Privacy Policy

1. Who this policy covers

• Account Holders: owners and team members of businesses with a FrontLark account.
• Visitors: people who visit frontlark.com, start signing up, or contact us.
• Business Contacts: people who interact with a business through FrontLark, for example by calling or texting its number, using its website or website chat, booking, receiving its messages, filling out or signing its forms, or paying it.

This policy does not cover the practices of the businesses that use FrontLark, or third-party services that have their own privacy policies, such as Stripe and Google, even when you reach them through the Services.

2. Information about Account Holders

• Account details: name, email address, mobile number, password (stored only in hashed form), role, notification preferences and the business you belong to.
• Business details: business name and type, hours, services and prices, service area and locations, staff and schedules, booking policies, website content, logos and photos, and instructions for the receptionist.
• Registration details: legal business name, entity type, Employer Identification Number (EIN, which we encrypt), business address, and the name, title, email and phone number of an authorized representative, which we use to register the business for texting with carriers and to set up payments. When you set up payments, Stripe collects identity and bank information directly from you; we receive the status of your Stripe account, not your full bank or identity numbers.
• Sign-in and device information: one-time sign-in codes, session records, IP address, device type, operating system, app version, push notification tokens and sign-in history.
• Usage information: how you use the Services, such as features used, settings changed and errors.
• Communications with us: support requests, feedback and survey answers.
• Connected accounts: if you connect Google Calendar, the information described in Google user data.
• Device features you allow: microphone audio during calls; your device’s location while you take a card payment (used by Stripe’s payment software on your device, as card networks require — we do not keep a location history); photos you take or choose to upload; and Bluetooth or local network access to connect card readers.
• Subscription payments: when you pay for FrontLark, Stripe processes your card, and we receive limited details such as the card brand, last four digits, expiration date and billing address.

3. Information we process for businesses

When you interact with a business that uses FrontLark, we process the following for that business:

• Calls: your phone number and caller ID name, call times and length, and the live audio of the call (processed in real time so the AI receptionist can understand and respond). If the business turns them on, also call recordings, transcripts, voicemails, and AI-generated summaries, reasons for calling and next steps.
• Texts and email: message content, phone numbers and email addresses, delivery status and replies.
• Website chat: the chat transcript and any details you share.
• Customer records: name, phone number, email, service address, notes the business adds, preferences, birthday if you share it, how you found the business, preferred staff, and appointment and service history.
• Bookings and payments: services booked, appointment times, estimates, invoices, amounts paid and tips, and the card brand and last four digits. Card numbers are collected by Stripe, not FrontLark.
• Forms and signatures: your answers (which, depending on the form, may include details about your property, pets, health or allergies), photos you upload, your drawn or typed signature, signed PDFs, your consent to electronic records, and an audit trail of when the form was sent, opened and signed, including your IP address and browser and device information.
• Texting consent: whether you agreed to or declined texts and marketing texts, the wording you saw, when and how you chose (for example, a checkbox on a website, a call or a text), and opt-out requests.
• Website visits: pages viewed, the referring site or campaign, approximate location (country and region), device type, a temporary per-tab identifier and a hashed visitor value that changes daily. These are collected without cookies.

4. Information from visitors

• Contact form: your name, business, phone number or email and message. If you share a mobile number, we may text you about your request, as described in our SMS Terms.
• Sign-up: the details you enter if you start creating an account.
• Technical information: IP address, browser, pages viewed and referring site, which our hosting provider, Cloudflare, processes to deliver and protect our websites.

5. Cookies and similar technologies

• The FrontLark web app uses a strictly necessary cookie to keep you signed in. The mobile apps keep your sign-in in your device’s secure storage.
• Business websites hosted on FrontLark count visits without cookies, using a per-tab identifier kept in your browser’s session storage (cleared when you close the tab) and a hashed value that changes every day, so visits cannot be linked across days or across websites.
• Our hosting and security provider, Cloudflare, may set strictly necessary cookies on our websites and on business websites we host, for example to tell people from bots and to block attacks.
• We do not use advertising cookies or cross-site tracking, and we do not allow third parties to collect information about your online activities over time and across websites through the Services.
• Because we do not track you across websites, we do not change our practices in response to “Do Not Track” browser signals. We treat a Global Privacy Control signal as a request to opt out of the sale or sharing of personal information, which we do not do.

