Privacy Policy

1. Introduction, Scope, and Who We Are

This Policy covers personal information we handle when you visit our Sites, request information, become a customer, or when our AI receptionist answers a call on behalf of one of our business customers. Some rights and obligations described here apply only where a given privacy law applies to us; we publish this notice to be transparent regardless of whether any specific threshold is met.

2. The Two Groups of Individuals We Handle — and Our Role for Each

Our Services involve two distinct groups of people, and our legal role is different for each:

• Customers— the businesses that buy our Services and their authorized users. For Customer data, we act as the business / controller and this Policy governs how we use it.
• Callers— the people who call our Customers' phone lines and are answered by the AI receptionist. Their name, phone number, reason for calling, and their call audio and transcript are captured to operate the service. For Caller data, our Customer is the controller that directs the processing, and we act as a service provider / processoron that Customer's behalf under our contract with them.

Callers who never contracted with us still have privacy rights. If you are a Caller and want to exercise a right, we will route your request to the business you called (the controller) and assist as their service provider. See our Data Processing Addendum for how caller data is governed.

3. Categories of Personal Information We Collect

Using standard statutory category terms, we may collect the following, mapped to the two groups above:

• Identifiers — name, phone number, email, mailing/billing address, IP address (Customers and Callers).
• Customer records — account, contact, and billing details (Customers).
• Commercial information — services purchased, plan, transaction history (Customers).
• Audio and visual information — call recordings and transcripts (Callers), captured to operate the receptionist.
• Internet or network activity — pages viewed, links clicked, device/browser data, log data (Site visitors).
• Geolocation — approximate location derived from IP address (Site visitors).
• Inferences — the "reason for calling" and appointment intent derived from a call (Callers).
• Biometric information — not collected. We record and transcribe calls; we do not create voiceprints or use voice to identify callers. See Section 7.

4. Sources of the Information

• From the Customer directly (account setup, forms, proposals, support);
• From Callers during calls answered by the AI receptionist;
• Automatically from your device when you use our Sites (cookies and logs — see our Cookie Policy);
• From integrated vendors used to deliver the Services (telephony, scheduling, messaging, payments).

5. Business and Commercial Purposes for Processing

• Answering, recording, transcribing, and understanding inbound calls;
• Booking appointments and sending SMS confirmations and notices;
• Logging each call (caller name, number, reason, transcript) for the Customer;
• Billing, account management, and customer support;
• Security, fraud prevention, and maintaining service integrity;
• Operating, maintaining, and improving the Services, consistent with our service-provider obligations.

6. Call Recordings and Transcripts

Calls answered by the receptionist are recorded and transcribed to book appointments and to provide, secure, and improve the service. Recordings and transcripts are processed by automated AI systems and by named subprocessors (including our conversational voice provider and large-language-model providers). Access is limited to the Customer, authorized personnel, and those subprocessors under contract.

Proposed retention: we intend to retain call recordings and transcripts for 18 months, after which they are deleted unless a longer period is required to resolve a dispute or to satisfy a legal hold or legal obligation. This period is a proposed default and is subject to confirmation by counsel.

For details on how and why calls are recorded, the in-call announcement, and caller choices, see our Call Recording & Consent Notice.

7. Sensitive Personal Information and Biometrics

A call recording is audio, and is not automatically "sensitive" or "biometric" information. Our receptionist is designed to record and transcribe only. We do notcreate voiceprints, run voice-ID or speaker authentication, or use anyone's voice to identify them.

We do not sell sensitive personal data and we do not sell biometric personal data. If we ever add a feature that would create a voiceprint or biometric identifier, we will provide the required pre-collection notice and obtain consent before doing so.

8. Disclosures to Third Parties and Subprocessors

We disclose personal information to trusted vendors that process data only to operate the Services on our behalf — for payments, telephony and SMS, AI voice and transcription, large-language-model processing, scheduling, e-signature, email delivery, CRM, workflow automation, and hosting. These vendors are bound by data-protection terms and may use the data only to provide services to us.

The current list of vendors, their purpose, and the data shared is maintained on our Subprocessors page, which is incorporated into this Policy by reference. We may also disclose information to comply with law, enforce our agreements, or in connection with a merger, acquisition, or sale of assets.

