Privacy Policy — InvestorOS

Effective Date: June 1, 2026 Last Updated: May 28, 2026 Operated by: Pinnacle Holdings Group LLC

1. Introduction

InvestorOS ("we," "us," or "our") is a software-as-a-service platform operated by Pinnacle Holdings Group LLC. This Privacy Policy explains how we collect, use, disclose, and protect information when you use our platform at investoros.tech and related services (the "Service").

By using InvestorOS, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use our Service.

2. Information We Collect

2.1 Information You Provide Directly

• Account information: Name, email address, business name, phone number, billing address
• Business profile: Industry, services offered, service area, pricing information
• Payment information: Processed securely via Stripe; we do not store full card numbers
• Communications: Messages, support requests, or feedback you send us

2.2 Information Collected Automatically

• Usage data: Pages visited, features used, time spent, clicks, and interactions within the platform
• Device information: IP address, browser type, operating system, device identifiers
• Log data: Server logs including access times, error logs, and performance data
• Cookies and tracking technologies: Session cookies, preference cookies, and analytics cookies

2.3 Information from Third-Party Integrations

When you connect third-party accounts to InvestorOS, we collect data necessary to provide the service:

• Facebook and Instagram (Meta): Page name, Page ID, post performance metrics, engagement data (likes, comments, shares), Page insights, and content you authorize us to publish on your behalf. We access this data only with your explicit OAuth authorization and use it solely to provide the social media management features of the Service.
• Google Business Profile: Business name, location, reviews, Q&A posts, photos, and performance metrics from your authorized Google Business Profile.
• Telnyx / Phone Services: Phone numbers provisioned under your account, call logs (without recording call content), SMS message metadata (sender, recipient, timestamp), and delivery status.
• Airtable: Data stored in your workspace including leads, content, and business records.
• WordPress / Website Platforms: Site content, published pages, and analytics where you grant integration access.

2.4 Information About Your Customers (End-User Data)

As part of providing the Service, we process data about your customers on your behalf:

• Contact information of leads and clients (names, phone numbers, emails)
• SMS/call interaction history
• Form submissions from your website
• Lead scoring and pipeline status

You are the data controller for your customers' data. We act as a data processor on your behalf.

3. How We Use Your Information

We use the information we collect to:

• Provide and operate the Service: Process transactions, manage your account, provision phone numbers, manage hosted websites, and operate AI agents on your behalf
• Power AI Agents: Your business profile and connected data is used to configure and operate automated AI agents (content writing, lead response, SEO monitoring, social media management, etc.) as described in your subscription plan
• Social Media Management: With your authorization, schedule and publish content to your Facebook Pages and Instagram accounts, read analytics, and manage your social presence
• SMS and Phone Services: Operate AI-powered SMS lead reception and follow-up on behalf of your business using phone numbers provisioned under your account
• Billing and Payments: Process subscription payments, issue invoices, and manage plan changes
• Customer Support: Respond to your requests and provide technical assistance
• Security and Fraud Prevention: Monitor for suspicious activity and protect the integrity of the platform
• Analytics and Improvement: Understand how the platform is used and improve features (using aggregated, anonymized data)
• Legal Compliance: Meet our obligations under applicable laws

We do not use your data or your customers' data to train AI models. We do not sell your data to third parties.

4. Facebook and Instagram Data — Special Disclosure

In compliance with Meta Platform Terms, we disclose the following specific to Facebook and Instagram data:

• Data accessed: We access Facebook Page data (posts, insights, engagement metrics) and Instagram content publishing capabilities solely through the Meta Graph API using permissions you explicitly grant via OAuth.
• Purpose: Data is used exclusively to provide social media scheduling, publishing, analytics reporting, and community management features within InvestorOS.
• Storage: Facebook and Instagram tokens are encrypted at rest using AES-256-GCM. We store only the minimum data necessary to provide the service.
• Retention: Social media tokens and data are deleted within 30 days of account cancellation.
• No unauthorized sharing: We do not share your Facebook or Instagram data with any third parties except as necessary to operate the service (e.g., Buffer for scheduling, where you have authorized).
• User control: You can revoke our access to your Facebook or Instagram account at any time via your Facebook Business Settings or by contacting us.

5. SMS and Phone Communications — TCPA Compliance

InvestorOS provides AI-powered SMS communication services on behalf of our clients. By using our phone and SMS features, you agree to:

• Obtain proper consent: You are responsible for obtaining legally compliant opt-in consent from your customers before any automated SMS messages are sent on your behalf. This includes providing clear opt-in language on your website forms (we provide template language during onboarding).
• Honor opt-outs: Our system automatically processes STOP requests and removes numbers from future communications.
• Business use only: SMS features may only be used for legitimate business communications with people who have consented to receive messages.

Phone numbers provisioned through InvestorOS are registered under our A2P 10DLC brand with carriers. You must not use these numbers for spam, unsolicited marketing, or any purpose that violates the Telephone Consumer Protection Act (TCPA) or carrier guidelines.

6. How We Share Your Information

We share information only in the following circumstances:

• Service Providers: We work with trusted vendors including Telnyx (phone/SMS), Airtable (data storage), Vercel (hosting), Stripe (payments), Anthropic/OpenAI (AI processing), Buffer (social scheduling), and Hostinger (email/web hosting). These providers access only the data necessary to perform services on our behalf and are bound by data processing agreements.
• Legal Requirements: We may disclose information if required by law, court order, or government request.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
• With Your Consent: We share information with third parties when you explicitly authorize us to do so.

We do not sell your personal information to data brokers or advertisers.

7. Data Security

We implement industry-standard security measures including:

• AES-256-GCM encryption for all stored credentials and API keys
• TLS/HTTPS encryption for all data in transit
• Access controls limiting data access to authorized personnel only
• Regular security reviews and monitoring

No method of transmission or storage is 100% secure. We cannot guarantee absolute security but commit to promptly notifying you of any breach that affects your data.

8. Data Retention

• Active accounts: We retain your data for the duration of your subscription plus 90 days after cancellation (to allow data export)
• Customer/lead data: Retained for the duration of your subscription. Upon cancellation, we provide CSV export and delete within 30 days
• Billing records: Retained for 7 years as required by law
• Logs: System logs retained for 90 days

9. Your Rights

Depending on your location, you may have the right to:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data (subject to legal retention requirements)
• Portability: Receive your data in a structured, machine-readable format (CSV export available in dashboard)
• Opt-out: Opt out of marketing communications at any time

To exercise any of these rights, contact us at privacy@investoros.tech.

California Residents (CCPA): You have the right to know what personal information is collected, to delete personal information, and to opt-out of the sale of personal information. We do not sell personal information.

10. Cookies

We use cookies and similar technologies to:

• Keep you logged in (session cookies — required for service operation)
• Remember your preferences
• Understand how you use the platform (analytics)

You can control cookies through your browser settings. Disabling certain cookies may affect platform functionality.

11. Children's Privacy

InvestorOS is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us at privacy@investoros.tech.

12. International Data Transfers

InvestorOS is operated from the United States. If you access our Service from outside the US, your information may be transferred to, stored, and processed in the United States. By using the Service, you consent to this transfer.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a notice in the platform at least 14 days before the change takes effect. Continued use of the Service after changes constitutes acceptance.

14. Contact Us

For privacy-related questions, requests, or concerns:

Pinnacle Holdings Group LLC / InvestorOS Email: privacy@investoros.tech Website: https://investoros.tech Mailing: 735 E Walnut St Suite 3, Green Bay, WI 54301