Privacy Policy

Your California Privacy Rights

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). These rights include:

• The Right to Know: You have the right to request that we disclose what personal information we collect, use, disclose, and sell.
• The Right to Delete: You have the right to request the deletion of your personal information that we have collected.
• The Right to Opt-Out of Sale or Sharing: You have the right to direct us not to sell or share your personal information.
• The Right to Correct: You have the right to request the correction of inaccurate personal information.
• The Right to Limit Use and Disclosure of Sensitive Personal Information: You have the right to limit the use and disclosure of your sensitive personal information.
• The Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise these rights, please contact us using the information in the "Contact Us" section below. We will verify your request using the information associated with your account. You may also designate an authorized agent to make a request on your behalf.

Your Virginia, Colorado, and Other State Privacy Rights

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have similar rights to those of California residents. These rights may include:

• The right to access your personal information.
• The right to correct inaccuracies in your personal information.
• The right to delete your personal information.
• The right to obtain a copy of your personal information.
• The right to opt out of the processing of your personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

To exercise these rights, please contact us using the information in the "Contact Us" section below.

Tenant Isolation & Cross-Contamination Controls

Partner data is logically isolated at the database layer. Every record is keyed to an owning organization and protected by PostgreSQL Row-Level Security (RLS) policies enforced on every query. Access tokens are scoped to a single organization, so one partner's data — including AI conversation history, leads, and integration credentials — cannot be read or modified by another partner.

Voice and messaging AI sessions run in per-partner contexts with separate knowledge bases and prompts. Third-party integrations use partner-specific API credentials stored in an encrypted secret vault and are never shared across partners.

Database Systems

Our primary application database is PostgreSQL, hosted on Supabase (running on AWS). Authentication is handled by Supabase Auth (JWT, bcrypt-hashed credentials, MFA for administrators). Serverless business logic runs on Supabase Edge Functions in isolated containers. CRM workflows use GoHighLevel; transactional email is delivered via Resend; AI inference is provided through the Lovable AI Gateway and the partner-selected model provider. All vendors in our production data path are SOC 2 Type II attested (or equivalent) and operate under signed Data Processing Agreements.

Additional Security Measures

• • Encryption: TLS 1.2+ in transit, AES-256 at rest for databases, backups, and object storage.
• • Access control: Least-privilege, role-based access; SSO and MFA required for administrative accounts; periodic access reviews.
• • Secret management: API keys and integration tokens stored in an encrypted secret vault and rotated on personnel changes or suspected compromise.
• • Input validation & hardening: Server-side schema validation, parameterized queries, output sanitization, and a Content Security Policy.
• • Audit logging & monitoring: Authentication events, administrative actions, and access to sensitive records are logged and monitored for anomalies.
• • Backups & recovery: Automated daily backups with point-in-time recovery; encrypted and access-controlled.
• • Vulnerability management: Automated dependency scanning, security headers, and a responsible-disclosure policy at /.well-known/security.txt.
• • Personnel: Confidentiality agreements and mandatory security training for all team members with production access.
• • Data integrity: Database constraints, transactional writes, and webhook signature verification on inbound integrations.