Privacy Policy

Short version: we collect your phone number and the recommendations you send us. We use them to run Passa. We share information only with the service providers needed to run the service, plus the limited cases described below. You can stop the texts anytime by replying STOP (or just asking us to stop), and you can delete your account from the dashboard or by emailing us. We keep a short record of your agreement to be texted and of any request to stop, which is explained under Retention.

Who this applies to

Passa is operated by Bendwater Labs LLC (“we”, “us”, “our”). This policy covers passalong.xyz and the Passa SMS service, and applies to anyone who submits their phone number, texts our toll-free number, or uses the dashboard. If you give us an email address, we may occasionally send product updates or news about other Bendwater products there, with an unsubscribe link in every one. We do not use your phone number for that. Texts from Passa are the service itself: replies to what you send, and alerts you asked for.

What we collect

• Your phone number, when you submit it through passalong.xyz or text our toll-free number.
• The text messages you send us, and the recommendations parsed from them (name, category, source person, location, notes).
• Your interactions with the dashboard, including which recommendations you retrieve or delete.
• A record of your agreement to receive texts: your number, the date, and the exact wording that was shown to you at the time.
• A record of any request to stop texting you: your number, the date, how the request reached us, and the message you sent.
• A short operational log of messages we sent, with your number, kept for about a week so we do not send the same thing twice and can stop if volume spikes.
• A longer record that we sent you a message, kept as a scrambled version of your number rather than the number itself, so we can show what was sent and when without keeping a readable list of phone numbers.
• If you turn on alerts in the dashboard, your browser gives us an address to deliver notifications to, and we store it. We use it only for the alerts you turned on. Turn them off in the dashboard or in your browser's site settings and we delete the address.
• If you save by voice, your phone turns your speech into text before anything reaches us, under the phone maker's own policy. We never receive or store audio. Saving by voice uses a capture code tied to your account that can add a recommendation and nothing else; you can replace it from the dashboard.
• If you apply for a partner page, the business name and the contact details you give us so we can reply. We use them only to set up and manage the partner page.
• Standard server logs (IP address, user agent, timestamps, page views) for security, abuse prevention, analytics, and product improvement.

How we use it

• To run the service: saving your recommendations, sending you confirmations, returning your lists, signing you into the dashboard.
• To keep Passa reliable and secure (rate limits, abuse prevention, debugging).
• To send you the SMS confirmations and welcome message you opted into by submitting your number.
• To analyze usage patterns, measure performance, improve features, and develop new ones.
• For internal research, business planning, and reporting.
• For marketing and partnership purposes, in accordance with this policy.

How we share it

We may share your information with the following categories of third parties:

• Service providers who help us operate Passa: an SMS carrier, an AI provider that parses messages through a commercial API, a cloud database, and a hosting provider. These providers process your data on our behalf and are bound by their own privacy obligations.
• Aggregated, de-identified, or anonymized data may be shared with third parties for product improvement and trend analysis. This data cannot reasonably be used to identify you.
• Businesses and partners, in aggregate form only. A business may claim a partner page showing statistics about saves of its name (such as counts and dates) and clicks on its link. These pages display aggregate numbers, not who saved or clicked. If you note who recommended something to you (for example “from Alex”), the business may see that first name and how often it appears, never a full identity or any contact information, and never anything about you as the saver. The page may also show common words drawn from notes people have written about that business, never a whole note.
• Links we send. Some links in our replies take you to a partner's booking page or to a store, and some of those may earn us a small commission at no cost to you. A link is never chosen because of a commission, and clicking one never tells the other side who you are.
• Successors in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets. Your information may be transferred as part of those transactions.
• Law enforcement or government authorities when we believe in good faith that disclosure is required by law, legal process, or to protect our rights, the rights of others, or public safety.

We do not sell personal information or share it for cross-context behavioral advertising as those terms are defined under applicable privacy laws. No mobile information will be sold or shared with third parties for promotional or marketing purposes. If our practices change, we will notify you and update this policy.

Marketing communications

We do not send marketing text messages. The texts we send are the service working for you: a one-time welcome when you sign up, replies to what you send us, and alerts you have asked for by tracking something (for example, when a show you told us to watch for comes back). We do not text you for any other reason.

To stop them, reply STOP to any Passa message. UNSUBSCRIBE, CANCEL, END, and QUIT work too, as does asking us plainly (“stop texting me”). You can also email us. When we receive any of these we add your number to a do-not-text list that we check before sending anything, and we stop immediately. Your carrier and our messaging provider also block messages after a STOP, so this works even if our own systems fail.

Your rights and choices

• Opt out of SMS. Reply STOP to any Passa message, or UNSUBSCRIBE, CANCEL, END, or QUIT. Plain language works too (“stop texting me”), and you can email us instead. Any of these stops the texts.
• See your data. Sign into passalong.xyz/dashboard to view what we have saved for you.
• Delete your data. Delete individual recommendations from the dashboard, delete your whole account from the dashboard to remove it and everything saved in it (cannot be undone), or email us to request deletion. The text-messaging records described under Retention are the exception: they are kept on the schedule set out there, including the do-not-text list, so that deleting your account does not accidentally start the texts again.
• Export your data. Export your full record as JSON from the dashboard. Or email us if you'd prefer.

Retention

We keep your recommendations as long as your account is active. If you stop using Passa, we may delete inactive accounts after a year of no activity. When you delete your account, it is removed right away along with everything in it, except where we are required to retain something for legal, regulatory, accounting, or security purposes.

Two text-messaging records are kept longer, and are not removed when you delete your account:

• Consent and sending records: 5 years. When you give us your number we store that number, the date, and the exact consent wording shown to you. We also keep a record that a message was sent to you, stored as a scrambled version of your number rather than the number itself. Federal law lets someone bring a text-messaging claim for up to four years, and some states allow longer, so we keep these records for five years to show what was agreed to and when.
• Opt-out records: kept indefinitely. If you text STOP or otherwise ask us to stop, we keep your number on a do-not-text list permanently. This is the list we check before every message. Deleting it would mean we could start texting you again, which is the opposite of what you asked for. You can ask us to remove it, but then we can no longer guarantee you will not be contacted if you sign up again later.

Cookies and tracking

The dashboard sets a session cookie to keep you signed in after phone verification. We may also use cookies, pixels, or similar technologies for analytics, performance measurement, or marketing in the future. We will update this section if we add tracking that requires consent.

Security

We use reasonable administrative, technical, and physical safeguards to protect your information. No system is perfectly secure, and we cannot guarantee that unauthorized access will never happen. If we become aware of a breach affecting your data, we will notify you as required by law.

Children

Passa is not intended for anyone under 13. We do not knowingly collect data from children. If we learn we have collected data from a child under 13, we will delete it.

International users

Passa is operated from the United States. If you use the service from outside the US, your information will be transferred to, stored, and processed in the US, where data protection laws may differ from those in your country.

Changes to this policy

We may update this policy from time to time. When we do, we will update the effective date at the top. Material changes will be communicated to active users via SMS or email.

Contact

Questions, deletion or opt-out requests, or anything else: hello@passalong.xyz.