9. "Sale" and "Sharing" of Personal Information

We do not sell personal information for money, and we do not share personal information for cross-context behavioral advertising.Using vendors only as service providers/processors under contract is not a "sale" or "share." Because we neither sell nor share, we are not required to post a "Do Not Sell or Share My Personal Information" link.

We use optional website analytics cookies (for example, to understand traffic and performance). These are off by defaultand load only if you opt in. To the extent any analytics activity could be treated as "sharing" under some laws, we honor the Global Privacy Control (GPC)browser signal as a valid opt-out and provide a "Your Privacy Choices" control — see our Cookie Policy and Section 14.

10. Retention Periods

We keep personal information only for as long as reasonably necessary for the purposes above, then delete or anonymize it. Proposed schedules (subject to confirmation by counsel):

• Call recordings and transcripts: 18 months, then deletion unless subject to a dispute or legal hold.
• Call logs (caller name, number, reason): for the term of the Customer relationship or per the Customer's instructions.
• Account and billing records: for the term plus any period required by tax, accounting, and legal obligations.
• Website analytics and marketing data: for a limited period tied to the activity and your consent.
• Payment card data: handled by our payment processor; we never store full card numbers and do not store card security codes (CVV).

11. Your Privacy Rights

Depending on where you live and which law applies, you may have the right to:

• Confirm whether we process your personal information and access it;
• Correct inaccurate personal information;
• Delete personal information, subject to exceptions;
• Obtain a portable copy of certain data (data portability);
• Opt out of targeted advertising, the sale of personal data, and certain profiling;
• Under Texas law, appeal a decision on your request; and
• Not be discriminated against for exercising your rights.

If you are a Caller exercising a right about call data, the business you called is the controller; we will forward your request to them and assist as their service provider.

12. How to Exercise Your Rights

You can submit a request by either of two methods:

• Email privacy@tsunamiautomation.com with the subject "Privacy Rights Request"; or
• Call our toll-free line at (844) 953-3545.

We will verify your identity before acting. Timelines, where a law applies:

• Texas (TDPSA): we respond within 45 days, with one 45-day extension when reasonably necessary. If we deny a request, you may appeal within 60 days, and we will respond to the appeal within 60 days.
• California (CCPA), where applicable: we confirm receipt within 10 business days and respond within 45 days, extendable to 90 days.

13. Authorized Agents

You may use an authorized agent to submit a request. We may require the agent to provide proof of your signed permission and may ask you to verify your own identity directly. A power of attorney is not required.

14. Universal Opt-Out and Global Privacy Control (GPC)

We recognize and honor browser-level universal opt-out preference signals, including the Global Privacy Control (GPC). Because our optional analytics and functional cookies are off by default until you opt in, and because we do not sell or share personal information for cross-context behavioral advertising, a GPC signal is treated as a valid opt-out of any such sale or sharing. The Texas universal opt-out requirement has been in force since January 1, 2025.

15. Automated Processing and AI

Inbound calls are handled by an AI virtual assistant and processed by automated large-language-model and voice subprocessors to understand the caller and book appointments. Our receptionist discloses that it is an AI when asked and can hand off to a human at any time.

Appointment-booking is not a "significant decision" (such as lending, housing, employment, or healthcare eligibility), so profiling-specific automated decision-making rights generally do not attach; we disclose the AI processing here for transparency. We will re-assess if the Services are ever used to make significant decisions about individuals.

16. Minors

Our Services are directed to businesses and are not intended for children. We do not knowingly collect personal information from children under 16. If we ever had actual knowledge that a consumer is under 16, we would not sell or share their personal information without opt-in consent. If you believe a child provided us information, contact privacy@tsunamiautomation.com.

17. Data Security

We use reasonable administrative and technical safeguards designed to protect personal information, including encryption in transit and at rest, access controls, and logging. No system is completely secure; you are responsible for keeping account credentials confidential and for notifying us promptly of any suspected unauthorized access.

18. International Transfers

We are based in the United States and use subprocessors located in the United States and other countries (including the EU). Where personal information is transferred internationally and the law requires it, we rely on appropriate safeguards such as standard contractual clauses.

19. Changes to This Policy, and How to Contact Us

We may update this Policy to reflect changes in our practices or the law. When we make material changes, we update the "Last Updated" date above and provide additional notice where required. A Spanish-language version of this Policy is available on request.