Privacy Policy
Last Updated: September 29, 2026
1. Introduction
This Privacy Policy explains how AIEmployee.com collects, uses, and protects personal information.
It covers our websites, the AIEmployee.com web app, and the AI agents, phone numbers, chat widgets and AI employees that businesses run on our platform (together, the "Services").
Businesses use the Services to talk with their own customers and callers. For that information, the business decides how it is used, and we process it on the business's behalf under our Data Processing Agreement. If you spoke with a business's AI agent and have a question about your information, please contact that business. You can also reach us at [email protected].
2. Information We Collect
We collect information you provide directly, including account details, billing information, and content submitted through the platform.
We also collect technical data such as IP address, device type, browser data, and usage activity.
Depending on the features in use, this includes:
- Account and contact details. Name, email address, company and sign-in details, including for team members and clients invited to a workspace.
- Billing information. Plan, credit purchases and transaction history. Payment card and bank details go directly to our payment processor, Stripe.
- Voice sessions and phone calls. Live audio, and any camera or screen a person chooses to share, so the AI agent can hear, see and answer. We keep the transcript and call details such as phone numbers, time, duration and outcome, plus an AI-written summary of browser conversations. See Section 6.
- Messages and files. Chat messages with AI agents and AI employees, files and images attached to them, task instructions, and the documents, media and apps an AI employee creates.
- Customer memory. Facts an AI agent remembers about a business's returning customers, when the business turns this on. See Section 5.
- Knowledge-base content. Documents, website pages and connected files a business adds so its AI agents can answer questions.
- Leads and contacts. Names, phone numbers, email addresses and notes that a business imports or that its AI agents collect, and requests not to be called again.
- Images, likeness and voice. Avatar images and reference photos, images and video used in Content Studio, and voice recordings uploaded to create a cloned voice.
- Connected apps. Data from calendars, CRMs, email, social media and other apps a business chooses to connect.
- Phone numbers and text messages. Phone numbers a business buys or connects, text messages sent to those numbers, and business identity and address details or documents that some countries require before a number is issued.
- Technical and usage data. IP address, device and browser details, pages viewed, actions taken in the app, and error reports.
3. How We Use Information
We use data to:
- Provide and improve the Services
- Run the AI agents, phone numbers and AI employees that businesses set up, including recognizing returning customers when a business turns on customer memory
- Process payments
- Communicate updates and support
- Ensure security and prevent abuse
- Analyze performance and usage
- Measure our advertising and show our ads to people who visited our web pages
5. Customer Memory
Businesses can let their AI agents remember returning customers across web conversations and phone calls. Memory is off unless a business turns it on for an agent. It is stored in our database and processed by the AI providers listed in Section 7.
An agent can remember facts a customer shares in conversation, such as their name, preferences or an upcoming appointment. It can also see summaries and the last messages of that customer's recent conversations. On the web, the widget recognizes a returning browser by a visitor ID stored in the browser and, where available, a device fingerprint. On the phone, the agent recognizes the caller's phone number. A business can also link records it confirms belong to the same person.
Businesses choose whether visitors are asked first. If a business asks first, the widget shows a "Remember me on this device" checkbox, and the agent remembers the visitor only after they tick it. Unticking it later clears the visitor ID and fingerprint the widget kept in that browser, and the widget stops sending them. Otherwise, the agent remembers visitors without asking.
Businesses can see what their agents remember in the dashboard and delete a customer with "Forget this customer". Forgetting a customer deletes their memory, including records the business linked to the same person. To have your memory deleted, contact the business that runs the agent, or email [email protected].
Memory about a web visitor who never shares contact details is deleted 90 days after their last visit. For other customers, the business chooses how long memory lasts after the customer's last contact: 90, 180 or 365 days, or until the business deletes it. The default is 365 days. Where that setting is not yet available for a workspace, memory is deleted 90 days after the customer's last contact.
When a signed-in user talks to an agent from the dashboard, the agent can also remember that user across sessions if the business turns this on.
