Privacy Policy

1. Introduction

This Privacy Policy explains how First AI Employee LLC ("First AI Employee," "we," "us," or "our") collects, uses, shares, and protects information in connection with our AI-powered receptionist and front-desk services (the "Service") and our website at https://firstaiemployee.com. Please read it together with our Terms of Service. By using the Service or our website, you acknowledge the practices described here.

2. Our Two Roles: Controller and Processor

We handle personal information in two distinct capacities. First, for visitors to our website and for the businesses that hold accounts with us ("Customers"), we act as a controller of that information and this Policy describes our practices. Second, when we answer calls, exchange text messages, operate a website chat agent, and help manage reviews and email on behalf of a Customer, including the personal information of the people who call, text, chat with, review, or email that Customer (collectively, "End Users"), we act as a service provider/processor on that Customer's behalf. In that role, the Customer is the controller of the End User information and is responsible for the lawful basis, notices, and consents for that processing, and our handling of that information is governed by our agreement with the Customer. If you are an End User and wish to exercise rights over your information, please contact the business you interacted with; we will assist that business as required.

3. Information We Collect

From Customers: business contact details (such as name, business name, email, and phone number), account credentials, billing information (processed by our payment processor; we do not store full card numbers), the business configuration you provide (hours, services, pricing, FAQs, scripts, routing and escalation rules), and business documents that the account owner uploads.

Also from Customers, where business texting is enabled: your business's Employer Identification Number (EIN), collected once from the account owner. US carrier registration (10DLC) requires the business behind a texting number to be verified, so we send the EIN, with your legal business name and address, to our identity-verification provider, which runs an IRS tax-identification-number match, a sanctions (OFAC) screen, and a USPS address check. After the check passes, we keep the EIN encrypted (AES-256-GCM, a NIST-approved authenticated encryption method) for one purpose only: filing your 10DLC carrier registration without asking you to enter it again. We delete the encrypted EIN as soon as that registration is filed successfully, and in any event no later than sixty days after you entered it, whichever comes first. We also keep the result of the check, the legal name and address you gave us, and what the provider reported back about that name and address.

From End Users, on behalf of Customers: telephone number and caller ID information; recordings and transcripts of calls; the content of text and SMS messages and of website-chat conversations; the content of online reviews that a Customer asks us to help manage; voicemail and messages; appointment details; documents and information an End User provides through a secure intake link or during an interaction; service-relevant profile details that an End User explicitly states, such as an organization, role, work relationship, relationship to the property, preferred contact time, or preferred language; and interaction metadata such as time, duration, channel, and outcome, including, for secure-intake uploads, technical connection data such as IP address and device or browser information that we retain to operate the Service and to help detect and prevent abuse or misuse. We do not infer age, sex, gender, health, ethnicity, or other sensitive traits for these profile fields. Some secure-intake material may be confidential in the ordinary professional sense, including legal, accounting, or tax documents. The Service supports those documents through secure intake, subject to the Terms and the security and retention practices below. That material is distinct from legally defined special-category data. PHI is prohibited. Where the GDPR or UK GDPR applies, Article 9 special-category data is prohibited unless we have agreed in writing and implemented a dedicated lawful workflow for it; no such workflow is included in the standard Service.

Automatically from our website: device and browser information, IP address, and pages viewed, recorded in standard server logs. Separately, when a page loads we ask our content delivery network which country and US state your request came from, so that we can show a phone number local to you next to our main number. That check reads your IP address, which our network already receives in order to serve you the page; it uses no cookies, it does not depend on your cookie choice, and we do not store its result or use it for anything else. With your consent, we also use Google Analytics to understand how the site is used (for example, pages visited, approximate location, and general usage patterns), collected through cookies. Analytics cookies load only after you opt in through our cookie banner; if you decline, only essential cookies are used. See Section 12 for details and how to change your choice.

