Privacy Policy

• Account details: your name, email address and password. Passwords are stored as a hash, never as plain text. If you turn on two-step sign-in, we store its secret in encrypted form.
• Sign-in with Google or your company's single sign-on: your name, email address and whether that email is verified, as sent to us by that provider.
• Brand details: the websites, handles, products, executives, competitors, keywords and feeds you ask PoppyPR to track, and the contact lists you set up for alerts.
• What you write in the app: questions to the AI assistant, notes, drafts and outreach messages, including replies that arrive in your outreach inbox.
• Free reputation check: the website or handle you enter.
• Messages to us: what you send through the contact form, by email or when booking a call.
• Payment details: handled by Stripe. We receive your plan, payment status and billing contact, but never your full card number.

• Technical data such as your IP address, browser type and the time of each request. We use it to keep the service secure, to limit how many free checks one address can run, and to fix problems.
• If you accept optional cookies, information about how you use the site, collected through PostHog and Google Tag Manager.

To do its job, PoppyPR collects publicly available content: news articles, RSS items, posts on Reddit and X, YouTube videos and public reviews. That content can include personal information about the people who wrote it or who are named in it, such as a username or a quoted comment.

We use this content only to show our customers what is being said publicly about the brands they track, and to analyze it. If you are named in content shown in PoppyPR and want to ask about it, contact us using the details at the end of this policy.

• To provide the service: finding mentions, analyzing them, sending alerts and reports, and producing recommendations and drafts.
• To create and secure your account, and to verify your email address.
• To take payments and manage your plan.
• To send service emails, such as alerts, receipts, password resets and important notices.
• To answer your questions and give you support.
• To understand how the service is used and to improve it.
• To prevent abuse and fraud, and to meet our legal obligations.

Where the law asks for a legal basis, we rely on our contract with you, our legitimate interest in running and improving a secure service, your consent for optional cookies, and our legal obligations.

PoppyPR uses AI models to read mentions and to write summaries, recommendations and drafts. To do that, we send the relevant text to AI model providers through OpenRouter. That text includes public mentions, your brand details and what you write to the assistant.

We always use the cookies needed to keep the site working and keep you signed in. We also remember your cookie choice in your browser.

PostHog and Google Tag Manager, which help us see how the site is used and measure our marketing, load only if you accept optional cookies. You can change your choice at any time with the "Cookies and privacy choices" link at the bottom of every page. If your browser sends a Global Privacy Control signal, we treat it as a no.

We do not sell your personal information. We share it only with:

• Service providers that process it for us: Stripe (payments), Resend (email), OpenRouter and the AI model providers it routes to (AI analysis), Context.dev (reading business websites), Cal.com (booking calls), our hosting provider, and, with your consent, PostHog and Google (analytics and marketing tags).
• The sources we search, such as Reddit, X, YouTube, Google and Trustpilot, which receive the search terms needed to find mentions of the brands you track.
• Your team: people in your PoppyPR organization can see the brands, mentions and drafts in it.
• Integrations you connect: when you link another service, we send it the information needed for that integration to work.
• Authorities or other parties where the law requires it, or where it is needed to protect our rights, our customers or the public.
• A buyer or successor if Mosco Holdings LLC is involved in a merger, sale or reorganization. This policy would continue to apply to your information.

We keep your account information for as long as your account is open. If you ask us to close your account, we delete or anonymize your personal information within a reasonable time, except where we need to keep it for legal, tax or security reasons, such as billing records.

We protect your information with measures such as encrypted connections, hashed passwords, encrypted secrets, optional two-step sign-in and limited staff access. No online service can be made completely secure, so we can't guarantee absolute security.

Depending on where you live, you may have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct or delete it;
• object to or restrict some uses of it;
• receive it in a portable format;
• withdraw consent you have given, such as for optional cookies;
• complain to your local data protection authority.

You can change your organization's details in the app's settings and reset your password from the login page. For anything else, contact us using the details below. We may need to confirm your identity first, and we won't treat you differently for using these rights.

We and our providers process information in the United States and in other countries where they operate. Those countries may have different data protection laws from the one you live in.

PoppyPR is for businesses and adults. It is not intended for anyone under 18, and we don't knowingly collect personal information from children.

We may update this policy. When we do, we'll change the date at the top of this page, and for significant changes we'll let you know by email or in the app.

PoppyPR is owned and operated by Mosco Holdings LLC. For privacy questions or to use your rights, contact us through mosco.holdings.