6. Voice Calls and Transcripts
When someone talks to an AI agent in a browser or by phone, LiveKit carries the live audio, and any camera or screen the person chooses to share, to our voice agents. Speech-to-text, AI model and text-to-speech providers process that audio and text in real time so the agent can answer, and a business can add a video avatar that speaks the agent's replies. Section 7 lists these providers.
We keep a transcript of the conversation, including chat messages, and call details such as the phone numbers involved, time, duration and outcome. For browser conversations we also keep an AI-written summary. Businesses can review these in their dashboard.
The Services do not offer call recording to businesses. For the session data our voice infrastructure provider can store, see LiveKit in Section 7.
7. Service Providers (Subprocessors)
We use the service providers below to run the Services. The tables list what each one does for us and the personal data it receives. Location is shown where our configuration sets one. Other providers may process data in the United States or other countries where they operate.
Hosting and infrastructure
| Provider | What it does for us | Data it receives | Location |
|---|---|---|---|
| Convex | Database, file storage and backend for the Services. | All data stored in the Services, including account details, agent settings, transcripts and messages, customer memory, knowledge-base files, uploaded images and files, and billing and usage records. | United States |
| Vercel | Hosts our websites, web app and API, and runs the AI employee service. Its AI Gateway relays requests to AI model providers, including xAI, Anthropic, Google and ByteDance. | Data sent through our websites and web app, including account details, messages and uploaded files, IP addresses and request details, and the content we send to AI models through the AI Gateway. | Global edge network |
| LiveKit | Real-time audio and video network for browser voice sessions and phone calls. It also hosts the software that runs our voice agents. | Live audio, video, screen shares and chat messages from voice sessions and calls, and the transcripts, prompts and session details our voice agents work with. When session recording is turned on in our LiveKit account, LiveKit also stores session audio, transcripts and diagnostic traces. | Multiple regions, including the United States and the European Union |
| Cloudflare | Network and security proxy in front of our web app, custom domains for agencies, and hosting for Spaces, the apps that AI employees build. | Traffic to our web app, agencies' custom domains and Spaces, including IP addresses, request details and the content of pages and requests, and the content of published Spaces. | Not specified |
| Railway | Hosts our own document converter, our media editing service and a connector used by some older GoHighLevel connections. | Knowledge-base files while they are converted to text, images, video and audio while they are edited in Content Studio, and CRM data passing through older GoHighLevel connections. | Not specified |
| Upstash | Rate limiting. | IP addresses and account identifiers used to count requests. | Not specified |
AI models, speech and avatars
| Provider | What it does for us | Data it receives | Location |
|---|---|---|---|
| OpenAI | AI models that answer phone calls, run Lightning Voice sessions and the voice agent builder, summarize conversations, extract customer memory, index knowledge-base documents, transcribe recordings, and generate images and speech for AI employees. | Transcripts and messages, live audio in Lightning Voice sessions, knowledge-base text, customer memory, audio and video files sent for transcription such as Teach recordings, and prompts for generated images and speech. | Not specified |
| Google (Gemini API) | AI models for Premium Voice agents, conversation summaries and titles, prompt suggestions, filling CRM fields from conversations, avatar image generation, and Content Studio images and plans. When avatar image moderation is enabled, it also checks custom avatar reference images for safety. | Transcripts and messages, images from cameras, screen shares and files shared in Premium Voice sessions, website content used for prompt suggestions, and Content Studio prompts and reference images. For avatar safety checks it receives only normalized image pixels and fixed safety instructions, without filenames or tenant, user or provider IDs. | Not specified |
| xAI | Default AI model for AI employee chat and tasks, reached through Vercel's AI Gateway. | AI employee messages, task instructions, attached files, and results from the tools and apps the AI employee uses. | Not specified |
| Anthropic | AI models for AI employee specialist agents and tasks set to Max effort, and for the on-screen visuals voice agents create, reached through Vercel's AI Gateway. | Messages, task instructions and files handled by specialist agents or Max-effort tasks, and the conversation details a voice agent puts in a visual. | Not specified |
| TypeSafe AI | Quick yes-or-no and multiple-choice decisions that help route AI employee work and label conversations: which teammate suits a task, whether a group-chat message needs a reply, whether a check-in has anything useful to say, how a question to a voice agent's knowledge base should be searched, and a finished call's outcome, lead strength, whether a person should follow up and whether the caller asked not to be contacted. Reached through Vercel's AI Gateway.Only when we have turned this service on, for all workspaces or for selected ones. | Task titles and instructions, check-in signals, recent group-chat messages, the names and descriptions of the workspace's AI teammates and skills, questions voice agents look up in a knowledge base, transcripts of finished web and phone conversations, and text messages people send to a business's phone numbers. | Not specified |