4. How We Use Information

We use information to: provide and operate the Service, including answering calls, texts, and website chats; transcribing and routing communications; booking appointments; recognizing a returning caller by their telephone number and prior interaction history to provide continuity of service (recognizing them by number, not by a voiceprint); and, where a Customer enables those features, drafting and sending replies to the Customer's online reviews and generating summaries and reports; set up and maintain Accounts and configurations; process payments and manage subscriptions; provide customer support; secure, monitor, debug, and improve the Service; and comply with legal obligations and enforce our Terms. For documents, AI reading is off by default and must be enabled separately for each file. When enabled, we may read the document, generate an AI-readable version, use optical character recognition to extract text from scanned PDFs, and propose facts for the account owner to approve. For a scanned PDF without a text layer, pages are sent as images to a US AI provider for text recognition. Photos are not processed this way. Approving facts compiles them into the Customer's own assistant instructions and makes the full extracted document searchable by that assistant. We do not sell personal information. We do not use Customer Content, Customer Data, or Caller information to train third-party or publicly available AI models. We do use your own business's information and call history to build, tune, and improve your own AI agent (that is the Service) and we may use transcripts and related data internally to improve the Service, using de-identified data for that purpose wherever practical; we do not share one Customer's transcripts with other Customers.

Where the GDPR, UK GDPR, or similar laws apply, we rely on the following lawful bases for processing: performance of a contract, to set up and provide the Service to Customers; consent, for analytics cookies and any marketing communications, which you may withdraw at any time; legitimate interests, to secure, debug, and improve the Service, weighed against your rights and freedoms; and legal obligation, to comply with applicable law. The Service uses automated processing to answer, transcribe, and route calls and to organize interaction history; it does not make decisions producing legal or similarly significant effects about a Caller without human involvement.

5. How We Share Information

We share information with service providers (sub-processors) that help us operate the Service, under contracts that limit their use of the information to providing services to us. These include: telephony and messaging providers to place and receive calls and texts; speech-processing providers for speech-to-text and text-to-speech; AI and language-model providers to read uploaded documents, recognize text in scanned PDFs, and generate responses; a payment processor for billing; cloud hosting and infrastructure providers to host the Service; integration and connectivity providers; an email delivery provider (an SMTP relay) that carries the email we send to your Account, such as service notices and report digests that contain call summaries; and an identity-verification provider that runs the IRS tax-identification-number match, sanctions screen and USPS address check described in Section 3. We do not send review-request or referral email to your customers. Where you enable it, the ask happens inside a conversation the customer is already in: in a website chat, or spoken by the receptionist during a phone call. Both are off by default, and the phone ask has its own separate switch.

Hosted forms and their AI features. Where a business turns on an AI feature of a form we host for it, the answers typed into that form are sent to our AI and language-model provider to do the job the feature exists for: to answer a question the person filling in the form asks, to ask that person a follow-up question about an answer they have already given, or to summarize and analyze the answers the business has already collected. What we send is the text of the answers concerned and the questions those answers belong to. We route those requests with the zero-retention setting our routing provider offers, so that the request is served and nothing is kept after it. That is a setting we switch on plus the terms the AI company publishes, not a promise we are able to make about the inside of someone else's system, and Section 8 already says what we can and cannot tell you about that step. As Section 4 says, we do not use that content to train third-party or publicly available AI models. Three separate switches all have to agree before any of it happens: our own fleet-wide switch, which is off unless we turn it on and which we can turn off for every business at once; the business's own opt-in, which reads as off and cannot be moved while our switch is off; and a health-regulated exclusion on the account, which blocks the lane whatever the other two say. As of the date of this Policy, none of these form AI features is switched on, and no answers are sent this way.

Accounts you connect are your own accounts, not our sub-processors. Where a Customer connects a scheduling or calendar account, we read availability and create appointments in it. Where a Customer connects a review or social platform (for example, Google or Meta), we read, draft, and manage reviews and messages in that account on the Customer's behalf. We act there because the Customer connected the account, and the Customer can disconnect it at any time. Use of any platform a Customer connects is also subject to that platform's own terms and privacy policy.

External AI apps you connect. When a Customer authorizes an external AI app, such as ChatGPT or Claude, through Model Context Protocol (MCP), we return permitted tool results to that app so it can answer questions about the Customer's business and perform supported, requested workflows. Depending on the authorized OAuth scopes, account access, and tools used, results may include contact details, form questions and answers, call summaries, other business records, and change previews and receipts. MCP call tools do not return call transcripts or recordings. The Customer can review and disconnect the connection in Connected Apps in the dashboard settings. This stops subsequent access under that connection.

We may also disclose information: to comply with law, legal process, or lawful requests; to protect the rights, safety, and property of First AI Employee, our Customers, Callers, or others; and in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy. We do not sell or "share" personal information for cross-context behavioral advertising.

