Privacy Policy

This Privacy Policy describes how Prism AI Apps LLC (“we,” “us,” or “our”) collects, uses, discloses, and protects information in connection with quickCLIENT.ai (the “Service”). It is part of, and incorporated into, our Terms of Service. By creating an account or using the Service, you agree to this Policy. If you do not agree, do not use the Service.

1. Our roles: who controls what

The Service lets you store information about your own clients and contacts (“Client Data”). For that Client Data, you are the controller (you decide what to collect and why) and we are a processor acting on your instructions. For your own account and usage information (for example, your email, profile, and log data), we act as the controller. You are responsible for having the rights and consents needed to collect and store Client Data, as described in our Terms of Service. If you use the Service on behalf of a business to process personal data about your clients, our Data Processing Addendum describes the commitments we make as your processor.

2. Information we collect

Information you provide.

• Account information: your email address and login credentials.
• Profile / Business Card: details you add to your shareable card, such as your name, company, title/profession, phone, email, website, city/state, photo, specialties, and bio, plus your unique QuickClient Code.
• Your Content: notes and their transcripts, images, PDFs, documents, reminders, to-dos, tags, and events, and any text within them. When you record a voice note — or record a meeting or call using the meeting feature, or talk through a site using the Walkthrough feature — we transcribe it to text and do not store the underlying audio recording after transcription; only the transcript is kept, as a note on the relevant client. In the QuickClient mobile app, meeting audio is stored temporarily and encrypted on your device until each part is transcribed and confirmed saved, then deleted. These parts are securely transmitted to QuickClient and our transcription provider solely to create the transcript. Unfinished uploads may remain encrypted on your device for up to seven days so the meeting can be recovered. A Walkthrough also saves the photos you take (and, if you enable it, their location, described below) to that client’s record; the resulting report is shared only when you choose to export or save it — we never send it to your client for you. You are responsible for obtaining any consent the law requires before recording or photographing anyone.
• Client Data: the names, phone numbers, email addresses, and other details of your clients, prospects, and contacts that you choose to enter, capture, or upload.
• Contacts you import (optional): if you use Import from your phone, you choose people from your device’s contacts, and only the people you select — their names, phone numbers, email addresses, and the other contact details shown to you before you import — are sent to quickCLIENT.ai and saved as records in your account. On Android the app asks for contacts permission so it can show your address book on your device; it does not upload anyone you don’t select, and it does not read your contacts in the background. On iPhone you choose people in Apple’s contact picker, and the app receives only those people. Imported people are Client Data: you can undo an import for 7 days after it finishes, and delete any imported person at any time.
• Location data (optional): if you use the Walkthrough feature and grant location permission, we attach your device’s location to each photo you take during that walk, so you can see where on a site a photo was captured. This is optional — deny or turn off location and photos are saved without it — and we do not track your location continuously or in the background. A photo’s location is stored with the photo and deleted when you delete the photo or the walkthrough.

Connected Google Calendar (optional). If you choose to connect a Google account in Settings → Connections, you sign in with Google and grant quickCLIENT.ai the calendar permissions shown on Google’s consent screen. Nothing is connected unless you do this, and you can disconnect at any time in Settings → Connections or from your Google Account.

• What we read. The list of your calendars (names, colors and your access level) and the events on them — title, start and end time, location, attendees (names, email addresses and responses) and the event’s link — so we can show them in quickCLIENT.ai next to your clients. Google tells our servers when your calendar changes so the copy in quickCLIENT.ai stays current. We do not store event descriptions, and we do not read Google Tasks, contacts or anything outside your calendars.
• What we change. Only what you ask for: when you create, edit, reschedule or cancel an event in quickCLIENT.ai, we make that change in your Google Calendar. Google may then notify the event’s guests, as it would if you made the change in Google Calendar yourself.
• No AI, no advertising, never sold. Calendar data is never sent to AI services, never used to train AI models, never used for advertising, and never sold.
• Access tokens. The access and refresh tokens Google issues are encrypted at rest with a key kept separately from our database and used only on our servers (never sent to your browser).
• If your access ends. If you no longer have access to the calendar feature (for example, your subscription lapses), we stop synchronizing your calendar and you can’t create or change events from quickCLIENT.ai until access is restored. When you disconnect, or delete your account, we revoke quickCLIENT.ai’s access at Google and delete the stored calendar data and tokens immediately.

