Privacy Policy

1. Introduction

This Privacy Policy explains how First AI Employee LLC ("First AI Employee," "we," "us," or "our") collects, uses, shares, and protects information in connection with our AI-powered receptionist and front-desk services (the "Service") and our website at https://firstaiemployee.com. Please read it together with our Terms of Service. By using the Service or our website, you acknowledge the practices described here.

2. Our Two Roles: Controller and Processor

We handle personal information in two distinct capacities. First, for visitors to our website and for the businesses that hold accounts with us ("Customers"), we act as a controller of that information and this Policy describes our practices. Second, when we answer calls, exchange text messages, operate a website chat agent, and help manage reviews and email on behalf of a Customer, including the personal information of the people who call, text, chat with, review, or email that Customer (collectively, "End Users"), we act as a service provider/processor on that Customer's behalf. In that role, the Customer is the controller of the End User information and is responsible for the lawful basis, notices, and consents for that processing, and our handling of that information is governed by our agreement with the Customer. If you are an End User and wish to exercise rights over your information, please contact the business you interacted with; we will assist that business as required.

3. Information We Collect

From Customers: business contact details (such as name, business name, email, and phone number), account credentials, billing information (processed by our payment processor; we do not store full card numbers), and the business configuration you provide (hours, services, pricing, FAQs, scripts, routing and escalation rules).

Also from Customers, where business texting is enabled: your business's Employer Identification Number (EIN), collected once from the account owner. US carrier registration (10DLC) requires the business behind a texting number to be verified, so we send the EIN, with your legal business name and address, to our identity-verification provider, which runs an IRS tax-identification-number match and a sanctions (OFAC) screen. We do not store the EIN, in whole or in part. What we keep is the result of the check, the legal name and address you gave us, and what the provider reported back about that name and address.

From End Users, on behalf of Customers: telephone number and caller ID information; recordings and transcripts of calls; the content of text and SMS messages and of website-chat conversations; the content of online reviews and of inbound and outbound email that a Customer asks us to help manage; voicemail and messages; appointment details; documents and information an End User provides through a secure intake link or during an interaction; and interaction metadata such as time, duration, channel, and outcome, including, for secure-intake uploads, technical connection data such as IP address and device or browser information that we retain to operate the Service and to help detect and prevent abuse or misuse. Some intake information may be sensitive (for example, documents provided to a legal or accounting practice); we process it only to provide the Service on the Customer's behalf and hold it under the security and retention practices described below. The Service is not intended for special-category or sensitive personal data (such as health, genetic, or biometric-identification data), and Customers must not submit it. The Service is not intended for protected health information (see Section 6).

Automatically from our website: device and browser information, IP address, and pages viewed, recorded in standard server logs. With your consent, we also use Google Analytics to understand how the site is used (for example, pages visited, approximate location, and general usage patterns), collected through cookies. Analytics cookies load only after you opt in through our cookie banner; if you decline, only essential cookies are used. See Section 12 for details and how to change your choice.

4. How We Use Information

We use information to: provide and operate the Service, including answering calls, texts, and website chats; transcribing and routing communications; booking appointments; recognizing a returning caller by their telephone number and prior interaction history to provide continuity of service (recognizing them by number, not by a voiceprint); and, where a Customer enables those features, drafting and sending replies to the Customer's online reviews and inbound email and generating summaries and reports; set up and maintain Accounts and configurations; process payments and manage subscriptions; provide customer support; secure, monitor, debug, and improve the Service; and comply with legal obligations and enforce our Terms. We do not sell personal information. We do not use Customer Content, Customer Data, or Caller information to train third-party or publicly available AI models. We do use your own business's information and call history to build, tune, and improve your own AI agent (that is the Service) and we may use transcripts and related data internally to improve the Service, using de-identified data for that purpose wherever practical; we do not share one Customer's transcripts with other Customers.

Where the GDPR, UK GDPR, or similar laws apply, we rely on the following lawful bases for processing: performance of a contract, to set up and provide the Service to Customers; consent, for analytics cookies and any marketing communications, which you may withdraw at any time; legitimate interests, to secure, debug, and improve the Service, weighed against your rights and freedoms; and legal obligation, to comply with applicable law. The Service uses automated processing to answer, transcribe, and route calls and to organize interaction history; it does not make decisions producing legal or similarly significant effects about a Caller without human involvement.