6. Call Recordings and Transcripts

We record calls and generate transcripts of them. Recordings and transcripts are created to provide the Service (for example, to generate accurate messages, bookings, and summaries) and are associated with that Customer's Account. Every call includes a disclosure at its start that the call is being recorded and transcribed. The Service does not proactively announce that the Caller is speaking with an artificial intelligence system, and it never represents itself as a human being: asked whether it is an AI, it says that it is. Audio recordings are retained on a rolling basis for the number of days the Customer selects, from 1 to 14 days; the default is 7 days. They are then deleted; recordings that evidence a caller's consent, or that relate to an active dispute, are preserved as described in Section 7. We do not use recordings to create a voiceprint or other biometric identifier, and we do not use them to identify or verify any individual by their voice. Where the Service recognizes a returning caller, it does so using the caller's telephone number and prior interaction history, not by matching their voice. The Customer controls these records as the controller. As described in our Terms, the Customer is responsible for ensuring that recording, transcription, and AI interaction comply with applicable consent and disclosure laws. We make transcripts available to the Customer and process recordings and transcripts on the Customer's behalf. The Service is not intended for protected health information ("PHI"); Customers must not use it to collect, store, or transmit PHI.

7. Data Retention

We retain personal information for as long as needed to provide the Service and for legitimate business or legal purposes. Audio recordings of calls are retained on a rolling basis for the number of days the Customer selects, from 1 to 14 days; the default is 7 days. They are then deleted, except recordings evidencing consent or relevant to an active dispute, which are retained under categories (a) and (b) below. Call transcripts and Customer Data not governed by the specific file rules below are retained for the life of the Account and deleted within 14 days after account termination.

Our retention and deletion rules in this Section apply to data we hold. Disconnecting an external AI app does not delete copies of results that app already received. Its use, storage, retention, and deletion of those copies depend on that app's own terms, privacy policy, and available settings.

Files follow different rules. Business documents uploaded by the account owner have no set retention period and are kept until a human deletes them or the Account is purged. Temporary customer uploads are deleted after 7 days if they remain unmatched and after 30 days once linked to a job. When a customer upload is saved to a job, the account owner chooses a retention period of 90 days, 1 year, 3 years, or 7 years. That period starts when the job is completed. If the job is never completed, the file is kept without a time limit. After account termination, a saved job file remains until its owner-selected period expires.

A legal hold stops deletion without a time limit. If any file is under a legal hold, an Account purge fails and deletes nothing. There is no Customer-facing control for placing a file under legal hold. A file under legal hold remains after account termination without a time limit.

Deleting a document destroys every stored version and its AI-readable text. The account owner chooses at deletion whether to remove approved facts too. If the owner keeps those facts, they remain live in the assistant after the source document is gone. We retain a deletion record and a content fingerprint. Stopping AI use for a document is not deletion. Residual copies of deleted data remain in encrypted backups for approximately 14 to 15 days.

Other categories also survive account termination or deletion where applicable, including: (a) records evidencing consent and opt-outs (for example, a caller's agreement to be texted or called back, and any do-not-contact request), which we retain for compliance purposes and the establishment, exercise, or defense of legal claims, for five (5) years from the later of the date the record was created, the date it was last relied upon to contact the person it concerns, or the date consent was revoked; (b) records we must keep to comply with legal obligations, resolve disputes, or enforce our agreements; and (c) billing and tax records retained as required by law. Audit records survive Account deletion with their detail cleared; the action, time, and acting user's email remain. Website server logs and any analytics data are retained only as long as needed for security, debugging, and understanding site usage, then deleted or de-identified in the ordinary course. Customers may request earlier deletion of specific records, subject to the file rules above and other technical and legal limitations.

8. Data Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, or misuse. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Section 14 sets out when and how we tell you if a breach happens anyway.

Call recordings, transcripts, account data, backups, and the files you or your callers upload all sit in US regions operated by our hosting provider. One further step is different, and we would rather state it than imply otherwise. The AI language-model step is routed on our behalf to inference providers that are US-headquartered and whose terms forbid training on your data or keeping it beyond serving the request; those providers operate datacenters in more than one country and none of them publishes which datacenter handled an individual request, so we do not represent a processing location for that step. If your business needs a contractual guarantee that no processing leaves the United States, tell us before you subscribe: we will either arrange it in writing or tell you plainly that we cannot.

In ordinary US-only operation we do not process personal data originating from the European Economic Area or the United Kingdom. If we ever agree in writing to do so, we would rely on appropriate safeguards for its transfer to and processing in the United States, such as the European Commission's Standard Contractual Clauses, and we would require our sub-processors to provide equivalent protections.

