Privacy Policy

[Company legal name] ("we", "us") runs Fullday. For your own account details, we decide how they're used (we're the "controller" or "business"). For the data your business puts into Fullday, like your leads and their calls and messages, we process it on your behalf and follow your instructions: you're in charge of it, and we're your "processor" or "service provider". If you're a member of the public who contacted a business that uses Fullday, that business's own privacy policy applies too.

• Account details: your name, email, phone, password (stored as a secure hash by our sign-in provider), team members and settings.
• Business details: your business name, address, hours, services and prices, website, brand and anything we read from your public website and listings during setup.
• Customer data you process with us: your leads' names, phone numbers, emails and notes; calls, texts, direct messages, web chats and emails with them; transcripts, summaries and call recordings.
• Payment details: handled by Stripe. We see the card brand, last 4 digits and billing details, never the full card number.
• Partner data: for agencies, client records, prospects, lead lists, cold email content, replies, bounces and unsubscribes. For connected cold email inboxes, we read new mail to find replies, bounces and warm-up emails; anything else is left as it is and not stored. With warm-up on, an inbox's address and display name appear on the warm-up emails it exchanges with other customers' connected inboxes.
• Public business data: the lead finder collects business names, addresses, phone numbers, websites and public business emails from public sources.
• Connected account data: when you connect Google, Meta, Whop, Microsoft or other accounts, the data you allow, like calendars, ad accounts, pages and campaign results.
• Records of what you agreed to: the version and words of the terms you accepted, when, and from which IP address and browser.
• Your voice, if you use Your own voice: the recording the account owner makes in the app, the AI copy of their voice made from it (kept by Cartesia), and the record of their consent: the statement they read, their name, when, and the IP address and browser they used.
• Usage and device data: pages used, actions taken, IP address, approximate location from IP, browser and device type, and error logs, to run and secure the service.
• Support: what you send us by email or through the Help chat.

To help agencies find local businesses, the lead finder reads public business information. Here's exactly what it does.

• What it reads: public business listings from OpenStreetMap, and a few public pages of a business's own website at most (the homepage, contact and about pages). It never logs in or fills in forms, it honors robots.txt, and every request identifies our crawler and how to reach us.
• What it keeps: only the business contact details a business publishes, like its name, address, phone number, website and published business email addresses. To check that a domain takes email, we look up its public mail records; we never test individual mailboxes.
• Opting out: a business can opt out at any time. Email support@fullday.ai with the domain. We add it to our opt-out list, so it's never crawled or listed again.
• OpenStreetMap: business listing data is © OpenStreetMap contributors, available under the Open Database License (ODbL). See the OpenStreetMap copyright page.

When the front desk answers a call, the call can be recorded and transcribed so the business can review it, get a summary and see the outcome. Callers hear a notice that the call may be recorded. A business can turn recording off. Recordings and transcripts belong to the business and are only shown to its team (and, for agency clients, to its agency).

We process phone numbers, message content and consent records to deliver texts for the businesses that use Fullday, to honor STOP and HELP, and to meet carrier rules.

We don't sell or share mobile numbers for marketing. No mobile information is shared with third parties or affiliates for their marketing or promotional purposes. Text messaging opt-in data and consent are never shared with third parties, except the providers that deliver the messages (like Twilio and the carriers). See the SMS terms.

Fullday uses AI to answer calls and messages, write follow-ups and ads, summarize conversations and answer support questions. To do that, the relevant content (for example a caller's words, or a lead's message) is sent to our AI providers, such as Anthropic and OpenAI for language and images, Vapi for voice, and Cartesia for a business owner's own voice (their recording, and what the front desk says in that voice), which process it to give us a result. Under our agreements with them, they may not use your data to train their models [confirm against each provider's current terms]. We don't use your customer data to train AI models for other customers. We don't use AI to make decisions that have legal or similarly significant effects on people.

If you connect a Google account (for example Google Calendar, Gmail or a Google Business Profile), we only access the data needed for the features you turn on, like checking your availability and booking appointments, and we only use it to provide those features to you. For a Gmail inbox connected for cold email, that's sending your emails, reading new mail to find replies, bounces and warm-up emails (anything else is left as it is and not stored), and moving warm-up emails out of spam, marking them read and archiving them. We never delete your mail.

Fullday's use and transfer of information received from Google APIs to any other app will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We don't use Google user data for advertising, we don't sell it, we don't let people read it unless you ask us to (for support), it's needed for security or the law requires it, and we don't use it to train AI models. You can disconnect Google at any time in Settings → Connections, or at your Google account's security page.

If you connect Facebook or Instagram (directly or through Whop), we access the pages, ad accounts, messages and results you allow, only to run the features you use, like answering messages and running ads.

To delete data we got from Facebook or Instagram: disconnect it in Settings → Connections (or the Ads page), which stops access and deletes the tokens; then email support@fullday.ai with the subject "Delete my Facebook data" and the email on your account, and we'll delete the related data within 30 days and confirm. You can also remove Fullday from your Facebook settings under Apps and websites.

