Privacy Policy

Who this covers

Two groups of people show up in the service. The first is the business that hires us and the people who work there: the owner, the office admin, the technicians. The second is that business’s customers — the homeowner who calls after hours, gets a text with an appointment, pays an invoice from a phone. We handle a homeowner’s information on behalf of the business they called; the business decides what happens with it, and a homeowner should start with that business for any request about their own data.

[COUNSEL: confirm the controller / processor (or service-provider) framing, and whether the business clients need a separate data-processing agreement referenced from here.]

What we collect

• Call audio and transcripts. Calls the operator answers are recorded and transcribed. The recording and the transcript are what let the operator write up the job, brief the technician, and let the owner check what was actually said.
• Text messages. The SMS and MMS exchanged with the business’s number: booking confirmation, the optional photo ask, the payment link, the review request, and whatever the customer texts back, including keywords like STOP and HELP.
• Customer and job details. Name, phone number, service address, the problem in the caller’s own words, the appointment time, the technician assigned, time on the job, material cost, and the invoice built from those numbers.
• Job photos. A photo the caller texts in before the visit, and the photo the technician takes when the work is done. They ride the job record and go back to the customer with the review request. They are used as marketing material only where the customer has given permission, recorded on that job.
• Payment status. The invoice amount and whether it has been paid. Payment happens on a checkout page hosted by Stripe; card numbers are entered there and never reach our servers or our database.
• Accounting connection. When a business connects QuickBooks, we store the access and refresh tokens Intuit issues for that connection. They are held encrypted (AES-256-GCM, in a versioned envelope) under a key that lives in our secrets configuration and not in the database.
• Account information. For the people who sign in: email address, name, and role in the shop.
• Operational data. Error reports and product analytics. Error reports are scrubbed before they leave the server — phone numbers, email addresses, street addresses, message bodies and transcripts are redacted rather than sent.

Why we collect it

Every item above exists to run one job from the first ring to the receipt: answer the call, book the appointment, brief the technician, send the invoice, take the payment, ask for the review, and push the invoice and payment out to the business’s accounting. We also use this information to keep the service working — fixing errors, watching for calls or texts that failed to deliver, and confirming that an emergency reached the owner. We do not sell personal information, and we do not use a homeowner’s information to advertise to them.

[COUNSEL: confirm whether “we do not sell or share personal information” should be stated in the CCPA/CPRA sense, and add any state-specific rights sections (CA, CO, CT, VA and successors) this policy must carry.]

Calls are recorded

Calls answered by the operator may be recorded and transcribed. The operator says it is an AI assistant, and where a spoken recording notice is required it is played at the start of the call and logged against that call. Recording notice is configured per business and per state, because the obligation is not the same everywhere: some states require only one party to the call to consent, and others require every party.

[COUNSEL: confirm the exact recording-disclosure wording and the list of all-party (two-party) consent states it must be switched on for. The commonly cited list — California, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, Washington — has not been verified by counsel and must not be relied on until it has. New Jersey, where the first business operates, is one-party.]

Text messages and how to stop them

The service texts a customer about their own job: confirming the appointment, asking for a photo of the problem, sending the invoice and a link to pay, and asking for a review once the invoice is settled. Texts go only to a number that has consented, and the consent is recorded. Reply STOP to any message to stop them; STOP is honoured on the number that sent it and the consent record is updated the moment it arrives. Reply HELP for help, or START to turn messages back on. Message and data rates may apply.

[COUNSEL: confirm the TCPA consent language, the required HELP reply text, and whether a carrier-facing messaging-terms page is needed for 10DLC/campaign registration.]

How long we keep it

• Job photos: 90 days. A nightly job deletes photos older than 90 days from storage and clears their rows.
• Call recordings and transcripts. Purged on the business’s retention window, which defaults to 90 days; the recording file is deleted and the transcript column cleared.
• Job, invoice and payment records. Kept for as long as the business is a client, because they are the business’s own books-adjacent records, and then removed on the schedule in the business’s agreement with us.
• Accounting tokens. Deleted when the business disconnects QuickBooks.

[COUNSEL: set the retention period for job, invoice, payment and consent records after the account closes, and confirm whether consent evidence (call and SMS) must be kept longer than the data it describes.]

Who else handles the data

We use these companies to run the service. Each of them handles only what its job needs.

• Supabase — the database, the private storage for recordings and photos, and sign-in.
• Vercel — hosting for the application and its scheduled jobs.
• Twilio — the phone number, the calls, the SMS and MMS, and the carrier lookup that tells us whether a number can receive a text.
• Our voice provider — the speech and conversation for answered calls. Today that is Retell, with xAI’s Grok Voice in migration.
• Stripe — the hosted checkout page and the payment status that comes back from it.
• Intuit — QuickBooks, when a business connects it, receives the invoices and payments we push out.
• Sentry — error monitoring, on scrubbed events.
• PostHog — product analytics for how the application is used.

[COUNSEL: confirm this list matches the signed data-processing agreements before publication, and decide whether it should be a linked page that can be updated with notice rather than prose in the policy.]

Payments

Card details are entered on Stripe’s hosted checkout page. We receive the amount, the reference and whether the payment succeeded — never the card number. While the service is in its pilot the Stripe integration runs in test mode, so no live card charge is taken through it.

[COUNSEL: this test-mode sentence must be removed or rewritten the day live payments are switched on.]

How it is protected

Recordings and photos live in private storage buckets and are reached only through short-lived links the server issues after checking who is asking. Each business’s data is separated at the database level, so one business cannot read another’s. Accounting tokens are encrypted. Error logs are scrubbed of phone numbers, addresses, message bodies and transcripts before they are sent anywhere. No system is perfect, and we do not claim otherwise.

[COUNSEL: add the breach-notification commitment and its timing.]

Access, correction and deletion

A homeowner who wants to see, correct or delete what we hold should ask the business they called; we act on that business’s instruction and will help them carry it out. A business client, or anyone who cannot reach the business, can write to us at privacy@officeoperator.ai and we will answer. Tell us enough to find the record — the phone number the call or text came from is usually enough. Recordings and photos may already have aged out under the retention windows above.

[COUNSEL: confirm the contact address and who monitors it, the response deadline, and the identity-verification step required before acting on a deletion request.]

Changes

When this policy changes we update the date at the top of the page. Material changes will be sent to business clients directly rather than left to be discovered here.