Privacy Policy

Last updated: May 28, 2026

1. Overview

HelloItsAI ("we," "us," or "our") provides an AI voice agent that answers inbound phone calls for home service businesses. This Privacy Policy explains what data we collect, how we use it, and your rights.

It covers three groups of people:

  • Customers — the businesses that hold a HelloItsAI account
  • Callers — the people who ring a Customer's HelloItsAI-provisioned phone number
  • Visitors — anyone who uses the live demo on our website

2. Data We Collect

2a. Account data (Customers)

  • Name, email address, and password (stored hashed, never in plain text) — or, if you choose to sign in with Google, the name, email address, and profile picture Google provides
  • Organization name and business details you provide
  • Billing information, processed by Stripe; we never receive or store card numbers
  • Business information content and configuration settings you upload

2b. Call data (from inbound callers)

  • Caller phone number (caller ID), where the caller has not withheld it
  • The caller's name, where they give it to the AI during the call
  • A text transcript of the conversation, produced as the call happens
  • An AI-generated summary and outcome, plus any notes the AI logs during the call
  • Appointment details captured on the call: requested time, purpose, and contact details
  • Call timestamp and duration

We do not record or retain call audio. See Section 4.

2c. Website demo data (Visitors)

If you try the live demo on our homepage, your browser streams your microphone to our voice provider so the AI can hear you. Your browser asks your permission first, and the demo does not run if you decline. That audio is processed as you speak and is not recorded.

Nothing from a demo call is written to our database. The demo agent is deliberately built with no connection back to our systems: it cannot create records, send messages, or store anything.

2d. Usage and technical data

  • Log data, IP addresses, browser type, and pages visited in the dashboard
  • Aggregate usage statistics (minutes used, call counts)

2e. SMS notification data (Customers who opt in)

  • Mobile phone number and the SMS notification preferences you select
  • Opt-in record: timestamp, IP address, browser user agent, and consent version

See Section 13 for how we use your mobile number and how to opt out.

3. How We Use Data

  • To provide, maintain, and improve the Service
  • To answer inbound calls and generate AI responses on behalf of Customers
  • To create and display call logs, transcripts, and service requests in Customer dashboards
  • To detect and prevent abuse, fraud, and violations of our Terms of Service
  • To communicate with Customers about their accounts, service updates, and support requests
  • To comply with legal obligations

We do not sell personal data to third parties. We do not use call transcripts to train AI models.

4. Calls Are Not Recorded

All inbound calls to a HelloItsAI-provisioned phone number are answered by an AI voice agent. Speech is converted to text as the call happens, and at the end of the call we store a transcript and an AI-generated summary for the Customer whose number was called.

The audio itself is not recorded and is not retained. There is no recording to play back, download, or produce — not for the Customer, not for us, and not for anyone else.

Customers are responsible for telling callers that their calls are answered and handled by an AI agent where local law requires it. If we introduce optional call recording in future, it will be off by default, will require the Customer to switch it on deliberately, and will announce the recording to the caller at the start of the call. We will update this policy before that happens.

5. Google User Data

We use Google in two separate, independent ways. Both are optional, and this section applies in addition to the rest of this policy.

5a. Signing in with Google

If you choose "Continue with Google", Google gives us your name, email address, and profile picture. We use them only to create and authenticate your HelloItsAI account. Sign-in does not request access to your Gmail, Drive, Calendar, or contacts, and we never post anything to your Google account. You can use an email address and password instead.

5b. Connecting Google Sheets and Calendar

This is a feature a Customer switches on from Settings, and none of what follows happens unless you connect it. When you do, we request exactly three permissions:

  • https://www.googleapis.com/auth/spreadsheets
    To create a spreadsheet named "HelloItsAI Activity Log" in your Google Drive, and to append one row to it per call, lead, or appointment. We also read that spreadsheet's title, and nothing else, to show you whether the connection is still working. We never read the contents of any cell, or of any other spreadsheet in your Drive.
  • https://www.googleapis.com/auth/calendar.readonly
    To run a free/busy check before booking, so the AI does not offer a caller a time you are already busy. This returns only the start and end times of your busy periods. We do not read event titles, descriptions, locations, attendees, or any other event content.
  • https://www.googleapis.com/auth/calendar.events
    To create a single calendar event when the AI books an appointment during a call. We do not modify or delete events we did not create.

What we send to Google

Only data generated by your own HelloItsAI calls:

  • Activity Log, Calls tab: timestamp, call outcome, the AI-generated summary, call duration
  • Activity Log, Leads tab: timestamp, caller phone number, caller name, summary
  • Activity Log, Appointments tab: timestamp, status, the appointment time or the caller's preferred times, purpose, subject, contact name, contact phone number
  • Calendar event: the purpose and subject as the event title, the start and end time, and the caller's name and phone number in the event description

What we store

Your Google access and refresh tokens, encrypted with AES-256-GCM before they are written to our database; the list of permissions you granted; the ID of the Activity Log spreadsheet; and the ID of each calendar event we create, so a booking can be referenced later. That is the complete list. No content from your Google account is copied into our database. We do not store your spreadsheets, your cell values, your calendar, or your events.

