non-discrimination for exercising any of the rights above.

How to exercise these rights: call (619) 975-1535 and tell us it's a privacy request. We verify your identity by calling the phone number on file (or, for non-customers, by asking 2 verifying details). We respond within 45 days.

California residents (CCPA / CPRA)

Categories of personal information we have collected in the last 12 months, mapped to the categories defined in California Civil Code Section 1798.140:

• Identifiers: name, email, phone, billing address, IP address.
• Customer records / commercial information: purchase history, transaction records, products purchased.
• Internet or other electronic network activity: page views on omnipresent.app, email opens and clicks.
• Geolocation data: approximate (city-level) from IP address only. No precise GPS.
• Professional or employment-related information: for clients: business name, EIN, role.
• Inferences: none drawn for profiling purposes.
• Sensitive personal information: none collected.

Do we sell personal information? No.

Do we share personal information for cross-context behavioral advertising? Our use of the Meta Pixel for ad measurement and ad audiences may count as "sharing" under the CCPA. You can opt out through Meta's Ad Preferences or by calling the number below with a privacy request.

Do we use sensitive personal information to infer characteristics? No.

This page also serves as our Notice at Collection under CCPA section 7012. The categories collected and purposes are described in Sections 2 and 3 above.

9. International users

Omnipresent is a U.S.-based business serving U.S. contractors and home service businesses only. We have not appointed an EU or UK GDPR Article 27 representative. If you are located outside the United States, please do not submit personal data to us. We do not knowingly accept signups from outside the U.S.

10. Children

This service is directed at contractor and home service business owners (adults). We do not knowingly collect personal information from anyone under 16 years old. If you believe a minor has submitted personal information to us, contact us at (619) 975-1535 and we will delete it.

11. Security

The plain truth on security posture:

• Cardholder data: handled entirely by Stripe (PCI DSS Level 1). We never see full card numbers.
• CRM and campaign data: handled by GoHighLevel (SOC 2 Type II).
• SMS delivery and consent records: handled by Twilio (SOC 2, ISO 27001).
• In transit: all traffic to omnipresent.app and to our processors uses TLS.
• Access: Only authorized Omnipresent team members can access client systems. Sub-account access for contractors (when used) is scoped and revoked when work ends.
• Passwords: where applicable, hashed using the underlying platform's standard hashing (Stripe, GHL, Vercel handle this).

No system is unbreakable. If we ever have a breach affecting your data, you will be notified within the time limits required by California law (no later than 30 days after discovery for most cases).

12. Changes to this policy

We will email any material change to the billing address on file at least 30 days before it takes effect. Non-material updates (typos, clarifications, new processor added to the list, links updated) are made silently with the "Last updated" date at the top of this page revised.

13. Contact

(619) 975-1535 · support@omnipresent.app · San Diego, CA