Privacy Policy

Who this covers

This policy explains how AI Operator handles information about the businesses that use it and about those businesses' customers. For customer data, the business is in charge of how it is used; we process it on the business's behalf to provide the service.Needs legal review — confirm controller/processor roles and whether a DPA is offered

What we collect

• Account data — names, email addresses, phone numbers, and sign-in details of the business's users. Passwords are stored only as one-way hashes.
• Business configuration — services, prices, hours, AI employee settings, and approval rules.
• Customer data the business manages — customer contact details, appointments, estimates, notes, and the content of conversations (texts, call transcripts, and messages).
• Connected accounts — for example a Google Calendar connection. Calendar connection tokens are encrypted before they are stored.
• Technical data — basic records needed to secure and operate the service, such as sign-in attempts used for brute-force protection.

How we use it

To provide the service the business has set up — answering and organizing customer conversations, scheduling, preparing estimates, sending messages the business has approved or allowed — and to secure, support, and bill for the service. We do not sell personal information.

AI processing

When a business enables AI employees, the relevant conversation and business context is sent to our AI provider (Anthropic) to generate replies, suggestions, and drafts. Only the information needed for the task is sent.Needs legal review — confirm provider data-use and retention terms

Service providers

We use providers to run AI Operator, each only for its specific purpose:

• Database hosting (Supabase) — storing application data;
• Anthropic — AI processing;
• Twilio — sending and receiving texts and calls;
• Deepgram and ElevenLabs — speech recognition and voice for the AI phone receptionist, when enabled;
• Stripe — subscription payments (we never see full card numbers);
• SendGrid — account emails such as verification and password resets;
• Google — optional sign-in and calendar sync, when the business connects them.

Security

Every business's data is kept separate from every other business's on the server. Data is sent over encrypted connections, calendar connection tokens are encrypted at rest, sign-in is protected against repeated guessing, and important AI actions wait for the business owner's approval. No system is perfectly secure; we will notify affected businesses of a breach as required by law.

Retention, export, and deletion

Data is kept while the business account exists. A business owner can export the business's data, delete a single customer and their records, or delete the entire business account from Settings → Privacy & Data. Deleting the business account removes its data and cancels any subscription.Needs legal review — add backup retention period and any legal holds

Your choices and rights

Customers of a business using AI Operator should contact that business to access, correct, or delete their information; we will help the business respond. Anyone can stop texts from a business by replying STOP. Depending on where you live, you may have additional rights under laws such as the CCPA or GDPR.Needs legal review — state-specific rights language (CCPA/CPRA etc.)

Children

AI Operator is a business tool and is not directed to children under 13.

Changes

We will post updates to this policy here and notify account owners of material changes.

Contact

Questions about this document? Contact AI Operator support from inside the app. Needs legal review — set NEXT_PUBLIC_SUPPORT_EMAIL and add a postal address before launch