Privacy Policy

1. Who We Are and What This Policy Covers

ProFront ("we," "us") provides an AI-powered front office for businesses. This policy explains what personal information we collect, how we use it, and the choices available. It covers our websites, dashboard, and the AI communication services we operate for our business customers.

Two roles matter throughout:

• For our customers (the businesses that sign up), we are the "business"/controller for their account information.
• For their customers and callers (the people who talk to a business's AI assistant), we act as a service provider/processor on the business's behalf. The business is responsible for its own privacy notices to its customers. Section 7 covers this in detail.

2. Information We Collect

• Account data: name, business name, email, phone, password credentials, team member details, plan and settings.
• Business knowledge: content you upload or configure for your assistant (FAQs, documents, business details, staff and contact directories).
• Conversation records: for calls, texts, and chats handled by the Service — transcripts; call recordings; message content; caller/contact identifiers such as phone numbers, names, and emails; and structured records of the actions the assistant took during a conversation (for example, a booking created or a message sent), together with snapshots of the configuration in effect.
• Contact permission records: when one of our customers' contacts agrees to receive texts or calls, or opts out, we keep a record of what they agreed to, when, the exact wording they saw or heard, their answer in their own words, and the call or chat it happened in.
• Caller records: for each business that uses the Service, we keep a short record of each phone number that has contacted it, so the assistant can recognise a returning caller. It holds the number, a name if the caller gave one, how many times they called, when they first and last called, how the last call ended, their next booked appointment, whether the number is a mobile, landline or internet line, and a trust level the Service works out to decide how much detail to give before the caller is verified. Each business has its own separate record; a caller's record at one business is never visible to, or combined with, another business's.
• Appointments and contacts: records the Service creates or manages for the business.
• Billing data: subscription and usage records; payment card details are collected by our payment processor (Stripe), not stored by us.
• Usage and device data: log, device, and interaction data for the dashboard and websites. We use cookieless analytics and only strictly necessary cookies (sign-in, security, payment). No advertising trackers.
• Demo data: if you request a demo, the business details and contact info you provide, used to generate and deliver the demo.

3. How We Use Information

We use the information above to:

1. Provide the Service — answer and conduct conversations, take messages, book appointments, send communications the business has configured or requested, and maintain the dashboard.
2. Operate automated quality and safety review. We run automated checks on every conversation record (deterministic rules) and AI-assisted review on flagged or sampled conversations, to detect safety issues, abuse, malfunction, quality drift, and compliance risks.
3. Take bounded protective actions when review detects likely harm — for example reverting a recent configuration change or holding a capability — surfaced to the affected business in its dashboard.
4. Validate improvements ("replay"). We may re-run past conversations against updated software or configuration in a sandboxed environment that never contacts a real person.
5. Improve the platform using de-identified and aggregated patterns across customers (Section 12). We do not use your customers' personal information to train third-party foundation models.
6. Bill, secure, and support — process payments, prevent fraud and abuse, provide support, meet legal obligations.
7. Communicate with our customers — service notices, and marketing to business contacts with unsubscribe honored.

4. AI Processing

We process conversations handled by the Service, and other content you ask us to process (such as translating the alerts we send you into your chosen language), with AI systems, including third-party large-language-model and voice providers acting as our subprocessors. Model providers are contractually restricted to processing conversation content to provide the Service; they do not use it to train their models, and any retention on their side is limited to transient operational purposes such as response caching and abuse prevention under their agreements with us.

5. Third-Party Service Providers

We share personal information only with service providers that help us run the Service (hosting, telephony, AI inference, voice synthesis, payments, email), under contracts restricting their use of it. The current list is published at /legal/subprocessors and is incorporated here. We update that page when providers change; material changes follow the notice mechanism in Section 16. We do not sell personal information and do not share it for cross-context behavioral advertising.

5a. Business Transfers

If ProFront is involved in a reorganization, incorporation, merger, acquisition, financing, or sale of all or part of its business, personal information may be transferred to the successor or acquirer as part of that transaction, subject to this policy's commitments. We will provide notice of any transfer that results in your information becoming subject to a materially different privacy policy.

