We protect caller and business data by default.

EarlyBird AI - Privacy Policy Version 4.4 (document id EB-PP-4.4). Effective November 8, 2025. Last updated October 29, 2026. This Privacy Policy is effective as of November 8, 2025 and was last updated on October 29, 2026. It is published by EarlyBird AI, LLC, a Virginia limited liability company ("EarlyBird", "we", "us", or "our"), with its principal office in Fairfax County, Virginia. It describes how we collect, use, retain, share, and protect personal information in connection with oneearlybird.ai and its subdomains (including partner.oneearlybird.ai, the site of the EarlyBird Partner Program), oneearlybird.com, the EarlyBird AI applications for iOS and macOS, and the EarlyBird AI virtual receptionist service (together, the "Services"). Questions and requests under this Privacy Policy should be directed to privacy@oneearlybird.ai. 1. Our Roles. a. EarlyBird as a business (controller). We decide how and why to process the information of our own customers and their authorized users, of the partners and partner applicants in the EarlyBird Partner Program, of visitors to our websites, and of people who contact us directly. We call this "Account Data". Sections 2 through 12 and Section 14 describe this processing. b. EarlyBird as a service provider (processor). When the Service answers a call, sends a message, or manages a booking for one of our business customers, we process the personal information of that business's callers, contacts, and clients on the business's behalf and under its instructions. We call this "Customer Content". The business, not EarlyBird, decides why that information is collected and how long it is kept, within the limits of our platform. If you are a caller or client of a business that uses EarlyBird, the business is responsible for your information, and requests about it should be directed to that business; Section 13 explains this and how we will assist. c. Partners are separate businesses. A Partner is an independent company that EarlyBird has approved to introduce businesses to the Service and to bill them at prices the Partner sets. When a business joins EarlyBird through a Partner, the Partner collects its own information from that business, such as payment details and contract terms, under the Partner's own privacy notice, and is itself responsible for that information. Section 14 describes what we share with a Partner about the businesses it bills, which is limited to account-level billing information and never includes Customer Content. 2. Information We Collect As A Business. a. Account information. Name, email address, telephone number, organization, role, and sign-in credentials. Passwords are managed by our identity infrastructure and are not visible to EarlyBird staff. If you sign in with Google or Apple, we receive your name, email address, and an account identifier from that provider. b. Billing information. Billing contact details and transaction history. Payment cards are collected and stored by Stripe, our payment processor; EarlyBird stores only payment references and card metadata such as brand and last four digits, never full card numbers. For a business billed by a Partner, EarlyBird holds no payment method; the Partner's payment processor account holds it. c. Business configuration. Business name, address, hours, services, staff names and roles, greetings, prompts, and other settings you provide to configure your AI receptionist. d. Usage and device data. Login timestamps, IP addresses, device and browser information, mobile push notification tokens and device names, feature usage, and security and audit logs. e. Communications. Support requests, marketing preferences, and consent records, including records of SMS notification consent with the phone number and timestamp of consent. f. Website data. Cookies and analytics data described in Section 8. g. Partner Program information. From a company that applies to the Partner Program: its company name, website, the state in which it is based, the contact's name, work email address, and telephone number, the number of businesses it expects to introduce, and any note it adds. From an approved Partner and its owner: the owner's sign-in credentials and authenticator enrolment, sign-in sessions and the browser and kind of device used, the billing contact the Partner publishes to the businesses it bills, the Partner's pricing plans and which businesses they are offered to, the invitations it creates (the invited business's name and, where collected, the invited owner's email address), its prepaid purchases and monthly usage statements, its questions to EarlyBird, the version of the Partner Program Agreement it accepted and when, and an append-only audit log of the changes made to the Partner's account. We also record our own decisions about applications and the reasons for them, which we do not share with the applicant. 3. Information We Process On Behalf Of Businesses (Customer Content). When we provide the Service to a business, we process on its behalf: call audio and call recordings; voicemail recordings; call transcripts; caller telephone numbers and call metadata such as timestamps, duration, and routing outcomes; contact records such as names, telephone numbers, and email addresses; booking and reservation details; SMS message logs; food orders; consent and opt-out records, which may include IP address and user agent where consent is captured online; and automated outputs generated by the Service, including call summaries and caller profiles. Caller profiles may include details a caller shares during calls, such as occupation, preferences, dietary restrictions, vehicles, property or access notes, and interaction history, assembled to help the business serve that caller. The business controls this content, and Section 13 describes caller rights. Customer Content is never shared with a Partner. 