| AssemblyAI | Speech-to-text for Premium Voice sessions, phone calls and the voice agent builder. | Live audio of what people say to an agent. | Not specified |
| Inworld | Text-to-speech voices and voice cloning. | The text of agent replies to be spoken, and voice recordings uploaded to create a cloned voice. | Not specified |
| LiveAvatar (HeyGen) | Premium video avatars for voice agents. | The agent's spoken replies as audio, and the details needed to connect the avatar to the session. | Not specified |
| bitHuman | Basic video avatars. | For avatars drawn in bitHuman's cloud, the avatar image and the agent's spoken replies as audio. For avatars drawn on our servers, license checks and usage reports. | Not specified |
| Moondream | Describes camera and screen-share images during Lightning Voice sessions so the agent can respond to what it sees.Only when someone shares video in a Lightning Voice session. | Still images from the user's camera or shared screen. | Not specified |
| fal | Image and video generation in Content Studio. | Prompts and any reference images, video or audio the customer provides, which may show real people. | Not specified |
| Replicate | Image and video generation in Content Studio. | Prompts and any reference images, video or audio the customer provides, which may show real people. | Not specified |
Knowledge, memory and web content
| Provider | What it does for us | Data it receives | Location |
|---|---|---|---|
| Weaviate | Search index for knowledge bases. | Text passages from knowledge-base documents and websites, their search vectors, and search queries. | Not specified |
| Voyage AI | Turns knowledge-base text into search vectors and ranks search results. | Text passages from knowledge-base documents and websites, and search queries. | Not specified |
| Supermemory | Managed customer memory and knowledge-base search, including connections to Google Drive, Notion and OneDrive.Only when we have turned this service on, for all workspaces or for selected ones. | Transcripts, facts remembered about customers, knowledge-base documents and website pages, and files from connected document sources. | Not specified |
| Firecrawl | Reads websites that customers point us to and runs web searches for AI employees. | Website addresses, the public content of those pages, and search queries. | Not specified |
| ThumbmarkJS | Open-source code in the chat widget that recognizes a returning browser for customer memory.Only when customer memory is on for the agent and, in ask-first mode, after the visitor opts in. | By default, a random sample of about 1 in 10,000 device fingerprints, the browser details used to calculate them, and the page path, sent to its developer. | Not specified |
Communications, integrations and publishing
| Provider | What it does for us | Data it receives | Location |
|---|---|---|---|
| Twilio | Phone numbers, phone calls and text messages. | Phone numbers, call audio and call details, text messages sent to a business's number, and business identity and address details or documents that some countries require before issuing a number. | Not specified |
| Resend | Sends our emails, such as invitations, notifications and alerts. | Recipient names and email addresses, email content, which can include lead details in new-lead notifications, and delivery status. | Not specified |
| Pica (One) | Connects apps a customer chooses to link, such as Google Drive, calendars, CRMs and email, and relays requests to them. | Authorization for connected apps and the data exchanged with them, such as contacts, calendar events, messages and files. | Not specified |
| Zernio | Publishes social media posts for customers who connect social accounts. | Connected social account details and the text, images and video in posts. | Not specified |
Accounts, payments and monitoring
| Provider | What it does for us | Data it receives | Location |
|---|---|---|---|
| Clerk | Sign-in and account management. | Names, email addresses, sign-in details, and IP address and device details used to secure sessions. | Not specified |
| Stripe | Payments, subscriptions, credit purchases and agency payouts. | Billing names and email addresses, payment card and bank details entered directly with Stripe, and transaction history. Agencies that receive payouts give Stripe their business and identity details. | Not specified |
| Sentry | Error monitoring. | Error reports, which can include the signed-in user's account ID and email address, browser and device details, and the address of the page or request that failed. | United States |
| Langfuse | Monitoring of voice agent quality and performance. | Traces of voice agent sessions, which can include transcripts, prompts, agent replies and tool results. | Not specified |
Businesses can also connect services they use with their own accounts, such as GoHighLevel, calendars, Slack, Discord, Telegram, WhatsApp, Linear, their own tool servers and webhooks, or their own Twilio account. We send data to those services on the business's instructions, and the business's own terms with them apply.