We use these providers to run Fullday. Each only gets what it needs for its job:

• Supabase: database, file storage and sign-in. Account and customer data.
• Stripe: payments, subscriptions and agency payouts. Billing details.
• Twilio: phone numbers, calls and texts. Phone numbers, call audio and message content.
• Vapi: AI voice calls. Call audio and transcripts.
• Cartesia: the owner's own voice, for businesses that use it. The owner's voice recording, and the words the front desk says in that voice on calls.
• Anthropic and OpenAI: AI models. Message and call text sent for answers, summaries and drafts.
• Resend: email delivery. Email addresses and email content.
• MillionVerifier: email address checks (owner emails in the lead finder, and each lead's address before its first cold email). Email addresses only.
• Cloudflare: hosting, network and security. Request data like IP addresses.

When you connect them, we also exchange data with Meta, Google, Microsoft, Slack, Whop, domain registrars and calendar providers, as you set up. We'll update this list before adding a new subprocessor that handles customer data.

• To run the service: answer calls and messages, book appointments, send follow-ups, run ads you approve, build your website and show you results.
• To bill you, prevent fraud and enforce our terms, including keeping records of what you agreed to.
• To keep the service secure and fix problems.
• To support you and tell you about changes to the service.
• To improve the service, using usage data and, only in aggregate, de-identified data.
• To follow the law and respond to lawful requests.

We don't sell personal information, and we don't share it for cross-context behavioral advertising.

In the last 12 months we've collected these categories of personal information, for the purposes above, from you, your business, your customers, connected accounts and public sources:

• Identifiers: name, email, phone, IP address, account ID.
• Customer records: billing details, business contact details.
• Commercial information: plans and purchases.
• Internet activity: how you use the service, device and browser.
• Approximate location: from IP address.
• Audio and electronic information: call recordings, messages.
• Professional information: your business and role.
• Sensitive information: account login (email and password) only, used only to sign you in.

We keep each for as long as the next section says. We don't sell or share any of it (as "sell" and "share" are defined under California law), and we have no actual knowledge of selling or sharing the personal information of anyone under 16.

• Account and business data: while your account is open, then 30 days after it closes so you can export it or come back.
• Call recordings: [90 days] by default, unless the business chooses a different period.
• Transcripts, messages and lead records: while the account is open, unless the business deletes them sooner.
• Billing records: as long as tax and accounting law requires (usually 7 years).
• Records of what you agreed to: [7 years] after your account closes, to prove our agreement if there's a dispute.
• Voice recordings and voice copies (Your own voice): until the owner (or an admin) deletes the voice or takes the add-on off in the app, or the account is deleted. Then we delete the recording from our storage and the copy at Cartesia.
• Voice consent records: [7 years] after the voice is deleted, without the recording, to prove the copy was made with consent.
• Security logs: up to [12 months].
• Support conversations: up to [2 years].

Backups roll over within [35 days] after deletion.

You can delete leads, conversations and recordings in the app, and the account owner can delete the whole account (see Delete your account). We delete it within 30 days, except what we must keep by law or to defend claims.

Depending on where you live (for example California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other US states, or the EU and UK), you may have the right to know what we collect, and to access, correct, delete or get a copy of your personal information, and to opt out of sale, sharing, targeted advertising and profiling (we don't do these). Email support@fullday.ai. We'll confirm who you are and answer within the time the law sets (usually 30 to 45 days). You can use an authorized agent; we'll ask for proof they can act for you. We won't treat you differently for asking.

Appeals. If we turn down your request, you can appeal by replying to our answer. If you're still not satisfied, you can contact your state's attorney general.

If you're a customer of a business that uses Fullday, contact that business first: they control your data, and we'll help them answer you.

• Marketing emails from us have an unsubscribe link. Service messages (like receipts and security alerts) can't be turned off while you have an account.
• Global Privacy Control. We treat a GPC signal from your browser as a request to opt out of sale and sharing for that browser. Since we don't sell or share, nothing changes, but we honor it.
• Do Not Track. There's no common standard for it, so we don't respond to it differently; we don't track you across other sites anyway.
• Cookies: see the Cookie policy.

We encrypt data in transit and at rest, limit who on our team can access customer data, and keep secrets like API keys on the server (you see them once, then only the last 4 characters). No system is perfectly secure; if a breach affects your data, we'll tell you without undue delay and as the law requires.

Fullday is for businesses and isn't meant for children. We don't knowingly collect personal information from children under 13 (or under 16 where the law sets that age). If you think we have, email support@fullday.ai and we'll delete it.

We're based in the United States and our providers may process data in other countries. Where the law requires, we use safeguards like the European Commission's Standard Contractual Clauses and the UK addendum.

We'll post changes here and, if they matter, tell you by email or in the app before they apply. The version and date at the top show which version is current.

Questions or requests: support@fullday.ai. [Company legal name], [Company address]. Our cookie practices are in the Cookie policy.