PsychLocalPsychLocal
Get Listed

Privacy Policy

This Privacy Policy describes how PsychLocal, Inc. collects, uses, and shares your personal information when you use our website and directory management platform.

Last updated: August 22, 2026

1. Who We Are and What This Covers

This Privacy Policy applies to PsychLocal, Inc. ("PsychLocal", "we", "us", or "our") and governs our data collection practices for users in the United States.

We play two distinct roles in handling data. We act as a data controller for the information you provide to open an account, subscribe to our services, or browse our public marketing site. We act as a data processor (or service provider) for the client data, CRM contacts, text messages, form submissions, and leads that mental health practices upload or collect using our platform. For data where we act as a processor, the practice is responsible for obtaining all necessary consents, and we only process it on their instructions.

2. Information We Collect

We honestly and transparently collect the following categories of information:

  • Account and Profile Information: When you sign up, we collect your name, email, phone number, business name, address, and login credentials. We store passwords securely using bcrypt hashing.
  • Billing Information: We store Stripe customer and subscription identifiers. We do not store or process full credit card numbers on our systems; they are handled directly by Stripe.
  • Practice and Location Data: We collect business details intended for public syndication, which may include your National Provider Identifier (NPI) number, accepted insurance, treatments offered, and conditions treated.
  • Connected Accounts: If you connect a Google account or other third-party tool, we collect the associated account email and OAuth access/refresh tokens.
  • Platform Communications: We process CRM contacts, notes, deal stages, and the full content bodies of SMS and email messages sent or received through the PsychLocal platform.
  • Form and Lead Submissions: We collect emails for newsletters and public form submissions. We record the submitter's IP address and referer along with the form data. Free listing audit requests capture the requested business details and submitter email.
  • Visitor and Analytics Data: For visitors to our marketing sites and platform, we record a unique visitor identifier cookie, your IP address, browser user agent, referring URL, UTM parameters, pages viewed, and time spent on the page. We also record the IP and user agent when a public directory listing is viewed or engaged with, as well as timestamps of login attempts (both successful and failed).

3. Cookies and Tracking

We use cookies and similar technologies to provide our services and analyze usage. Our core platform utilizes HttpOnly, Secure, and SameSite session cookies for authentication, alongside a dedicated visitor identifier cookie.

We use Google Analytics 4 (GA4) for aggregated traffic reporting. In our GA4 implementation, we strictly enable IP anonymization, strip query strings, redact identifying numeric or UUID segments from URL paths, and do not track our public forms infrastructure (`/f/*`).

We do not use third-party advertising cookies, nor do we track your activity across other websites for cross-site targeted advertising. If you transmit a Global Privacy Control (GPC) or Do Not Track (DNT) signal, we honor it as a valid opt-out of data sharing.

4. How We Use Information

We use the information we collect to:

  • Provide, operate, and maintain the PsychLocal platform and directory syndication network.
  • Process transactions and send related billing information.
  • Send administrative notices, technical alerts, and security updates.
  • Respond to customer service requests and provide support.
  • Monitor and analyze trends, usage, and activities in connection with our services.
  • Detect, investigate, and prevent fraudulent transactions and other illegal activities.

5. Google User Data

If you choose to integrate your PsychLocal account with Google, we will request explicit permission to access your data via OAuth. We strictly limit our request to the scopes necessary to operate our features:

  • https://www.googleapis.com/auth/business.manage: Used to read your existing Google Business Profile locations and write updates (such as hours or phone numbers) solely for the listings you explicitly authorize us to manage.
  • https://www.googleapis.com/auth/webmasters: Used to read Google Search Console performance data and to submit XML sitemaps to Google. Write access is strictly required as submitting a sitemap is categorized by Google as a write operation.
  • .../auth/userinfo.email and .../auth/userinfo.profile: Used solely to identify which Google account you have connected and to display the connection status accurately back to you in our interface.

PsychLocal, Inc.'s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Affirmative Commitments: Your Google user data is never used for advertising, nor is it ever sold, licensed, or transferred to ad networks or data brokers. We do not use Google user data to train AI models. Your data is not read by human personnel unless we have your explicit consent to view specific data for support, it is required for security investigations, or it is necessary to comply with applicable law.

Tokens are encrypted at rest. You can disconnect your Google account at any time from within the PsychLocal dashboard or by revoking access at your Google Account permissions page. Disconnecting will immediately delete the stored tokens and associated Google session data from our systems.

6. Meta/Facebook Platform Data

We do not currently implement Meta OAuth login or access direct Meta user data. Our competitor advertising intelligence tools aggregate public data from public ad libraries, and any social publishing you conduct via Facebook/Instagram is routed securely through a third-party social publishing provider that holds the active connection credentials.

If and when we introduce direct Meta integrations, we commit to the following Platform Terms: We will never sell or license Meta Platform Data; we will never transfer it to ad networks or data brokers; we will keep data belonging to different advertisers strictly segregated; we will not use Meta data to retarget users on non-Meta platforms; and we will always obtain your consent before publishing content on your behalf.