4. How We Use Information. a. To provide and operate the Services: answering and routing calls, recording and transcribing calls, generating summaries and caller profiles, managing bookings, sending notifications, and syncing with integrations the business has connected. b. To administer accounts and billing, including invoicing, fraud prevention, and collections through Stripe. c. To secure the Services, including authentication, isolation between customers' data, audit logging, abuse prevention, and incident response. d. To provide support and communicate about the Services, including service announcements and, where you have opted in, marketing communications, which you can opt out of at any time. e. To improve the Services using aggregated or de-identified information. We do not use Customer Content to train general-purpose AI models. f. To comply with law, enforce our agreements, and protect rights, safety, and property, including verifying that our customers and partners are located in the United States as our terms require. g. To operate the Partner Program: reviewing applications, approving and administering Partners, metering the usage of businesses a Partner bills, producing the Partner's statements, funding those businesses' accounts on the Partner's instruction, and sharing with the Partner the information described in Section 14. 5. Artificial Intelligence Processing. The Service uses conversational voice AI to speak with callers and large language models to transcribe, summarize, and organize call content. During a call, our voice AI subprocessor (ElevenLabs) converts the caller's speech to text and our replies to speech, and is configured not to retain call audio or transcripts. The language model that conducts each call, and all post-call language model processing, run in our Amazon Web Services environment through Amazon Bedrock, using models from third-party model providers such as Anthropic, in United States regions. The subprocessors involved are listed in Section 7. Automated outputs can contain errors, and businesses are responsible for reviewing outputs before relying on them. We do not use call audio to create voiceprints or to biometrically identify anyone, and we do not use Customer Content to train general-purpose AI models. 6. Call Recording. Calls handled by the AI agent are recorded, and a notice that the call is recorded is played at the start of the call, before recording begins. The AI agent states that it is an automated assistant whenever a caller asks, and a business may configure its greeting to disclose the automated assistant at the outset of a call. Recordings that capture a caller's spoken consent to receive text messages are retained as evidence of that consent as described in Section 9. These behaviors are the same for every business, whether it is billed by EarlyBird or by a Partner, and no Partner can change them. 7. When We Share Information. a. Subprocessors. We share information with the service providers that host and power the Services: Amazon Web Services (cloud hosting, storage, databases, encryption, logging, identity, AI model inference through Amazon Bedrock, speech-to-text through Amazon Transcribe, SMS delivery through AWS End User Messaging, email delivery through Amazon SES, push notification delivery, and business address lookup through Amazon Location Service); Twilio (telephony carrier services, call audio, and call recordings); ElevenLabs (speech recognition and speech synthesis during calls, without retention of call audio or transcripts); Anthropic (large language models engaged through Amazon Bedrock); Stripe (payments and billing); Vercel (website hosting); Google (Google Analytics website analytics and Google Workspace business email); and Apple (push notification delivery to Apple devices). A current subprocessor list with processing locations is maintained in our Data Processing Addendum at oneearlybird.ai/legal/dpa. Partners are not subprocessors. b. Integrations you authorize. When a business connects a third-party calendar, CRM, or similar service (for example Google Calendar, Microsoft 365, HubSpot, Salesforce, Pipedrive, Zoho CRM, Slack, GoHighLevel, Jobber, Follow Up Boss, Wealthbox, Calendly, or Acuity Scheduling), we exchange data with that service as configured by the business. Those services are independent of EarlyBird and are governed by their own terms and privacy policies. c. Legal and corporate. We may disclose information to comply with law or legal process, to protect rights, safety, and property, or in connection with a merger, acquisition, financing, or sale of assets, in which case this Privacy Policy will continue to apply to the transferred information until updated as described in Section 16. d. No sale. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. Sharing account-level billing information with a business's own Partner, as described in Section 14, is done at the business's direction to provide the billing arrangement the business chose, and is not a sale. e. Third-party sites. Our websites and applications may link to third-party sites and services, including the integrations described above, which have their own privacy practices that this Privacy Policy does not cover. f. Your Partner. If your business's account is billed by a Partner, we share with that Partner the account-level information described in Section 14 so that it can bill you and fund your account, and nothing else. 8. Cookies And Analytics. a. Essential cookies. We use an essential session cookie to keep you signed in, a security token to prevent request forgery, and a preference cookie that remembers your theme choice. These are required for the Services to function. The partner site uses its own essential session cookie, which never travels to the customer sites. b. Analytics. Our websites use Google Analytics 4, configured for site analytics and not for Google advertising features, and Vercel Analytics and Speed Insights, to understand site usage and performance. Google Analytics sets _ga cookies. You can limit analytics through your browser settings, browser extensions such as the Google Analytics opt-out add-on, and by blocking cookies for our sites. c. Opt-out preference signals. Because we do not sell personal information or share it for cross-context behavioral advertising, there is no sale or sharing to opt out of; we treat browser opt-out preference signals accordingly. Our websites do not respond to browser "Do Not Track" signals, for which no industry standard exists. 