Google user data — Limited Use. quickCLIENT.ai’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we use Google user data only to provide the features you turn on and can see in quickCLIENT.ai; we do not transfer it to others except as necessary to provide those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you; we do not use it for advertising, including personalized or interest-based advertising; and no person reads it unless you give us permission to (for example, for support), it is necessary for security purposes such as investigating abuse, it is necessary to comply with applicable law, or it has been aggregated and anonymized for internal operations.

Information collected through referrals and prospect capture — see Section 6 for detail — including referral provenance (which client a captured lead came from) and information a prospect submits to you through a shared capture link, a client-shared “Refer me” link, QR profile card, or a public Campaign landing page.

Campaign activity. When you run a Campaign, we record aggregate interaction events on its public pages — scans, flyer downloads, and form submissions, together with a truncated IP prefix used only for rate-limiting and abuse prevention — so you can see how the campaign is performing. Details a prospect submits on a Campaign page (name and an email or phone) are stored to your account as Client Data and are visible only to you.

Email nudge (optional). If you turn on the email nudge, you set up your own mailbox to forward messages from your clients to a unique address we give you. We record only the sender’s email address, the subject line, and the time received — we do not read or store the body of the message — so we can flag on your home screen that a client may be waiting for a reply. You control this: it works only for the addresses you choose to forward, and you can turn it off at any time by removing the forwarding rule in your mailbox.

Waitlist and marketing. If you join the waitlist on our marketing site, we collect your email address and, if you provide it, the industry you work in, so we can notify you about availability and updates. You can ask us to remove you at any time by contacting support@quickclient.ai.

Information collected automatically. Basic technical and usage data needed to operate and secure the Service, such as log data, device and browser type, IP address, and timestamps. This includes limited first-party usage signals from both our marketing pages and the signed-in app — for example, which pages or screens are viewed and basic interaction counts — recorded by us to operate and improve the Service. These first-party signals are not shared with advertisers and are not used for cross-site tracking; on the marketing site we additionally use Google Analytics (Section 4), while the signed-in app uses no third-party analytics. We use only essential cookies and local storage required for authentication and app preferences; we do not use advertising or cross-site tracking cookies. See Section 15 for the specific cookies and storage we use.

Push notifications (optional). If you turn on notifications, we register a push token or subscription for your device or browser so we can deliver the reminders you asked for. The token identifies the device to notify, not you, and you can revoke it any time by turning notifications off. Delivery goes through the platform’s push service (Apple, Google, or your browser’s web-push service) — see Section 4.

Device permissions (optional). Some features ask your device for access: the microphone (to record audio we transcribe), the camera (to take photos during a Walkthrough), location (to note where a Walkthrough photo was taken), and, on Android, contacts (to show your address book when you import people from your phone). You grant these through your device and can revoke them at any time in your device settings; a feature that needs a permission you’ve denied simply won’t run. We access these only while you’re actively using the feature.

Text-message (SMS) verification codes (optional). Two-factor authentication is required on your account, and the default second factor is a code sent to your own email — no phone number is needed. If you separately choose to turn on text-message codes, you add and confirm your own mobile number in your account settings (Profile → Text-message codes); from then on we send a one-time sign-in code by SMS when you sign in or re-verify your identity. This is strictly opt-in and used only to authenticate you — never for marketing. Message frequency depends on your own sign-in activity (typically one code per sign-in on a new device), and message and data rates may apply. You can turn it off at any time by removing your number in settings or by replying STOP to a message; reply HELP for help. Your number is used only to deliver these codes through our SMS provider (Section 4).

Help and support questions (product help only). When you type a question into in-app Help or contact support, we store the question text, the app area you were on, your plan, and device type so we can answer you and improve our help content. In-app Help answers only how to use quickCLIENT.ai — it does not read your notes, documents, or other Client Data, and we do not store client data with your question.

2A. Categories of personal information (California)

For California residents, the categories of personal information we collect, why, and where they go. We do not sell or share (for cross-context behavioral advertising) any category, and none is disclosed for those purposes.

