Privacy Policy

1. Introduction

This Privacy Policy explains how First AI Employee LLC ("First AI Employee," "we," "us," or "our") collects, uses, shares, and protects information in connection with our AI-powered receptionist and front-desk services (the "Service") and our website at https://firstaiemployee.com. Please read it together with our Terms of Service. By using the Service or our website, you acknowledge the practices described here.

2. Our Two Roles: Controller and Processor

We handle personal information in two distinct capacities. First, for visitors to our website and for the businesses that hold accounts with us ("Customers"), we act as a controller of that information and this Policy describes our practices. Second, when we answer calls, exchange text messages, operate a website chat agent, and help manage reviews and email on behalf of a Customer, including the personal information of the people who call, text, chat with, review, or email that Customer (collectively, "End Users"), we act as a service provider/processor on that Customer's behalf. In that role, the Customer is the controller of the End User information and is responsible for the lawful basis, notices, and consents for that processing, and our handling of that information is governed by our agreement with the Customer. If you are an End User and wish to exercise rights over your information, please contact the business you interacted with; we will assist that business as required.

3. Information We Collect

From Customers: business contact details (such as name, business name, email, and phone number), account credentials, billing information (processed by our payment processor; we do not store full card numbers), and the business configuration you provide (hours, services, pricing, FAQs, scripts, routing and escalation rules).

From End Users, on behalf of Customers: telephone number and caller ID information; recordings and transcripts of calls; the content of text and SMS messages and of website-chat conversations; the content of online reviews and of inbound and outbound email that a Customer asks us to help manage; voicemail and messages; appointment details; documents and information an End User provides through a secure intake link or during an interaction; and interaction metadata such as time, duration, channel, and outcome. Some intake information may be sensitive (for example, documents provided to a legal or accounting practice); we process it only to provide the Service on the Customer's behalf and hold it under the security and retention practices described below. The Service is not intended for special-category or sensitive personal data (such as health, genetic, or biometric-identification data), and Customers must not submit it. The Service is not intended for protected health information (see Section 6).

Automatically from our website: device and browser information, IP address, and pages viewed, recorded in standard server logs. With your consent, we also use Google Analytics to understand how the site is used (for example, pages visited, approximate location, and general usage patterns), collected through cookies. Analytics cookies load only after you opt in through our cookie banner; if you decline, only essential cookies are used. See Section 12 for details and how to change your choice.

4. How We Use Information

We use information to: provide and operate the Service, including answering calls, texts, and website chats; transcribing and routing communications; booking appointments; recognizing a returning caller by their telephone number and prior interaction history to provide continuity of service (recognizing them by number, not by a voiceprint); and, where a Customer enables those features, drafting and sending replies to the Customer's online reviews and inbound email and generating summaries and reports; set up and maintain Accounts and configurations; process payments and manage subscriptions; provide customer support; secure, monitor, debug, and improve the Service; and comply with legal obligations and enforce our Terms. We do not sell personal information. We do not use Customer Content, Customer Data, or Caller information to train third-party or publicly available AI models. We do use your own business's information and call history to build, tune, and improve your own AI agent (that is the Service) and we may use transcripts and related data internally to improve the Service, using de-identified data for that purpose wherever practical; we do not share one Customer's transcripts with other Customers.

Where the GDPR, UK GDPR, or similar laws apply, we rely on the following lawful bases for processing: performance of a contract, to set up and provide the Service to Customers; consent, for analytics cookies and any marketing communications, which you may withdraw at any time; legitimate interests, to secure, debug, and improve the Service, weighed against your rights and freedoms; and legal obligation, to comply with applicable law. The Service uses automated processing to answer, transcribe, and route calls and to organize interaction history; it does not make decisions producing legal or similarly significant effects about a Caller without human involvement.

5. How We Share Information

We share information with service providers (sub-processors) that help us operate the Service, under contracts that limit their use of the information to providing services to us. These include: telephony and messaging providers to place and receive calls and texts; speech-processing providers for speech-to-text and text-to-speech; AI and language-model providers to generate responses; a payment processor for billing; cloud hosting and infrastructure providers to host the Service; integration and connectivity providers; scheduling and calendar providers, used only when a Customer connects a calendar, to read availability and create appointments; and review, social, and email platforms (for example, Google and Meta), used only where a Customer connects them so we can read, draft, and manage reviews, messages, and email replies on the Customer's behalf. Your use of any platform you connect is also subject to that platform's own terms and privacy policy.

We may also disclose information: to comply with law, legal process, or lawful requests; to protect the rights, safety, and property of First AI Employee, our Customers, Callers, or others; and in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy. We do not sell or "share" personal information for cross-context behavioral advertising.