9. Your Rights and Choices

Depending on where you live, you may have rights regarding your personal information, such as the right to access, correct, delete, or obtain a copy of it, and to object to or restrict certain processing. Callers should direct such requests to the business they called (the controller); we will assist that business. Customers and website users may contact us at [email protected].

As a matter of policy, we extend these core rights to all users, wherever located: to access, correct, delete, and receive a portable electronic copy of your personal information; to object to or restrict certain processing; and to withdraw consent where our processing relies on it. To exercise any of them, email [email protected]; we will respond within 30 days and will tell you if we need a legally permitted extension. If we decline a rights request, you may appeal by emailing [email protected] with "Appeal" in the subject line; we will respond within 45 days, and if we deny the appeal we will provide a means to contact your state Attorney General. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.

For California residents: you may have rights under the California Consumer Privacy Act, as amended, including rights to know, delete, and correct personal information, to opt out of sale or sharing, and, where applicable, to limit our use and disclosure of sensitive personal information. Because we use any sensitive information solely to provide the Service on a business's behalf, the right to limit is generally not triggered, but you may raise any such request at [email protected]. We do not sell or share personal information as those terms are defined. You may exercise these rights by contacting [email protected]; we will not discriminate against you for doing so.

Residents of other U.S. states may have similar rights under applicable state privacy laws; you may exercise them by contacting [email protected]. Our Service is directed to businesses in the United States, and our servers run in the United States, with the storage and AI-inference nuances Section 8 states plainly.

10. Children’s Privacy

The Service and website are intended for businesses and are not directed to children. We do not knowingly retain children's conversational content, and we never ask a caller how old they are. When we learn that a caller is under 18, we retain only the minimal protective marker linked to the caller's phone number described below.

Anyone can dial a business, so we plan for it. If a caller tells our AI receptionist that they are under 18, or makes it plain, the receptionist stops collecting anything, does not ask them to agree to texts or calls, and does not offer reviews, referrals or promotions. If it sounds like an emergency it tells them to hang up and call 911. Otherwise it asks them to have a parent or another adult contact the business, and ends the call politely.

We then delete the recording of that call and replace what was said with a fixed one-line note that a child called and what the receptionist advised. The business sees that note instead of a transcript. The call is flagged in our own systems so the deletion happens, and a job runs every day to catch any call where it did not complete the first time.

What we keep afterwards is a marker on the phone number, so that if the same line calls again the receptionist protects them the same way from the first second. We do not treat that marker as a profile and we do not build one.

If you believe a child's information has been provided to us, contact us at [email protected] and we will delete it.

11. Third-Party Links and Services

Our website and the Service may link to or integrate with third-party services. We are not responsible for the privacy practices of third parties, and their handling of your information is governed by their own policies.

12. Cookies and Similar Technologies

Our website uses two categories of cookies. First, strictly necessary (essential) cookies, for example, a cookie that records your cookie-preference choice, a cookie that remembers a referral code for 30 days when you arrive through someone's referral link so that the person who referred you receives their credit, and any session or security cookies needed to operate the site. These cookies do not track you across other websites, are not used for advertising, and do not require your consent. Second, analytics cookies, which are optional and off by default.

For analytics we use Google Analytics, provided by Google, to understand how visitors use the site (such as pages viewed, approximate location, and general usage patterns). Google Analytics sets cookies and processes this information on our behalf; Google may process it in the United States. These analytics cookies and the Google Analytics script load only after you opt in. When you first visit, a consent banner lets you accept all cookies, reject all non-essential cookies, or choose which categories to allow; analytics is never pre-selected, and rejecting it means the Google Analytics script never loads. You can change your choice at any time (we re-ask periodically), and you can also control cookies through your browser settings, although disabling essential cookies may affect website functionality. We recognize and honor the Global Privacy Control (GPC) browser signal as an opt-out of non-essential analytics.

13. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes affecting Customers, provide notice by email or through the Service. Your continued use after changes take effect constitutes acceptance.

14. Security Incidents and Breach Notification

If we become aware of a breach of security leading to unauthorized access to, or unauthorized disclosure, alteration, loss, or destruction of, personal data we process, we notify affected Customers without undue delay. We do not hold a notice back until an investigation closes. Where facts are still being established, we tell you what we know and follow up as we learn more.

