Privacy Policy – Authorize Online^R

This Privacy Policy describes how INNsight.com, Inc. (“INNsight,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information in connection with the AuthorizeOnline platform and website (www.authorizeonline.com) (collectively, the “Platform”).

AuthorizeOnline is an all-in-one hospitality platform that includes credit card authorization, guest identification and ID scanning, mobile check-in, chargeback defense, fraud-prevention tools, Do Not Rent management, and cookie/consent management tools. This Policy applies to information we collect through the Platform and related services. When a Client deploys AuthorizeOnline tools on its own website or property, the Client’s privacy policy also applies to guest data collected on that Client’s site, and INNsight acts as a service provider processing data on the Client’s instructions.

If you do not agree with this Privacy Policy, please do not use the Platform.

Information We Collect

Information You Provide

We collect personal information you or your authorized users provide when you create an account, configure the Platform, contact us, or use Platform features. This may include:

• Name, business name, email address, phone number, and job title;
• Account credentials (we store password hashes, not plain-text passwords);
• Billing and payment information for subscription fees;
• Configuration settings, property details, and support communications;
• Guest data that Clients submit or that is processed through enabled modules (such as authorization forms, ID images, or check-in information), which we process on the Client’s behalf.

Information Collected Automatically

When you visit or use the Platform we automatically collect technical and usage information such as IP address, browser and device characteristics, operating system, referring URLs, and log data about how the Platform is used. This information is used to operate, secure, and improve the Platform. Non-essential analytics and advertising cookies load only after consent, as described in our Cookie Policy.

Information from Other Sources

We may receive limited information from service providers, publicly available sources, or partners and combine it with information we collect.

How We Use Information

We use personal information for the following purposes:

• To provide, maintain, secure, and improve the Platform and its modules (including credit-card authorization, ID scanning, mobile check-in, chargeback-defense tools, and consent management);
• To authenticate users, process transactions, and generate authorization or verification records;
• To communicate with you about your account, support requests, and (where permitted) product updates;
• To detect, prevent, and respond to fraud, security incidents, and abuse;
• To comply with law, card-network rules, and legal process;
• For analytics and product improvement, using non-essential cookies only after consent.

Where tools record interactions such as clicks or on-site behavior for analytics, those tools load only after consent.

How We Share Information

We share personal information only as follows:

• Service providers — with vendors who process data on our behalf (hosting, payment processing for our fees, email delivery, security) under confidentiality obligations;
• Clients — guest and authorization data processed through the Platform is made available to the Client that submitted or configured it;
• Legal and safety — when required by law, legal process, or to protect rights, safety, or prevent fraud;
• Business transfers — in connection with a merger, acquisition, or sale of assets;
• With consent — for any other purpose you authorize.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising except with consent (or as otherwise permitted by law), and any such sharing is subject to the opt-out rights described in this Policy and our Cookie Policy.

Payment Card and Identity Data

When Clients use credit-card authorization or ID-scanning features, we process the related data to provide the requested functionality. We implement technical and organizational measures designed to protect this data, including encryption in transit and at rest and access controls aligned with PCI DSS principles. Clients remain responsible for providing required guest notices, obtaining consents, and complying with PCI DSS and identity-verification laws applicable to them. We do not store sensitive authentication data in violation of PCI DSS.

Cookies and Similar Technologies

We use cookies and similar technologies on www.authorizeonline.com. Essential cookies may load without consent. All other cookies and tracking technologies load only after affirmative consent. For full details see our Cookie Policy.

Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy, to comply with law, resolve disputes, and enforce agreements. Retention periods vary by data type and module. Clients may request deletion of their account data subject to legal and operational exceptions. Guest data processed on a Client’s behalf is retained according to the Client’s instructions and applicable law.

Security

We maintain administrative, technical, and physical safeguards designed to protect personal information. No method of transmission or storage is completely secure. You are responsible for maintaining the confidentiality of your account credentials.

Your Privacy Rights

Depending on your location, you may have rights to access, correct, delete, or obtain a copy of your personal information, or to opt out of certain processing. To exercise these rights, email legal@innsight.com or use any request form we make available. We will respond within the time required by applicable law.

California Residents

California residents have the following rights under the CCPA as amended by the CPRA:

• Right to know the categories and specific pieces of personal information we collect, the sources, purposes, and categories of third parties with whom we share it;
• Right to delete personal information, subject to exceptions;
• Right to correct inaccurate personal information;
• Right to opt out of sale or sharing — we do not sell personal information; you may opt out of sharing for cross-context behavioral advertising via Cookie Settings or a GPC signal;
• Right to limit use of sensitive personal information, where applicable;
• Right to non-discrimination for exercising your rights.

We will verify your identity before fulfilling a request. Authorized agents may submit requests with proof of authorization.

Categories of personal information we may collect:

Category	Examples	Collected
Identifiers	Name, email, phone, IP address, account name	Yes
Commercial information	Subscription and billing records	Yes
Internet or network activity	Usage data, log data (non-essential collection after consent)	Yes
Geolocation	Approximate location from IP	Yes (coarse)
Professional information	Job title, business contact details	Yes
Sensitive personal information	Account credentials; payment card or government ID data processed on a Client’s behalf	Yes (limited)

Children

The Platform is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

International Transfers

We are based in the United States. Information may be transferred to and processed in the United States.

Changes to This Policy

We may update this Privacy Policy from time to time. The “Last Updated” date will reflect the most recent version. Material changes may be communicated by notice on the Platform or by email.

Contact Us

INNsight.com, Inc.
2445 Ocean Avenue
San Francisco, CA 94127
United States
Email: legal@innsight.com