Sources: you and your use of the Service; your device (with permission); and prospects who submit their details to you. Who we disclose to for a business purpose: the service providers (Sub-Processors) listed in Section 4. Retention: by category, as described in Section 9. Sensitive personal information: the only sensitive category is precise geolocation, collected only with your consent and used only to place your Walkthrough photos — see Section 11.

3. How we use information

We use information to: provide and maintain the Service; transcribe audio, extract text from images and PDFs, generate summaries and key facts, and power search and question-answering; create and deliver reminders; capture referrals and prospect details you collect; secure accounts and prevent abuse; provide support; process and manage subscriptions if you have a paid plan; and comply with legal obligations. We do not sell your personal information, and we do not use the content of Your Content or Client Data to serve advertising.

What we compute versus what we store. Some of what you see is worked out at the moment you look at it and is not kept. Relationship views (for example, whether you are currently working with a client or have lost touch) and stage suggestions are calculated from your own notes and contact dates each time a page loads, shown to you, and discarded — we do not store them, build a profile from them, or share them. Values we do store about a client are ones you entered or confirmed yourself, together with the AI-generated summaries and key facts described above, which are derived from Your Content and kept with the client record until you delete it.

Product improvement (optional, opt-in). The Service always learns from your own corrections — the edits you make to transcripts, summaries, and suggestions — to improve your own experience; that stays within your account. Separately, and only if you opt in (this is off by default), we use a pooled, de-identified set of those corrections to improve suggestion quality for professionals like you. Before pooling we strip identifiers, we do not include the content of Your Content or Client Data, and we never share your client details. You can turn this on or off at any time in Settings → Privacy & data; turning it off stops any further use of your corrections for this purpose.

4. AI processing and service providers (Sub-Processors)

To deliver core features, information is processed by trusted third-party providers. Most of them act only on our instructions to provide the Service (our processors). A few also handle limited data as independent controllers under their own privacy policies — notably our payment processor (Stripe), for payment and fraud-prevention compliance, and our website-analytics provider (Google Analytics), for aggregate audience measurement on our marketing pages. Our current providers, by the service they perform, are named below. We update this Policy and its date when this list changes:

• AI processing — OpenAI. Transcription (speech to text), image/PDF text extraction, summaries, and embeddings for search. Content sent to this provider is, per its API terms, not used to train its models.
• Cloud database and file storage — Supabase and Cloudflare R2. Supabase hosts the database, authentication, and file storage for your notes, files, and metadata; Cloudflare R2 holds object storage and encrypted backups.
• Application hosting and delivery — Vercel. Running and serving the Service.
• DNS, content delivery, and security — Cloudflare. Protecting and delivering the Service’s traffic.
• Email delivery — Google Workspace (SMTP). Sending account and notification emails to your own address (sign-in codes, email-change confirmations, reminders you asked for), and processing messages you send to our support address. We do not send email to your clients on your behalf: when you follow up or share a document, the message opens in your own email app, so it goes from your address and lands in your Sent folder.
• Connected calendar (only if you connect it) — Google. If you connect a Google account, we exchange data with Google through the Google Calendar API to show and change your calendar events, as described in Section 2. Google processes this data as your own account provider, under its own terms and privacy policy.
• Inbound email processing (optional). If you enable the email nudge, an inbound email-routing provider receives the messages you forward — which can include the full message — and posts them to us. From each message we store only the sender address, the subject line, and the time received; we never read or store the message body. (The specific routing provider depends on our email configuration.)
• SMS delivery — Twilio (only if enabled). If you turn on text-message two-factor authentication, sending one-time sign-in verification codes by text message to your own mobile number. The provider receives your number and the code needed to deliver the message, and is contractually barred from using them for any other purpose.
• Payment processing — Stripe. Subscription billing, if you purchase a paid plan. All billing happens on the web; the mobile apps do not sell subscriptions or process payments. Stripe also acts as an independent controller of payment data for fraud prevention and financial-compliance purposes, under its own privacy policy.
• Push-notification delivery — Apple and Google. To send the reminders you turn on, we pass a device or browser push token and the notification to the platform’s push service (Apple’s APNs, Google’s Firebase Cloud Messaging, or your browser’s web-push service). They receive the token and message needed to deliver the notification, not your account content.
• Error monitoring — Sentry. When the Service hits a fault, a diagnostic report (the error, where in the code it happened, and the browser or server type) is sent to Sentry so we can fix it. Before these reports leave the Service we filter them to reduce personal information: we remove request bodies, cookies, and headers, strip query strings from URLs, drop the account identifier, remove local variables from stack traces, and mask email addresses and phone numbers in error text. This filtering substantially reduces, but cannot guarantee the removal of, every possible sensitive detail an error might happen to contain. We do not record or replay your screen.
• In-app help and support (AI-assisted) — OpenAI. Answers your product-help questions in the app, grounded in approved help content. It does not access your Client Data; the question text you submit is stored to answer you and improve our help content (see Section 2).
• Website analytics — Google Analytics. On our public marketing pages only (not the signed-in app and never your Client Data), Google Analytics measures aggregate visits and how the pages are used, using cookies and standard device/usage signals. It helps us understand which pages are working; it does not identify you to us, and it acts as an independent controller under its own privacy policy. Google Analytics runs on the marketing site only — the signed-in app does not load Google Analytics or any third-party tracker. (The app does record limited first-party usage signals of its own; see “Information collected automatically” in Section 2.)