What the notice contains. To the extent we know it at the time, our notice describes what happened and when we learned of it; the categories of personal data and the records or accounts involved; what we are doing to contain and investigate the incident and to reduce the risk of it happening again; and what we recommend you do, including any step only you can take. Anything not yet established is identified as such.

How we reach you. We send these notices by email to the address on your Account, and to any additional security contact you have given us. That address is the channel we rely on during an incident, so keeping it current and monitored is your responsibility; a notice sent to the address on your Account is effective when sent.

Where the affected data is your callers' data. When we act as a service provider/processor for a Customer (see Section 2), the End User information involved belongs to that Customer, who is the controller of it. In that case we notify the Customer, not the Customer's own callers, texters, chat visitors, or emailers, and we support the Customer's notification obligations rather than taking them over: we provide the information the Customer reasonably needs to assess the incident and to make any notification the law requires of it, and we respond to reasonable follow-up requests. We do not notify a Customer's End Users directly unless the law requires us to or the Customer asks us to. Where we are the controller, which covers website visitors and Customer account information, we notify the affected people ourselves.

This Section states our commitment to you. It does not replace, reduce, or satisfy any notification obligation you have under the laws that apply to you, including state breach-notification statutes, and it does not move responsibility for those notifications to us.

Reporting something to us. If you believe you have found a vulnerability in the Service, or you suspect an incident involving data we hold, email [email protected] with "Security" in the subject line. Please include enough detail for us to locate or reproduce the issue, and give us a reasonable opportunity to investigate and fix it before disclosing it publicly.

15. Text Messages and Mobile Information

Text messages we send to account contacts. A mobile number enrolled for account alerts can receive usage alerts and an optional daily text digest of replies waiting for approval. Usage alerts are off by default, and we never text a number to ask for enrollment. To enroll a number, a dashboard user enters it in dashboard settings and switches text alerts on, and someone using that handset then texts the word ALERTS to the Customer's receptionist number. That inbound message is the consent event. We reply once to that ALERTS message to confirm enrollment. After enrollment, we send at most one usage alert in a billing period. If text is selected as the daily digest channel, a digest may be sent at most once per day when one or more replies are waiting. Separately, an account owner or team member with settings access may request a self-test message to a mobile number that has already consented to receive text messages for the Customer. No more than five self-test messages can be sent per account per hour. If the alert number changes, consent does not carry over, and the new handset must be enrolled the same way. Message and data rates may apply.

How to stop them. Reply STOP to any message to opt out. We also honor STOPALL, UNSUBSCRIBE, CANCEL, END, and QUIT. The opt-out is recorded against the mobile number and suppresses ordinary service messages to that number, not only usage alerts. After recording the opt-out, we send one confirmation. If you later text HELP or INFO, we reply with the requested help information. If you later text START or UNSTOP, we remove the opt-out, resubscribe the number, and send a confirmation. You may also switch text alerts off in your dashboard at any time, which needs no text message. Turning alerts off in the dashboard leaves the alert channel unarmed but is not itself an opt-out record; STOP is.

Mobile numbers and consent records. We do not sell mobile numbers or consent to receive text messages, and we do not share either one for third-party marketing or promotional purposes. Operational service providers that host the Service, deliver text messages or email, or provide integration connectivity receive mobile information as needed to do that work. At a Customer's direction, a caller's mobile number may be included in operational email notifications, sent to a configured on-call or escalation contact, passed to a CRM or automation destination such as Zapier or to a configured partner webhook, or sent to a connected Jobber or Housecall Pro account. The Customer selects or configures those destinations for its own operations. We do not send marketing, promotional, or advertising text messages, to Customers or to End Users, and we do not operate a marketing text program.

Text messages the Service sends for a Customer. Where a Customer enables business texting, the Service sends text messages to that Customer's End Users on the Customer's behalf, for example a booking confirmation, a follow-up, or a secure intake link. Nobody is texted before they consent. An End User consents either by saying so during a recorded call with the business or its AI receptionist, or by texting an opt-in keyword to the business's own number, and an outbound text never comes first. The Service honors STOP and the other standard opt-out keywords on every one of those numbers, and an opt-out applies across all of that business's lines. In this activity we act as a service provider/processor and the Customer is the controller (see Section 2), so an End User who wants to exercise rights over their information should contact the business they interacted with; we assist that business.

The records behind a consent or an opt-out. We keep the record that evidences a consent or an opt-out, so that we can show which one applies to a number and can honor it. Section 7 states how long we keep those records and why they survive the deletion of other Customer Data.

16. Contact