6. How we use information

• To provide the Services: answer, route and record calls according to each business’s settings; run the AI receptionist; send texts, emails and notifications; book appointments; host websites; send forms and keep signed records; and process payments through Stripe.
• To keep the Services secure: verify sign-ins, prevent fraud, spam calls, toll fraud and abuse, and enforce limits.
• To register and comply: register businesses for texting with carriers and The Campaign Registry, for payments with Stripe, and for domains with our registrar; keep consent and opt-out records; and answer carrier and regulator questions.
• To support and communicate with Account Holders: respond to requests and send sign-in codes and service, security and billing notices. We may also email Account Holders about product updates; you can unsubscribe at any time.
• To improve the Services: analyze use and performance, fix problems and develop features, using de-identified or aggregated information where practical.
• For legal reasons: comply with law and legal process, enforce our terms, and protect the rights and safety of people and the Services.

We do not sell personal information, use it for targeted advertising, or use Business Contacts’ information to market FrontLark. We do not use personal information to make decisions that produce legal or similarly significant effects about anyone.

7. AI processing

• Live calls and chats. Conversations with the AI receptionist are processed by ElevenLabs, its affiliates and its service providers, including the providers of the language models it uses. ElevenLabs processes call audio and chat text in real time to transcribe what people say, generate the receptionist’s responses and speak in a synthesized voice. ElevenLabs does not keep audio recordings for us, and it deletes conversation transcripts at the end of the business’s retention period. Call recordings, when turned on, are made by Twilio.
• Summaries, drafts and website help. OpenAI models, which we access through Cloudflare, process call transcripts, messages and website content to write call summaries and reasons for calling, suggested replies, and website and automation text. We ask OpenAI not to store these requests (OpenAI may keep them for up to 30 days to monitor for abuse), and we turn off Cloudflare’s request logging for prompts that contain call transcripts or customers’ messages.
• No training on conversations. We do not use call audio, recordings, transcripts, chats or messages to train AI models. We have opted out of ElevenLabs using this content to train its models, and OpenAI does not use data sent through its API to train its models.
• People. Our staff look at this information only when needed to provide support a business asks for, investigate security or abuse, or comply with law.
• If you ask the AI receptionist whether you are talking with a person, it will tell you that it is an AI. If you want a person, ask: it can bring in someone from the business or take a message.

8. Call recording and transcription

Each business decides whether its calls are recorded and transcribed. By default they are, and callers hear that the call may be recorded. Recordings are stored by Twilio and played back through FrontLark to the business’s team. Transcripts and summaries are stored in FrontLark. Each business chooses how long recordings and transcripts are kept (365 days by default); after that, they are deleted from FrontLark and our providers. Calls a business’s team answers in the FrontLark app may be recorded and transcribed the same way.

9. Text messaging and mobile information

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

Our messaging provider, Twilio, transmits text messages and may collect and monitor their content to deliver them and to prevent spam and fraud. By agreeing to texts or texting a number on FrontLark, you consent to this.

Mobile numbers are used only to send the texts people agreed to (or asked for): sign-in codes and replies from FrontLark, and appointment, service and (with separate consent) marketing messages from the businesses that use FrontLark. Our messaging provider, Twilio, and wireless carriers process numbers and messages only to deliver them. We keep records of consent and opt-outs to show who agreed to texts and when, as carriers and the law require. Reply STOP to any text to opt out. See our SMS Terms.

10. Google user data

If you connect a Google Calendar to FrontLark, we access the following through Google’s APIs:

• your Google account’s email address, to show which account is connected;
• your list of calendars and their busy times, so FrontLark and your website never book over something already on your calendar; and
• events FrontLark creates, so we can add, update and cancel appointments booked through FrontLark.