These providers are bound to use information only to provide services to us. We do not sell or rent personal information to third parties. Our current subprocessors are also maintained on a dedicated Subprocessor List, and business customers who process client personal data through the Service can review our processor commitments in our Data Processing Addendum.

As the Service grows, we may engage additional providers in the following categories. We will update this Policy and its date when we do:

• Product analytics — to understand how features are used and improve the Service.

5. How we share information

We share information only as follows: with the Sub-Processors above; to comply with law, enforce our Terms, or protect the rights, safety, and security of users, the public, or us; in connection with a merger, acquisition, financing, or sale of assets (with notice where required); and otherwise with your consent. We do not “sell” or “share” personal information for cross-context behavioral advertising as those terms are defined under California law.

Text-messaging (SMS) consent is never shared. If you turn on text-message verification codes, we do not share or sell your mobile phone number, your SMS opt-in, or your text-messaging consent with any third party, and we do not disclose them to anyone for their own marketing or promotional purposes. Your number is disclosed only to our SMS delivery provider (Section 4) for the single purpose of sending the sign-in codes you asked for.

6. Referrals and prospect capture

The Service lets your clients refer new people to you and lets prospects share their details with you. Because this involves information about other people, please note:

• Your responsibility. You may collect and store information about prospects and referred contacts only where you have a lawful basis to do so, and you remain the controller of that information.
• Referral provenance. When a lead arrives through a client’s “Refer me” link, we record which client it came from (“referred by”) so you can see who is referring you. This is shown only to you, not published publicly.
• Your public card. Information you place on your Business Card / public profile is accessible to anyone with your card link, QR code, or QuickClient Code.
• Your Professional Page. When you publish a Professional Page, everything you put on it is public and accessible to anyone with the link. You choose and control that content; we host and display it at your direction and are not responsible for it. When a visitor submits the page’s contact form, those details are added to your account as Client Data, and you become the controller of them.
• Prospect capture. When a prospect submits their contact details to you through a shared capture link, your QR card, or a “Refer me” link one of your clients passed along, that information is added to your account as Client Data, and you become the controller of it. For a “Refer me” link, we also count how many times the link was opened and how many leads it produced, and attribute a captured lead to the client who shared it, so you can see which clients are referring you. These counts are stored to your account and shown only to you.

7. Legal bases for processing (EEA/UK users)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Service you request); your consent (which you may withdraw at any time, for example for optional emails); our legitimate interests (securing and improving the Service); and compliance with legal obligations. Where you use the Service to process the personal data of others, you are responsible for establishing your own legal basis.

8. Your rights and choices

You can access and export all of your data, and permanently delete your account and all associated data, at any time from Settings → Privacy & data. Depending on your location, you may also have rights to access, correct, delete, restrict, or port your personal data, to object to certain processing, and to lodge a complaint with a supervisory authority (GDPR/UK GDPR), or to know, access, delete, correct, and limit the use of your information and to not be discriminated against for exercising these rights (CCPA/CPRA). We do not “sell” or “share” personal information as defined under the CCPA/CPRA. To make a request, use the in-app tools or contact us at support@quickclient.ai. If your request concerns Client Data held on behalf of a business customer, we will refer it to, or act on the instructions of, that customer as the controller.