6. Data Retention

• Account, business knowledge, appointments, contacts: retained while the account is active.
• Conversation records: transcripts and messages are retained while the account is active. Call transcripts and summaries are retained by ProFront for 12 months. This period is set by ProFront and is not configurable per business. If your industry or jurisdiction requires a different retention window, tell us before you sign up so we can say honestly whether we are the right fit. Call audio is stored by our voice provider, not by ProFront, and is subject to that provider's own retention window, which is shorter than the period above — ProFront does not keep a separate copy of call audio. Conversation-activity records used by our quality and safety systems are retained for 12 months, the same period as the conversation records above.
• Caller records: retained for 12 months from the last time they were updated, then deleted. A business can have a caller's record and conversations deleted at any time from Settings → Data & Privacy; deleting it also stops the Service from rebuilding it. To make that stick we keep a one-way scrambled code of the phone number (not the number) for as long as the business has an account, so the Service can recognise a caller who was forgotten and not rebuild their record. The record that a deletion happened (the deletion receipt) also holds a one-way code of the number, so we can prove the deletion later.
• Billing and consent records: retained as required for legal, tax, and audit purposes, including records proving acceptance of terms and opt-out requests. Records that a contact agreed to receive texts, and records that they withdrew that agreement, are kept for at least four years after the last text sent to that number, because that is how long a claim about a text can be brought.
• On account deletion: permanent deletion within 30 days per the Terms of Service, except the legal/tax/consent records above, de-identified or aggregated data (Section 12), and backup copies that age out on the backup cycle.

7. Your Customers' Data (When We Act as Processor)

If you are a customer or caller of a business that uses ProFront, that business controls your information; contact the business for its privacy practices, including access and deletion requests, which we support the business in honoring.

For our business customers: we process your customers' personal information on your documented instructions (your configuration and requests in the Service) for these processing modes:

• Handling inbound conversations on your behalf across voice, SMS, and chat;
• Placing outbound calls and messages you configure or request (for example appointment reminders and callbacks), with platform-enforced opt-out handling, contact-time limits, and identification;
• Passing information between your assistants (for example your customer assistant consulting your business assistant) within your account;
• Recording and transcribing every call, with a notice played to the other party at the start;
• The automated review, protective-action, and replay processing in Section 3;
• Creating and maintaining records (contacts, appointments, messages) in your dashboard;
• Maintaining a caller record for each phone number that contacts you (Section 2), kept separate from every other business's and never combined with theirs;
• Creating, updating and deleting records in services you connect, such as a calendar, as the Service needs to (for example, moving or removing an event when an appointment changes). A team member can connect their own account for their own records.

The Service enforces contact rules on your behalf: it will not text or call a contact outside reasonable hours in their time zone, it limits how often one number is contacted, and an opt-out such as STOP is honoured for every purpose it covers.

The Data Processing Addendum (available at /legal/dpa and incorporated into our Terms) states these commitments contractually, including confidentiality, subprocessor flow-down, security, breach notice, and deletion.

8. Security

We maintain administrative, technical, and organizational safeguards appropriate to the data we process, including encryption in transit, access controls with row-level security, service-role isolation for sensitive stores, redaction of certain sensitive values in conversation-activity records, and audit trails. No system is perfectly secure; we notify affected parties of breaches as required by law.

9. AI Accuracy

AI-generated content can be inaccurate. Businesses are responsible for reviewing AI output they rely on. See the Terms of Service for the full disclaimer.

10. Cookies

We use only strictly necessary cookies (authentication, session security, payment) and cookieless analytics. Because we do not use advertising or cross-site tracking cookies, we do not show a cookie consent banner. If that changes, this policy and the site will be updated first.

11. California and US State Privacy Rights

Where state privacy law applies to personal information we hold as a business/controller, you have rights to know/access, delete, correct, and to opt out of sale or sharing (we do not sell or share personal information for advertising), without discrimination. Business customers can exercise access and deletion self-serve in Settings → Data & Privacy (full export and account deletion). Others may contact us per Section 17; where we act as processor we will route the request to the controlling business and assist. We honor these requests as required by law and verify identity before acting.

12. De-identified and Aggregated Data

We derive de-identified, aggregated patterns from usage of the Service (for example, categories of failure modes across many conversations) to improve safety and quality. This data no longer identifies a person or a specific business, we commit to not re-identifying it, and it may be retained after deletion requests. Records that still identify you are handled per Sections 6 and 11.

13. International

The Service is operated from the United States and offered to US businesses. If you access it from elsewhere, your information is processed in the US.

14. Data Processing Addendum

Our DPA is published at /legal/dpa and applies to all business customers as part of the Terms of Service. Signed copies are available on request for customers whose procurement requires an executed counterpart.

15. Children

The Service is not directed to children under 13 and we do not knowingly collect their information. Businesses must not configure the Service for child-directed use.

16. Changes to This Policy

We will post updates here and give at least 14 days' notice of material changes via the dashboard and/or email before they take effect.

17. Contact

Privacy requests and questions: privacy@profront.ai