9. Retention. a. Call recordings, voicemail recordings, and transcripts: 90 days from the date of the call, except that recordings evidencing a caller's consent to receive messages are retained for four years. Text messages a business sends or receives through the Service: 90 days from the date of the message. b. Contact records, bookings, call summaries, and caller profiles: for as long as the business's account remains open, subject to earlier deletion at the business's request. c. Consent, opt-out, and communications-compliance records: four years. Authentication and session audit records: seven years. These periods exist to evidence compliance. d. Account Data: for as long as your account is open and as needed afterward for legal, tax, accounting, and security purposes. e. Backups persist on routine purge cycles not exceeding 35 days after deletion from active systems. f. Partner Program records. Partner applications, including declined ones, are retained for twelve months from submission. A Partner's account records, pricing plans, invitations, statements, and questions are retained while the Partner's account is open and afterward as needed for legal, tax, accounting, and security purposes. The append-only audit log of a Partner's account and the record of which version of the Partner Program Agreement was accepted are retained for seven years. The record of which Partner bills a business is retained with the business's account and for seven years afterward as a financial record. 10. Security. We use encryption in transit and at rest. Call recordings and transcripts are stored in storage dedicated to each business profile and encrypted with a key created for that business profile alone. Database storage, including call records, is encrypted with keys we create and govern, with automatic rotation. Isolation between customers is enforced through access roles scoped to each workspace and business profile. The Partner Program runs in a separate environment from the customer Services: a Partner's sign-in is its own, a Partner's role reaches only that Partner's own records, and no Partner credential can reach any business's account. We maintain access controls that fail closed, append-only audit logging including write-once audit archives, and automated masking of telephone numbers and email addresses in operational logs. No security program eliminates all risk, and we will notify affected customers of a security incident involving their information without undue delay, consistent with applicable law. EarlyBird does not currently hold SOC 2 Type 2 or HIPAA certification. 11. Where Information Is Processed. The Services are offered to businesses operating in the United States, and the Partner Program is open only to companies in the United States. Customer Content is stored and backed up exclusively in United States AWS regions, primarily us-east-1, and our subprocessors process it primarily in the United States. Customer Content is not stored outside the United States. We do not direct the Services to anyone outside the United States, and our terms require customers and Partners to be located in the United States and prohibit concealing location. 12. Your Rights (Customers, Users, Partners, And Site Visitors). a. Choices in the product. Account owners can export workspace data and delete their account from the dashboard and applications, manage notification and marketing preferences, and disconnect integrations at any time. A Partner's owner can update the Partner's website and billing contact, see where the owner is signed in and end other sessions, and ask EarlyBird to change the owner or close the Partner account. b. Requests. Depending on your state of residence, you may have rights to access, correct, delete, or receive a copy of your personal information, and to opt out of certain processing. These rights apply to customers' users, to Partners' owners and applicants, and to site visitors alike. You can exercise these rights by emailing privacy@oneearlybird.ai. We will verify your request using information associated with your account, respond within the time required by applicable law, and will not discriminate against you for exercising your rights. Authorized agents may submit requests where applicable law permits. c. Appeals. If we decline a request, you may appeal by replying to our decision or emailing privacy@oneearlybird.ai with the subject "Privacy Appeal". We will respond to appeals within the period required by applicable law (for example, within 60 days for Virginia residents). If your appeal is denied, you may contact your state Attorney General; Virginia residents may contact the Office of the Attorney General of Virginia. d. Marketing. You can opt out of marketing email through the unsubscribe link in each message or in your account settings, and opt out of SMS by replying STOP. 13. Callers, Contacts, And Clients Of Businesses That Use EarlyBird. For Customer Content, EarlyBird acts as a service provider or processor for the business you interacted with. That business is responsible for responding to requests to access, correct, or delete your information and for honoring your communication choices. Please contact the business directly; if you contact us at privacy@oneearlybird.ai, we will identify the business where we reasonably can and forward your request, and we will assist the business in fulfilling it. You can stop text messages from any business using the Service by replying STOP, and get help by replying HELP. If the business you interacted with is billed by a Partner, the Partner has no access to your information, and your request is still handled by the business and EarlyBird, never by the Partner. 