What we never do

We do not sell Google user data. We do not use it for advertising. We do not use it to train AI models. We do not transfer it to anyone other than the infrastructure providers in Section 6 who run the Service on our behalf. HelloItsAI staff do not read it, except where you ask us to in order to support you, where it is necessary for security, or where the law requires it.

How to disconnect or revoke access

  • In HelloItsAI: Notifications → Google → Disconnect. This immediately deletes the tokens we hold. Your Activity Log spreadsheet and any events already booked stay in your Google account — they are yours.
  • At Google: go to myaccount.google.com/permissions and remove HelloItsAI. This revokes our access at the source and is the more thorough of the two.

6. Data Sharing

We do not sell personal data. We share it with the providers that run the Service on our behalf, each bound by a data processing agreement and prohibited from using your data for their own purposes:

  • Vercel: application hosting; receives all request traffic, including IP addresses and server logs
  • Neon: the Postgres database holding account data, transcripts, and summaries
  • Vapi AI: the AI voice platform that answers and handles calls, together with the providers it uses on our behalf to do so — currently Deepgram (speech to text), OpenAI (language model), and ElevenLabs (voice)
  • Twilio, Inc.: telephony for inbound numbers, and delivery of SMS notifications
  • Stripe: subscription billing; receives your name, email, and payment details, which Stripe handles and we never store
  • Resend: delivery of transactional email such as verification, password reset, and notifications
  • Google Analytics: page views and a small set of named events (Section 7), on our Production deployment only

Data also goes to services you choose to connect from your dashboard, and only once you connect them: Google Sheets and Calendar (Section 5), Slack, Zapier, and email notifications to addresses you nominate.

We disclose data to law enforcement or regulators when required by law or valid legal process.

7. Cookies

We set one cookie: a session cookie created when you sign in, which keeps you signed in and identifies your organization. It is strictly necessary to operate the dashboard and cannot be turned off while you are signed in. Clearing it signs you out.

We do not use advertising cookies or third-party tracking cookies. Our web fonts are served from our own domain rather than a font provider's, so loading a page does not disclose your visit to anyone else on that account.

We use Google Analytics (GA4) to see how the site is found and used — page views, and a small set of named events such as starting sign-up or finishing onboarding. Google Analytics sets its own cookies to do this. We do not send it your name, email address, phone number, or call transcripts, and we do not use it for advertising or share it with advertisers. It runs on our Production deployment only — never on a preview deployment, and never in local development.

8. Data Retention

  • Account and call data— transcripts, summaries, caller numbers, notes, and appointments — is kept for as long as your account exists, whether or not it is active. We do not delete it on a timer: it is the record of your business's calls, and it is useful to you for as long as you have an account.
  • After an account is deleted or terminated, the data associated with it is deleted within 30 days, except where the law requires us to keep it.
  • SMS consent records — the opt-in timestamp, IP address, user agent, and consent version — are kept for 5 years, including after you opt out or close your account. Where a message was sent, the law places the burden of proving consent on us, so this record has to outlive the consent itself.
  • Google tokens are deleted the moment you disconnect the integration.
  • Billing records are kept for as long as tax and accounting law requires.

To request deletion of your data, email hello@helloitsai.com. We will action it within 30 days.

9. Security

We encrypt data in transit with TLS, and our infrastructure providers encrypt it at rest. Account passwords are stored hashed, never in plain text. Credentials for the third-party services you connect — including your Google tokens — are additionally encrypted by the application with AES-256-GCM before they reach the database, so they are unreadable in the database itself. Access to each organization's data is scoped to that organization and checked on every request. No method of transmission or storage is 100% secure; we cannot guarantee absolute security but take reasonable precautions to protect your data.

10. Your Rights

Depending on your location, you may have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data (subject to legal retention obligations)
  • Object to or restrict certain processing
  • Port your data to another provider

To exercise these rights, contact us at hello@helloitsai.com. We will respond within 30 days.

11. California Privacy Rights (CCPA)

California residents have the right to know what personal information we collect, to request deletion, and to opt out of the sale of personal information. We do not sell personal information. To submit a request, email us at hello@helloitsai.com.

12. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

13. SMS Notifications & Mobile Numbers

If you opt in to SMS notifications, we collect your mobile phone number solely to send you transactional and operational messages related to your HelloItsAI account. We will never:

  • Share, sell, rent, or disclose your mobile number to third parties for marketing purposes
  • Use your mobile number to send promotional or advertising messages without separate explicit consent

Message frequency varies based on account activity and your selected notification preferences. Message and data rates may apply depending on your mobile carrier plan.

To opt out: Reply STOP to any SMS message at any time, or disable SMS notifications from your account settings. You will receive a single confirmation message and no further SMS will be sent until you re-enroll. Reply HELP for help.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify Customers of material changes by email. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

15. Contact Us

For privacy-related questions or requests, contact:
HelloItsAI
Email: hello@helloitsai.com