5. How We Share Information

We share information with service providers (sub-processors) that help us operate the Service, under contracts that limit their use of the information to providing services to us. These include: telephony and messaging providers to place and receive calls and texts; speech-processing providers for speech-to-text and text-to-speech; AI and language-model providers to generate responses; a payment processor for billing; cloud hosting and infrastructure providers to host the Service; integration and connectivity providers; an email delivery provider (an SMTP relay) that carries the mail we send on your behalf, including report digests that contain call summaries and the review and referral emails you ask us to send; an identity-verification provider that runs the IRS tax-identification-number match and sanctions screen described in Section 3; scheduling and calendar providers, used only when a Customer connects a calendar, to read availability and create appointments; and review, social, and email platforms (for example, Google and Meta), used only where a Customer connects them so we can read, draft, and manage reviews, messages, and email replies on the Customer's behalf. Your use of any platform you connect is also subject to that platform's own terms and privacy policy.

We may also disclose information: to comply with law, legal process, or lawful requests; to protect the rights, safety, and property of First AI Employee, our Customers, Callers, or others; and in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy. We do not sell or "share" personal information for cross-context behavioral advertising.

6. Call Recordings and Transcripts

We record calls and generate transcripts of them. Recordings and transcripts are created to provide the Service (for example, to generate accurate messages, bookings, and summaries) and are associated with that Customer's Account. Every call includes a disclosure at its start that the call is being recorded and transcribed. The Service does not proactively announce that the Caller is speaking with an artificial intelligence system, and it never represents itself as a human being: asked whether it is an AI, it says that it is. Audio recordings are retained on a rolling basis for approximately 7 days and then deleted; recordings that evidence a caller's consent, or that relate to an active dispute, are preserved as described in Section 7. We do not use recordings to create a voiceprint or other biometric identifier, and we do not use them to identify or verify any individual by their voice. Where the Service recognizes a returning caller, it does so using the caller's telephone number and prior interaction history, not by matching their voice. The Customer controls these records as the controller. As described in our Terms, the Customer is responsible for ensuring that recording, transcription, and AI interaction comply with applicable consent and disclosure laws. We make transcripts available to the Customer and process recordings and transcripts on the Customer's behalf. The Service is not intended for protected health information ("PHI"); Customers must not use it to collect, store, or transmit PHI.

7. Data Retention

We retain personal information for as long as needed to provide the Service and for legitimate business or legal purposes. Audio recordings of calls are retained on a rolling basis for approximately 7 days and then deleted, except recordings evidencing consent or relevant to an active dispute, which are retained under categories (a) and (b) below. Call transcripts and other Customer Data are retained for the life of the Account (they are your business records, and the Service is built around your ability to refer back to them) and deleted within 14 days after account termination. Narrow categories survive that deletion, including: (a) records evidencing consent and opt-outs (for example, a caller's agreement to be texted or called back, and any do-not-contact request), which we retain for compliance purposes and the establishment, exercise, or defense of legal claims, for five (5) years from the later of the date the record was created, the date it was last relied upon to contact the person it concerns, or the date consent was revoked; (b) records we must keep to comply with legal obligations, resolve disputes, or enforce our agreements, including records subject to a litigation hold; and (c) billing and tax records retained as required by law. Residual copies in encrypted backups are purged in the ordinary backup rotation. Website server logs and any analytics data are retained only as long as needed for security, debugging, and understanding site usage, then deleted or de-identified in the ordinary course. Customers may request earlier deletion of specific records, subject to technical and legal limitations.

8. Data Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, or misuse. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Section 14 sets out when and how we tell you if a breach happens anyway.

Call recordings, transcripts, account data, and backups sit in US regions operated by our hosting provider. Files you or your callers upload sit in object storage that we lock to North American locations; that provider commits to North America rather than to one country, so we say North America instead of promising narrower than we can prove. One further step is different, and we would rather state it than imply otherwise. The AI language-model step is routed on our behalf to inference providers that are US-headquartered and whose terms forbid training on your data or keeping it beyond serving the request; those providers operate datacenters in more than one country and none of them publishes which datacenter handled an individual request, so we do not represent a processing location for that step. If your business needs a contractual guarantee that no processing leaves the United States, tell us before you subscribe: we will either arrange it in writing or tell you plainly that we cannot.

In ordinary US-only operation we do not process personal data originating from the European Economic Area or the United Kingdom. If we ever agree in writing to do so, we would rely on appropriate safeguards for its transfer to and processing in the United States, such as the European Commission's Standard Contractual Clauses, and we would require our sub-processors to provide equivalent protections.

9. Your Rights and Choices

Depending on where you live, you may have rights regarding your personal information, such as the right to access, correct, delete, or obtain a copy of it, and to object to or restrict certain processing. Callers should direct such requests to the business they called (the controller); we will assist that business. Customers and website users may contact us at privacy@firstaiemployee.com.