8. Data Sharing
We do not sell personal data for money. We may share information with the service providers in Section 7, with apps a business connects, with legal authorities if required, or in the event of a business transfer.
The advertising tools in Section 4 collect information from visitors to our web pages. Under some U.S. state privacy laws, letting advertising tools collect information for targeted advertising can count as selling or sharing personal information.
9. Avatar Images
When avatar image safety moderation is enabled, Google receives normalized image pixels and fixed safety instructions without filenames, tenant IDs, user IDs, or provider IDs. The purpose is to classify the normalized image as approved, rejected, or requiring manual review before it can be used in an avatar workflow. We do not keep reference images that are not approved.
We no longer create avatars automatically from uploaded images. Until we retired that feature in September 2026, it sent the normalized source image and a non-PII label to Protoface for avatar creation, operation, security, maintenance, and permitted service improvement.
In the manual $5 and $55 reference flows, normalized images are safety-moderated but are not automatically submitted for avatar creation. Our team uses the reference image to prepare the avatar you ordered.
10. Mobile Information Non-Sharing
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors in support services, such as customer service, is permitted.
All other use case categories exclude text messaging originator opt-in data and consent. This information will not be shared with any third parties.
11. Data Security
We implement reasonable technical and organizational safeguards. No system is fully secure.
12. Data Retention
Data is retained only as long as necessary for service delivery, legal compliance, or legitimate business purposes.
Customer memory is deleted on the schedule in Section 5.
Raw uploads of avatar images are temporary and are deleted after image finalization, whether finalization ends in success or failure. Normalized sources and previews remain only while needed for an active request or avatar and the lifecycle below. Unpaid manual-reference drafts retain the normalized reference for seven days after it is bound. Replacement, abandonment, cancellation, and completed fulfillment each queue authenticated owned deletion.
Starting checkout adds a seven-day protection window, so a valid or recently completed payment cannot race deletion. Paid or in-progress requests are not deleted by stale-unpaid cleanup. If a matching payment arrives after cancellation, the protected reference returns to retained state.
Deletion failures retry with exponential backoff, starting after five minutes and capped at 24 hours. If the same normalized image becomes an active avatar, the reference is transferred to the assigned avatar instead of deleted.
Limited consent receipts, security audit records, and deletion tombstone records may remain when needed to demonstrate lawful processing, investigate abuse, or prevent replay.
13. GDPR and CCPA Rights
Depending on your location, you may request access, correction, deletion, restriction, or portability of your data.
California residents may request disclosure or deletion of personal information. AIEmployee.com does not sell personal data for money. Sections 4 and 8 explain the advertising tools on our web pages.
If a business collected your information through the Services, for example when you called its AI agent, please send your request to that business, because it controls that information. You can also ask it to delete what its AI agents remember about you.
Requests may be submitted to [email protected].
14. International Data Transfers
Data may be processed in the United States or other jurisdictions where our service providers operate. Section 7 shows a location where our configuration sets one.
15. Children's Privacy
The Services are not intended for children under 13.
16. Changes to Policy
We may update this Privacy Policy at any time.