We use this information only to show availability and keep your bookings in sync. The AI receptionist sees only the open appointment times FrontLark calculates, never the details of events on your calendar. We do not use Google user data for advertising, we do not sell it, and we do not use it to develop, improve or train generalized or non-personalized AI or machine learning models. We do not transfer it to others except as needed to provide these features, to comply with law, or as part of a merger or acquisition with notice to you, and no one at FrontLark reads it unless you ask us to for support, it is needed for security or legal reasons, or it has been aggregated and anonymized. Access tokens are encrypted. You can disconnect Google Calendar in FrontLark at any time, which revokes our access, and you can also remove FrontLark at your Google Account’s connections page.

FrontLark’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. (Google API Services User Data Policy)

11. How we share information

• With the business you interact with. Business Contacts’ information is available to the business and its team members.
• Within an account. Team members see the business’s information according to their role.
• With service providers that help us run the Services, listed below, under contracts that limit their use of the information to providing services to us.
• With carriers and The Campaign Registry, to register a business’s texting program (business details and the authorized representative’s contact information) and to deliver calls and texts.
• With our registrar, when a business buys a domain. ICANN rules require registrant information to be collected, and some of it may be made available through domain registration data services.
• For legal reasons, when we believe disclosure is required by law or legal process, or needed to protect the rights, property or safety of people or the Services.
• In a business transfer, such as a merger, acquisition or sale of assets, subject to this policy.
• With your consent or at your direction, such as when you connect another service.

We may also share de-identified or aggregated information that cannot reasonably be linked to a person.

12. Service providers

• Cloudflare, Inc. — hosting, databases, file storage, email delivery, AI gateway, website delivery, custom domains and security (privacy).
• Twilio Inc. — business phone numbers, calls, call recordings, transcription of calls answered by people, texts, sign-in codes, phone number lookups and texting registration (privacy).
• ElevenLabs, Inc. — the AI receptionist on calls and website chat: speech recognition, language models and synthesized voices (privacy).
• OpenAI — AI models for summaries, suggested replies and website and automation text, accessed through Cloudflare (privacy).
• Stripe, Inc. — payment processing, verification of businesses that accept payments, payouts, and billing for FrontLark. When you provide personal data in connection with payments, Stripe receives it and processes it under the Stripe Privacy Policy.
• Google LLC — Google Calendar, when connected; Firebase Cloud Messaging for notifications and incoming calls on Android; and delivery of some sign-in codes as RCS messages (privacy).
• Apple Inc. — notifications and incoming calls on iPhone, and Tap to Pay on iPhone (privacy).
• 650 Industries, Inc. (Expo) — delivering notifications to the FrontLark apps (privacy).
• Porkbun LLC — registering domains businesses buy through FrontLark.

We update this list before a new provider begins processing personal information for us.

13. How long we keep information

• Account information: while the account is open. After an account closes, we delete its information within 90 days, except as described below.
• Call recordings and transcripts: for the retention period the business chooses (365 days by default).
• Messages, customer records, bookings and invoices: while the business’s account is open, unless the business deletes them sooner.
• Consent and opt-out records: for as long as the business uses FrontLark and for five years after, so the business and we can show who agreed to texts and when.
• Signed forms and audit trails: for the retention period set for signed records, in write-protected storage. Deleting a customer record may not delete their signed records before that period ends.
• Website visit data: as long as needed to show the business its website reports.
• Billing, tax and legal records: as long as the law requires.
• Backups and logs: for limited periods, after which they are deleted on a regular schedule.

14. Security

We protect information with encryption in transit, encryption at rest by our providers, additional encryption of sensitive fields such as connected-account tokens and EINs, hashed session and link tokens, signed webhooks, and access limited to people who need it. No system is perfectly secure. If a security breach affects your personal information, we will notify you or the business as the law requires. Please keep your sign-in details and devices secure.