You can request the deletion of any associated platform data via our data deletion process linked below.

7. Text Messaging and Mobile Data

PsychLocal adheres strictly to TCPA guidelines and A2P 10DLC messaging requirements.

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

8. How We Share Information

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We only share data in the following circumstances:

  • Sub-processors and Service Providers: We share data with trusted vendors that provide critical infrastructure. Below are the categories of service providers we use and what data they receive:
    • Cloud Hosting & Database Infrastructure: Processes all stored application data, encrypted at rest and in transit.
    • Payment Processing: We use Stripe to process payments. They receive customer names, emails, and subscription plan selections. All credit card data is securely captured by Stripe.
    • Email Delivery: Receives recipient email addresses and the body content of system alerts and marketing emails.
    • SMS Delivery: Receives recipient phone numbers and the full text body of SMS messages, as well as business registration details for A2P 10DLC compliance.
    • Directory & Listing Distribution: Receives location NAP data, NPI numbers, accepted insurance, treatments, and practice photos for publication to directories.
    • Website & Search Analytics: We use Google Analytics for anonymized visitor traffic analysis.
    • Search & Reputation Data Providers: Receives search keywords, location coordinates, competitor names, and domain URLs to retrieve public ranking results, ad details, and SEO metrics.
    • Social Media Publishing: Maintains social profile OAuth connections and receives the text/image content of social posts you schedule.
    • AI & Machine Learning Providers: Receives business profile context, SEO content drafts, and public consumer review text to generate summaries. Explicitly prohibited from training underlying models on submitted data.

    A current list of the specific named sub-processors is available to customers on request, and is provided to counterparties under a Business Associate Agreement or data processing agreement where required. Contact us at hello@psychlocal.com to request a copy.

  • Business Transfers: If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction.
  • Legal and Safety: We may disclose information if we believe disclosure is in accordance with, or required by, any applicable law, regulation, or legal process.

9. AI Processing

To provide features like competitor intelligence, review sentiment analysis, and SEO optimization, we transmit certain business data to our AI service provider(s). This may include public business listing data, SEO content drafts, and patient review text (which may contain content authored by consumers).

We execute agreements with these vendors that explicitly prohibit them from utilizing your submitted data or generated outputs to train their underlying machine learning models. You remain responsible for reviewing any AI-generated content or responses prior to publication.

10. Security

We employ industry-standard technical measures to protect your data. This includes bcrypt hashing for passwords, TLS encryption for all data in transit, AES-256-CBC encryption at rest for third-party credentials and OAuth tokens, HttpOnly session cookies, and strict role-based access controls.

To provide technical support, authorized PsychLocal support personnel may temporarily access your account. When this occurs, an impersonation banner is prominently displayed on-screen to ensure transparency.

11. Data Retention

We retain data according to the following specific timelines:

  • Account Data: Retained while your account is active, and permanently deleted within 30 days of a verified deletion request.
  • Website Analytics & Visitor Records: Retained for 14 months.
  • Message Logs: Email and SMS bodies sent through the CRM are retained for 24 months.
  • Audit Leads: Information submitted for free listing audits is retained for 24 months.
  • Login Attempts: Security logs tracking login successes and failures are retained for 90 days.

Note: For CRM contact data you upload to the platform where we act as a processor, we retain the data strictly in accordance with your account lifecycle and your explicit deletion instructions.

12. Your Privacy Rights

Depending on your US state of residence (including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana), you have the right to:

  • Access/Know: Request details about the specific pieces of personal information we have collected about you.
  • Delete: Request the deletion of personal information we have collected from you.
  • Correct: Request corrections to inaccurate personal data.
  • Portability: Obtain a copy of your data in a portable format.
  • Opt-Out: Opt-out of the sale or sharing of data for targeted advertising (note: we do not sell or share data for these purposes).
  • Limit Use: Limit the use of sensitive personal information.

We will not discriminate against you for exercising any of these rights. To submit a request, or if you are an authorized agent submitting a request on a user's behalf, please contact us at hello@psychlocal.com, call our toll-free line at (800) 434-4519. We will respond to verified requests within 45 days, which may be extended by an additional 45 days with notice. You have the right to appeal any denial of your request.

13. Children's Privacy

Our services are designed exclusively for business practices and are not directed at anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will take immediate steps to delete it.

14. Protected Health Information (PHI)

PsychLocal is not a Covered Entity under HIPAA, but we act as a Business Associate for our paid-plan customers. Practices must not enter Protected Health Information (PHI) into free-text fields or CRM records on the platform unless an executed Business Associate Agreement (BAA) is in place. Please see our HIPAA & BAA page for full compliance requirements.

15. Changes to This Policy

We may modify this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. If we make material changes, we will provide you with additional notice, such as via email or a prominent banner on the platform.

16. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Email: hello@psychlocal.com
Phone: (800) 434-4519