Privacy Policy — ViolationIQ

This Privacy Policy explains how ViolationIQ LLC (“ViolationIQ,” “we,” “us,” or “our”) collects, uses, stores, and shares personal data when you use our website, AI analysis tools, and related services (the “Service”).

1. Who we are

ViolationIQ LLC is the data controller for the personal data processed through the Service. We operate an AI-powered platform that helps US restaurant owners understand and respond to health department inspection notices.

If you have questions about this Privacy Policy or your data, contact us at: support@violationiq.com.

2. What personal data we collect

We collect the following categories of personal data:

Account information: name, email address, password hash, and any profile details you provide.
Restaurant information: restaurant name, address, jurisdiction, cuisine type, and establishment size.
Case documents: uploaded health inspection notices, citations, photos, and any other documents you submit for AI analysis.
Usage data: IP address, browser type, device information, pages visited, and feature interactions.
Support data: messages, tickets, and communication history with our support team.
Payment data: we do not store full payment card details. Payment transactions are processed by our Merchant of Record, Paddle, which collects billing information in accordance with its own privacy policy.

3. How and why we use your data

We process personal data for the following purposes:

Provide the Service: authenticate you, analyze uploaded inspection notices, generate assessments, and create appeal letters and deadline reminders.
Customer support: respond to inquiries, troubleshoot issues, and improve your experience.
Billing and subscriptions: manage payments, renewals, and cancellations through Paddle.
Security and fraud prevention: detect abuse, unauthorized access, and payment fraud.
Product improvement: understand how the Service is used and improve AI accuracy, features, and reliability.
Legal compliance: comply with applicable laws, regulations, and lawful requests.

4. Legal basis for processing

We process personal data on one or more of the following legal bases:

Contract performance: processing necessary to provide the Service you signed up for.
Legitimate interests: improving the Service, ensuring security, and preventing fraud.
Consent: where you have explicitly agreed, for example to marketing communications.
Legal obligation: where required by law, regulation, or court order.

5. Who we share data with

We share personal data only with the categories of recipients necessary to operate the Service:

Service providers: hosting, cloud infrastructure, analytics, error monitoring, email delivery, and customer-support tools.
Merchant of Record — Paddle: Paddle.com processes payments, subscription management, tax compliance, and invoicing on our behalf. Paddle is the Merchant of Record for all orders placed through the Service.
Professional advisers: legal, accounting, and insurance providers when necessary.
Authorities: when required by law, subpoena, or to protect our legal rights.

6. Data retention

We retain your personal data for as long as your account is active or as needed to provide the Service. After account closure, we delete or anonymize personal data within a reasonable period, except where we are required to retain it for legal, tax, or security purposes.

Uploaded case documents are retained while your account is active so you can access your violation history and appeal letters. You may request deletion of specific documents at any time.

7. Your rights

Depending on your location, you may have rights including:

Access the personal data we hold about you.
Correct inaccurate or incomplete data.
Request deletion of your data.
Restrict or object to certain processing.
Receive a copy of your data in a portable format.
Withdraw consent where processing is based on consent.

To exercise these rights, contact us at support@violationiq.com. We aim to respond within one month.

8. Security

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit and at rest, access controls, and regular security reviews. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Cookies and analytics

We use essential cookies to operate the Service and optional analytics cookies to understand usage. You can manage cookie preferences through your browser settings. Analytics cookies help us improve the Service but are not required for core functionality.

10. International transfers

ViolationIQ is based in the United States. If you access the Service from outside the US, your data may be transferred to and processed in the US. We use appropriate safeguards, such as standard contractual clauses where required, to protect data transferred internationally.

11. GDPR rights for UK and EEA users

If you are located in the United Kingdom or European Economic Area, you have the rights listed above, including the right to lodge a complaint with your local supervisory authority. We process your data as described in this policy and respond to requests within one month.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service. Continued use of the Service after changes means you accept the updated policy.