6. Call Recordings and Transcripts

We record calls and generate transcripts of them. Recordings and transcripts are created to provide the Service (for example, to generate accurate messages, bookings, and summaries) and are associated with that Customer's Account. Every call includes a disclosure at its start that the call is being recorded and transcribed and that the Caller is speaking with an AI. Audio recordings are retained on a rolling basis for approximately 90 days and then deleted; recordings that evidence a caller's consent, or that relate to an active dispute, are preserved as described in Section 7. We do not use recordings to create a voiceprint or other biometric identifier, and we do not use them to identify or verify any individual by their voice. Where the Service recognizes a returning caller, it does so using the caller's telephone number and prior interaction history, not by matching their voice. The Customer controls these records as the controller. As described in our Terms, the Customer is responsible for ensuring that recording, transcription, and AI interaction comply with applicable consent and disclosure laws. We make transcripts available to the Customer and process recordings and transcripts on the Customer's behalf. The Service is not intended for protected health information ("PHI"); Customers must not use it to collect, store, or transmit PHI.

7. Data Retention

We retain personal information for as long as needed to provide the Service and for legitimate business or legal purposes. Audio recordings of calls are retained on a rolling basis for approximately 90 days and then deleted, except recordings evidencing consent or relevant to an active dispute, which are retained under categories (a) and (b) below. Call transcripts and other Customer Data are retained for the life of the Account (they are your business records, and the Service is built around your ability to refer back to them) and deleted within 14 days after account termination. Three narrow categories survive that deletion: (a) records evidencing consent and opt-outs (for example, a caller's agreement to be texted or called back, and any do-not-contact request), which we retain for five (5) years from creation for compliance purposes and the establishment, exercise, or defense of legal claims; (b) records we must keep to comply with legal obligations, resolve disputes, or enforce our agreements, including records subject to a litigation hold; and (c) billing and tax records retained as required by law. Residual copies in encrypted backups are purged in the ordinary backup rotation. Website server logs and any analytics data are retained only as long as needed for security, debugging, and understanding site usage, then deleted or de-identified in the ordinary course. Customers may request earlier deletion of specific records, subject to technical and legal limitations.

8. Data Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, or misuse. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

All infrastructure and machine processing of personal data occurs on servers located in the United States, in the regions operated by our service providers.

In ordinary US-only operation we do not process personal data originating from the European Economic Area or the United Kingdom. If we ever agree in writing to do so, we would rely on appropriate safeguards for its transfer to and processing in the United States, such as the European Commission's Standard Contractual Clauses, and we would require our sub-processors to provide equivalent protections.

9. Your Rights and Choices

Depending on where you live, you may have rights regarding your personal information, such as the right to access, correct, delete, or obtain a copy of it, and to object to or restrict certain processing. Callers should direct such requests to the business they called (the controller); we will assist that business. Customers and website users may contact us at [email protected].

As a matter of policy, we extend these core rights to all users, wherever located: to access, correct, delete, and receive a portable electronic copy of your personal information; to object to or restrict certain processing; and to withdraw consent where our processing relies on it. To exercise any of them, email [email protected]; we will respond within 30 days and will tell you if we need a legally permitted extension. If we decline a rights request, you may appeal by emailing [email protected] with "Appeal" in the subject line; we will respond within 45 days, and if we deny the appeal we will provide a means to contact your state Attorney General. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.

For California residents: you may have rights under the California Consumer Privacy Act, as amended, including rights to know, delete, and correct personal information, to opt out of sale or sharing, and, where applicable, to limit our use and disclosure of sensitive personal information. Because we use any sensitive information solely to provide the Service on a business's behalf, the right to limit is generally not triggered, but you may raise any such request at [email protected]. We do not sell or share personal information as those terms are defined. You may exercise these rights by contacting [email protected]; we will not discriminate against you for doing so.

Residents of other U.S. states may have similar rights under applicable state privacy laws; you may exercise them by contacting [email protected]. Our Service is directed to businesses in the United States, and all processing takes place on servers located in the United States.

10. Children’s Privacy

The Service and website are intended for businesses and are not directed to children. We do not knowingly collect personal information from children. If you believe a child's information has been provided to us, contact us at [email protected] and we will take appropriate steps to delete it.

11. Third-Party Links and Services

Our website and the Service may link to or integrate with third-party services. We are not responsible for the privacy practices of third parties, and their handling of your information is governed by their own policies.

12. Cookies and Similar Technologies

Our website uses two categories of cookies. First, strictly necessary (essential) cookies, for example, a cookie that records your cookie-preference choice and any session or security cookies needed to operate the site. These cookies do not track you across other websites, are not used for advertising, and do not require your consent. Second, analytics cookies, which are optional and off by default.

For analytics we use Google Analytics, provided by Google, to understand how visitors use the site (such as pages viewed, approximate location, and general usage patterns). Google Analytics sets cookies and processes this information on our behalf; Google may process it in the United States. These analytics cookies and the Google Analytics script load only after you opt in. When you first visit, a consent banner lets you accept all cookies, reject all non-essential cookies, or choose which categories to allow; analytics is never pre-selected, and rejecting it means the Google Analytics script never loads. You can change your choice at any time (we re-ask periodically), and you can also control cookies through your browser settings, although disabling essential cookies may affect website functionality. We recognize and honor the Global Privacy Control (GPC) browser signal as an opt-out of non-essential analytics.

13. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes affecting Customers, provide notice by email or through the Service. Your continued use after changes take effect constitutes acceptance.

14. Contact