As a matter of policy, we extend these core rights to all users, wherever located: to access, correct, delete, and receive a portable electronic copy of your personal information; to object to or restrict certain processing; and to withdraw consent where our processing relies on it. To exercise any of them, email privacy@firstaiemployee.com; we will respond within 30 days and will tell you if we need a legally permitted extension. If we decline a rights request, you may appeal by emailing privacy@firstaiemployee.com with "Appeal" in the subject line; we will respond within 45 days, and if we deny the appeal we will provide a means to contact your state Attorney General. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.

For California residents: you may have rights under the California Consumer Privacy Act, as amended, including rights to know, delete, and correct personal information, to opt out of sale or sharing, and, where applicable, to limit our use and disclosure of sensitive personal information. Because we use any sensitive information solely to provide the Service on a business's behalf, the right to limit is generally not triggered, but you may raise any such request at privacy@firstaiemployee.com. We do not sell or share personal information as those terms are defined. You may exercise these rights by contacting privacy@firstaiemployee.com; we will not discriminate against you for doing so.

Residents of other U.S. states may have similar rights under applicable state privacy laws; you may exercise them by contacting privacy@firstaiemployee.com. Our Service is directed to businesses in the United States, and our servers run in the United States, with the storage and AI-inference nuances Section 8 states plainly.

10. Children’s Privacy

The Service and website are intended for businesses and are not directed to children. We do not knowingly collect personal information from children. If you believe a child's information has been provided to us, contact us at privacy@firstaiemployee.com and we will take appropriate steps to delete it.

11. Third-Party Links and Services

Our website and the Service may link to or integrate with third-party services. We are not responsible for the privacy practices of third parties, and their handling of your information is governed by their own policies.

12. Cookies and Similar Technologies

Our website uses two categories of cookies. First, strictly necessary (essential) cookies, for example, a cookie that records your cookie-preference choice, a cookie that remembers a referral code for 30 days when you arrive through someone's referral link so that the person who referred you receives their credit, and any session or security cookies needed to operate the site. These cookies do not track you across other websites, are not used for advertising, and do not require your consent. Second, analytics cookies, which are optional and off by default.

For analytics we use Google Analytics, provided by Google, to understand how visitors use the site (such as pages viewed, approximate location, and general usage patterns). Google Analytics sets cookies and processes this information on our behalf; Google may process it in the United States. These analytics cookies and the Google Analytics script load only after you opt in. When you first visit, a consent banner lets you accept all cookies, reject all non-essential cookies, or choose which categories to allow; analytics is never pre-selected, and rejecting it means the Google Analytics script never loads. You can change your choice at any time (we re-ask periodically), and you can also control cookies through your browser settings, although disabling essential cookies may affect website functionality. We recognize and honor the Global Privacy Control (GPC) browser signal as an opt-out of non-essential analytics.

13. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes affecting Customers, provide notice by email or through the Service. Your continued use after changes take effect constitutes acceptance.

14. Security Incidents and Breach Notification

If we become aware of a breach of security leading to unauthorized access to, or unauthorized disclosure, alteration, loss, or destruction of, personal data we process, we notify affected Customers without undue delay. We do not hold a notice back until an investigation closes. Where facts are still being established, we tell you what we know and follow up as we learn more.

What the notice contains. To the extent we know it at the time, our notice describes what happened and when we learned of it; the categories of personal data and the records or accounts involved; what we are doing to contain and investigate the incident and to reduce the risk of it happening again; and what we recommend you do, including any step only you can take. Anything not yet established is identified as such.

How we reach you. We send these notices by email to the address on your Account, and to any additional security contact you have given us. That address is the channel we rely on during an incident, so keeping it current and monitored is your responsibility; a notice sent to the address on your Account is effective when sent.

Where the affected data is your callers' data. When we act as a service provider/processor for a Customer (see Section 2), the End User information involved belongs to that Customer, who is the controller of it. In that case we notify the Customer, not the Customer's own callers, texters, chat visitors, or emailers, and we support the Customer's notification obligations rather than taking them over: we provide the information the Customer reasonably needs to assess the incident and to make any notification the law requires of it, and we respond to reasonable follow-up requests. We do not notify a Customer's End Users directly unless the law requires us to or the Customer asks us to. Where we are the controller, which covers website visitors and Customer account information, we notify the affected people ourselves.

This Section states our commitment to you. It does not replace, reduce, or satisfy any notification obligation you have under the laws that apply to you, including state breach-notification statutes, and it does not move responsibility for those notifications to us.

Reporting something to us. If you believe you have found a vulnerability in the Service, or you suspect an incident involving data we hold, email privacy@firstaiemployee.com with "Security" in the subject line. Please include enough detail for us to locate or reproduce the issue, and give us a reasonable opportunity to investigate and fix it before disclosing it publicly.

15. Contact