We will respond within the time your law allows (for example, within 45 days under U.S. state privacy laws, extendable where permitted). You may use an authorized agent to submit a request for you, and we may take reasonable steps to verify your identity and the agent’s authority. Appeals: if we decline your request, we will tell you why and how to appeal; to appeal, reply to our decision or contact support@quickclient.ai, and we will respond within the period your law requires. Because we do not sell or share personal information or use it for targeted advertising, there is no opt-out for us to apply, and we do not need to act on Global Privacy Control or other opt-out preference signals.

California “Shine the Light.” California Civil Code § 1798.83 lets California residents ask about personal information shared with third parties for those third parties’ own direct marketing. We do not share personal information with third parties for their direct marketing, so there is nothing to disclose; you may confirm this by contacting us at support@quickclient.ai.

Other U.S. state privacy rights. If you are a resident of a state with a comprehensive consumer-privacy law — including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and Montana, among others — you have the right to confirm whether we process your personal information and to access it, to correct it, to delete it, and to obtain a portable copy, as well as to opt out of its sale, of targeted advertising, and of profiling that produces legal or similarly significant effects. quickCLIENT.ai does not sell personal information, does notshare it for targeted advertising, and does not use it for that kind of profiling, so those opt-outs do not apply to us. You can exercise your access, correction, and deletion rights with the in-app tools or by contacting support@quickclient.ai, and you may appeal a decision as described above. We do not use your personal information to make decisions that produce legal or similarly significant effects about you.

9. Data retention

We retain your content for as long as your account is active or as needed to provide the Service. When you delete content or your account, we remove it from our active systems promptly. Copies may remain temporarily in encrypted backups: database backups age out on our infrastructure provider’s rolling backup cycle, and our separate file-backup copies of your uploads are removed when you delete your account. To help you understand how long specific categories are kept, our current retention practices are:

What happens when a subscription ends. Cancelling does not immediately delete your data. You can export all of your data — including your clients, notes, and documents — at any time from account settings. If you cancel one paid module but keep another, your Campaigns and Walkthroughs data from the inactive module stays viewable in read-only form while your account remains paid, and creating, editing, AI processing, transcription, and other paid processing for that module stop, and any public Campaign QR pages or forms stop accepting submissions. If all of your paid subscriptions end, paid features continue until the end of the period you have paid for; after that you cannot add or edit records, run AI or transcription, or capture new public QR submissions, but you can still sign in to export your data or resubscribe. We retain a cancelled workspace for a limited period so you can export your data or resubscribe, after which it may be permanently deleted, subject to our backup lifecycle and any legal exceptions below. Simply signing in does not extend that period, and you can request permanent deletion at any time. We keep each category of data only as long as described below.

Categories we keep separate. We distinguish (a) your account and business data; (b) personal data about your clients and prospects, which we process on your behalf as your processor; (c) billing, security, and compliance records; and (d) anonymized, aggregate telemetry that contains no personal data. Billing, security, and compliance records are kept only as long as legitimately required (for billing, tax, fraud prevention, security, disputes, or legal compliance) and are stored separately from, and more restricted than, your operational workspace data. A verified account-deletion request may require us to delete sooner than the periods here, where applicable law requires; we then keep only what we are legitimately required to retain.

• Account content and Client Data — for as long as your account is active; removed from active systems when you delete it or close your account.
• Encrypted backups — kept for disaster recovery. Database backups age out on our infrastructure provider’s rolling cycle, so recently deleted content may persist in a backup until that cycle completes. Our separate file-backup copies of your uploaded files are removed when you delete your account.
• Page-view analytics — pseudonymous, first-party, no IP; kept no longer than reasonably necessary for product analytics, then deleted or aggregated.
• Email-nudge signals (sender, subject, and time only) — retained while the related client is active and deleted with the client.
• Connected Google Calendar — calendar events we copy are kept while the connection is active and refreshed from Google. If your access to the feature ends, synchronization stops. When you disconnect, or delete your account, we revoke our access at Google and delete the stored calendar data and tokens immediately. Nothing in your Google Calendar is deleted.
• Waitlist entries — kept until you ask us to remove you or we complete launch outreach, whichever comes first.
• Dismissed reminders and action items — marking something “won’t do” records it as dropped rather than erasing it, so it stops appearing but remains part of the client’s history until you delete the item or the client.
• Security, sign-in, and access logs — retained as long as reasonably necessary to detect and investigate abuse and to meet legal, security, and dispute-resolution obligations.
• Tamper-evident audit records — retained in an immutable archive for as long as required for security and compliance.
• Records of consent (including to auto-renewal) and support correspondence — retained as required to comply with legal obligations, resolve disputes, and enforce agreements.