14. Partner-Billed Accounts And What Partners Receive. a. What a Partner-Billed Account is. A business may join EarlyBird through a Partner and agree, when it creates its account, to be billed by that Partner at the Partner's prices instead of by EarlyBird. The business is told the Partner's name and shown a notice about the arrangement before it agrees, and an account is never linked to a Partner without the business's express agreement. The business remains EarlyBird's customer for everything about the Service, and this Privacy Policy, the Terms of Service, and the Data Processing Addendum apply to it exactly as to any other business. b. What we share with the Partner. So that the Partner can bill the business and fund its account, we share with the Partner: the business name on the account; the fact and date that the account was linked to the Partner and its billing status; the plan the business selected from the Partner and that plan's status; the business's usage totals in minutes and calls, by day and by month, in aggregate; low-balance and funding notices; and the fact of any suspension of the Partner or transition of the account to direct billing. c. What we never share with a Partner. Customer Content of any kind, including call audio, recordings, voicemail, transcripts, summaries, caller profiles, contact records, and messages; the telephone numbers of callers or contacts; the business's staff names, roles, or sign-in details; the business's configuration, prompts, integrations, or settings; and the business's support communications with EarlyBird. A Partner has no credentials to the business's account and no technical path into it. d. What the Partner collects itself. The Partner collects payment details and its own contract and contact information from the business directly, through the Partner's own payment processor account and its own channels, under the Partner's own privacy notice. EarlyBird does not see the business's payment card held by the Partner's processor, and the Partner's handling of what it collects is the Partner's responsibility. The Partner is a separate business and is not EarlyBird's processor or subprocessor. e. If the Partner is suspended or cannot fund the account. If a Partner is suspended, or cannot fund a business's account and does not say what it will do about it, EarlyBird may contact the business directly about keeping its service running and about continuing as a business billed by EarlyBird. A Partner's leaving the program is not by itself a reason for that contact. We may tell the Partner that a business has moved to direct billing. We do not share the business's payment details with the Partner. f. Partners' own information. We process the information of Partners, their owners, and applicants described in Section 2(g) as a controller, for the purposes in Section 4(g), with the retention in Section 9(f), and Partners' owners and applicants have the rights described in Section 12. 15. Children. The Services are business tools and are not directed to individuals under 18, and we do not knowingly collect personal information from children for our own purposes. Callers to a business may occasionally include minors; that content is Customer Content processed on the business's behalf. 16. Changes To This Privacy Policy. We may update this Privacy Policy from time to time. We will post the updated version at oneearlybird.ai/legal/privacy with a new "last updated" date and, for material changes, provide notice by email or in-product. Continued use of the Services after the effective date of an update constitutes acceptance. 17. Contact. EarlyBird AI, LLC Fairfax County, Virginia Mailing address available on request to legal@oneearlybird.ai privacy@oneearlybird.ai (privacy requests and appeals) legal@oneearlybird.ai (legal and compliance) support@oneearlybird.ai (support) Version history. Version 1.0, November 8, 2025 (initial policy). Version 2.0, July 25, 2026 (complete rewrite as the canonical policy). Version 3.0, September 6, 2026 (call recording notice and identity on request in Section 6; vendor-level description of AI providers in Sections 5 and 7; processing location wording in Section 11; third-party sites and Do Not Track statements). Version 3.1, September 6, 2026 (contact address stated by county). Version 4.0, October 6, 2026 (the EarlyBird Partner Program: Partners as separate businesses in Section 1(c); Partner Program information in Section 2(g), purposes in Section 4(g), sharing in Section 7(f), retention in Section 9(f), and the separate partner environment in Section 10; location verification in Sections 4(f) and 11; new Section 14, Partner-Billed Accounts And What Partners Receive; Children, Changes, and Contact renumbered to Sections 15 through 17; isolation wording in Sections 4(c) and 10 restated without changing the controls described). Version 4.1, October 22, 2026 (text messages a business sends or receives kept 90 days in Section 9(a) and removed from the records kept for the life of the account in Section 9(b)). Version 4.2, October 26, 2026 (Section 14(e): contact with a business only when its Partner is suspended, or cannot fund it and does not answer, not when the Partner leaves the program). Version 4.3, October 28, 2026 (the language model used during calls runs in EarlyBird's Amazon Web Services environment through Amazon Bedrock, and ElevenLabs performs speech recognition and speech synthesis without retaining call audio or transcripts, in Sections 5 and 7(a)). Version 4.4, October 29, 2026 (Section 10: database storage, including call records, encrypted with keys EarlyBird creates and governs, with automatic rotation; call recordings and transcripts encrypted with a key created for each business profile alone).