15. Your choices

• Account Holders can review and update most information in FrontLark’s settings. To request a copy or deletion of your information, email legal@frontlark.com.
• Reply STOP to any text to stop texts from that sender, or HELP for help.
• Use the unsubscribe link in any marketing email from FrontLark.
• Turn off notifications, location, microphone or camera access in your device settings.
• Disconnect Google Calendar in FrontLark at any time.
• Business Contacts: contact the business you dealt with to access, correct or delete your information. If you contact us, we will pass your request to the business and help it respond.

16. U.S. state privacy rights

Depending on where you live, state law may give you rights over your personal information, including in California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. We extend these rights to Account Holders and Visitors in every state. They include the right to:

• know what personal information we have about you and get a copy in a portable format;
• correct inaccurate information;
• delete your information;
• opt out of the sale of your information, targeted advertising and profiling (we do none of these);
• limit the use of sensitive information (we use it only for purposes the law allows without that request); and
• not be discriminated against for using these rights.

To make a request, email legal@frontlark.com with the subject “Privacy request.” We will verify your request by matching information you give us to our records, and we respond within 45 days (we may extend this once by 45 days if needed and will tell you why). An authorized agent may make a request for you with your signed permission; we may ask you to confirm your identity directly. If we decline your request, you may appeal by replying with the subject “Appeal” within 60 days. We will respond to an appeal within the time the law requires (generally 45 or 60 days), and if we deny it, you may contact your state attorney general.

If you are a Business Contact, we will refer your request to the business we serve, since it controls that information, and help it respond.

Categories of personal information (California notice)

We collect personal information from you; from the businesses that use FrontLark and their team members; from your devices and browser; and from our service providers, such as Stripe (payment account status), Google (when you connect a calendar) and our telecommunications providers (for example, caller ID names). In the last 12 months, we have collected the following categories of personal information, for the purposes described above:

• Identifiers — such as name, phone number, email address, IP address and account IDs.
• Customer records (Cal. Civ. Code § 1798.80) — such as address, signatures, and the last four digits of payment cards.
• Commercial information — such as bookings, services, invoices, payments and subscriptions.
• Internet or other electronic network activity — such as use of the Services and website visits.
• Approximate geolocation — such as country and region derived from IP address.
• Audio, electronic and visual information — such as call audio, recordings, voicemails and photos.
• Professional information — such as a team member’s role at a business.
• Inferences — such as an AI-generated reason for a call, shared only with the business.
• Sensitive personal information — account sign-in credentials and, if a business’s form asks for it, health information. We do not use sensitive personal information to infer characteristics about anyone.

We disclose each category to the service providers and other recipients described in How we share information for the business purposes described in How we use information, and keep it as described in How long we keep information. We have not sold or shared personal information for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.

Consumer health data

A business’s forms may collect health-related information, such as allergies or health intake answers. We process it only for that business, to provide the Services; we do not sell it or use it for advertising. Residents of Washington, Nevada, Connecticut and other states with consumer health data laws may exercise their rights through the business, and we will help it respond.

Other state notices

• California “Shine the Light.” We do not disclose personal information to third parties for their direct marketing.
• Nevada. We do not sell personal information. You may still email a request to opt out to legal@frontlark.com.

17. Children

The Services are not directed to children under 13, and Account Holders must be at least 18. We do not knowingly collect personal information from children under 13. A business may serve minors (for example, a parent books a child’s haircut); the business is responsible for any parental consent the law requires. If you believe we have a child’s information without the required consent, contact us and we will delete it.

18. Where we process information

FrontLark is based in the United States, and the Services are intended for use in the United States. We and our providers store and process information in the United States, using U.S. regions where providers offer them, although information may pass through other countries on its way across the internet.

19. Changes to this policy

We may update this policy. If we make a material change, we will notify Account Holders by email or in the Services before it takes effect, and we will update the date at the top of this page.

20. Contact us

Simplisik LLC (FrontLark), Nashville, Tennessee.

• Privacy questions and requests: legal@frontlark.com
• Support: help@frontlark.com