Retention after account deletion. When you close your account, we delete your content and Client Data from active systems. A limited set of records — security, sign-in, and audit logs, records of consent, referral records, and support correspondence — may be retained where we have a legal, security, or dispute-resolution basis to keep them. These are minimized and are not used to re-identify you for any other purpose.

10. Security

We use reasonable administrative, technical, and organizational measures to protect information, including encryption in transit and at rest, per-user access isolation, and access controls, and we do not store voice-note audio after transcription. No system is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you and any regulators as required by applicable law.

11. Sensitive information

You control what you store. We recommend you avoid storing highly sensitive identifiers (such as government ID numbers, financial account numbers, passwords, or health information) unless necessary, and you remain responsible for the content you choose to upload. Do not upload others’ personal information without a lawful basis to do so.

Sensitive data we collect. The only sensitive-category data we collect is precise location, and only for the Walkthrough feature, only if you grant your device’s location permission — so it is collected with your opt-in consent. You can withhold or turn it off at any time, and you may ask us to limit our use of sensitive information. Biometrics: we do not collect or create biometric identifiers — we do not generate voiceprints from your recordings (audio is transcribed to text and then discarded), and we do not run facial recognition or derive facial geometry from your photos.

12. Where your data is processed

The Service is offered to users in the United States. Our production database is hosted in the United States. We use service providers for hosting, AI processing, payments, communications, and diagnostics; the providers we rely on, and the categories of data each handles, are listed in our Subprocessor List. Some of these providers are global companies and may process data in more than one country. If you access the Service from outside the United States, you understand that your information will be processed in the United States and, for some providers, elsewhere.

13. Children’s privacy

The Service is a professional tool intended for adults and is not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect their personal information. If you believe a child has provided us personal information, contact us and we will delete it.

14. Third-party links and services

The Service may link to or interoperate with third-party sites and services we do not control. Their privacy practices are governed by their own policies, and we are not responsible for them.

15. Cookies and local storage

We use only what the Service needs to work. We do not use advertising cookies, cross-site or third-party tracking, or analytics that build a profile of you. Specifically:

• Essential cookies. A session cookie is set when you sign in so the app knows you are logged in. The Service will not function without it.
• Functional local storage. Your browser’s local storage keeps app preferences and interface state (for example, filters, tab, and layout choices) on your own device. It is not shared with advertisers and is not used to track you across sites.
• Referral cookie (first-party). If you arrive through a referral link, we set a first-party cookie (qc_ref, and optionally a source tag) so that if you sign up, we can credit the person who referred you. It is first-party only, is not used for cross-site tracking or advertising, and expires on its own.
• Error monitoring. Our error-monitoring provider may set a minimal identifier to group crash reports. Those reports are stripped of personal information before they leave and we do not record or replay your screen (see Section 4).

Because we set only essential and functional storage — and no tracking or advertising cookies — a cookie-consent banner is not required to use the Service. If we ever add non-essential analytics or advertising technologies, we will update this Policy and, where the law requires, ask for your consent first. You can clear or block cookies and local storage in your browser at any time; note that sign-in may not work without the session cookie.

16. Changes to this Policy

We may update this Policy from time to time. Material changes will be indicated by updating the “Effective and last updated” date and, where appropriate, by additional notice. Continued use after changes take effect constitutes acceptance.

17. Contact

For privacy questions or to exercise your rights, contact Prism AI Apps LLC at support@quickclient.ai, or by mail at 2108 N St, Ste N, Sacramento, CA 95816. Governing law for this Policy is the State of California, United States, as further described in our Terms of Service.