Privacy Policy

We collect the following categories of information in connection with the Hartlowe Service:

• Account and contact information — business name, your name, email, phone number, and related details you provide when creating or managing an account.
• Call audio recordings and transcripts — recordings of inbound calls handled by the AI agent and the text transcripts and summaries generated from them.
• Intake data captured during calls — Caller first and last name, callback phone number, email (when offered), inquiry topic (planning / portfolio / tax / insurance / other), existing-client status, structured notes (urgency, meeting mode, assets bracket if the caller volunteers it), callback request and window, recording-consent decision. This may include personal information of third-party callers.
• System-of-record (SoR) bearer tokens — API tokens you provide so we can write captured intake back into Wealthbox (and any future CRM adapter you enable, such as Redtail). Tokens are encrypted at rest.
• Usage and technical data — log data, device and browser information, IP address, and analytics about how the Service is used.
• Payment information — payments are processed by Stripe. We do not collect or store full payment card numbers.

• To provide and operate the Service, including answering calls and capturing intake;
• To transcribe, summarize, and route calls and alert you (for example, by SMS) so you can act on the lead;
• To process subscriptions, billing, and payments;
• To provide support, communicate with you about your account, and respond to requests;
• To maintain, secure, troubleshoot, and improve the Service and its accuracy;
• To comply with legal obligations and enforce our terms.

We rely on trusted third-party providers ("subprocessors") to deliver the Hartlowe Service. They currently include:

• Vapi — voice AI agent orchestration.
• Twilio — telephony and SMS messaging.
• Deepgram — speech-to-text transcription.
• Anthropic — large language model for conversation and summarization.
• Supabase — database and backend hosting.
• Vercel — application hosting and delivery.
• Stripe — payment processing.
• Wealthbox — CRM write-back (Person contact, note, follow-up task) when you connect your Wealthbox account.
• Redtail — roadmap CRM adapter (not active until you opt in).

We may add or change subprocessors as the Service evolves and will update this list accordingly. We do not sell your personal information.

We share information with the subprocessors listed above to operate the Service, with your account's authorized users, with the system of record you connect (Wealthbox (and any future CRM adapter you enable, such as Redtail)), and when required by law, legal process, or to protect the rights, safety, and security of NextAI Forge, LLC, our users, or the public. If we are involved in a merger, acquisition, or sale of assets, information may be transferred subject to this Policy.

We retain information for as long as your account is active and as needed to provide the Service, then for a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce agreements. Call recordings and transcripts are retained according to your plan and applicable settings.

We use reasonable administrative, technical, and organizational measures designed to protect information, including encryption in transit, AES-256-GCM encryption of system-of-record tokens at rest, content-security-policy headers, HSTS, and same-origin API enforcement. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Depending on your location, you may have rights to access, correct, update, or delete personal information, and to object to or restrict certain processing. To exercise these rights, contact us at support@hartlowe.com. If you are an end caller, requests regarding information captured on a call may be directed to the business you called; we will assist that business as needed.

The Hartlowe Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from children.

We operate in the United States. Information we process may be stored and processed in the United States or other countries where we or our subprocessors operate.

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice and update the "Last updated" date above.

Questions about this Privacy Policy or our data practices? Contact the Hartlowe team at support@hartlowe.com.