Privacy

What we store, for how long, and what we never do

Draft — review by counsel

Plain English, on purpose. If anything here is unclear, email us and we will answer in plain English too. Last updated October 2026.

Who this covers

Two groups of people: clients (the packaging companies that use the service and their team members) and leads (people who submit a form, call, or text one of our clients and are then contacted by the assistant on the client's behalf).

What we store about leads

• What the lead submitted on the client's form or ad: name, phone, email, company, the message, and any other form fields.
• The consent the lead gave (the exact disclosure text, when, and from which source), and the IP address of the submission.
• Texts sent and received, call attempts, call recordings, transcripts, and a short written summary of each conversation.
• The qualification details the assistant captured (quantity, dimensions, material, timeline, and similar) and any booking made.
• The lead's time zone and state, derived from the phone number's area code, so calls stay inside 8am–9pm local time and recording notices are given where the law requires them.

What we store about clients

• Team member emails and roles, the business profile the assistant is built from (products, questions, hours, booking rules), and notification addresses.
• Usage: minutes, texts and emails used each month, for billing.
• Billing details are held by our payment processor, not by us. We keep only the identifiers needed to match invoices to your account.
• If you connect a CRM, the access token you give us is stored encrypted and used only to create the records you asked for.

Recordings and the assistant

Calls are placed by an automated assistant. It identifies itself as an AI in its first sentence. Calls are recorded so the client's team can hear what was said; in states that require every participant's consent to record, the assistant announces the recording at the start of the call. Transcripts are produced by automated speech recognition and summarized by an AI model. The assistant never quotes prices and does not make decisions about anyone on its own — a person at the client follows up.

How long we keep it

• Call recordings and transcripts: 90 days by default — the transcript and the recording link are cleared automatically after that, and the recording itself is held by our voice provider for the same window. A client can ask for a shorter window.
• Lead records (name, contact details, summary, booking): for as long as the client's account is active, then deleted within 30 days of the account closing.
• Opt-out records: kept indefinitely as a one-way hash (not the raw phone number or email), so a person who said STOP is never contacted again by the same client.
• Usage and billing records: as long as tax and accounting rules require.

Opting out

Reply STOP to any text to end all texts and calls from that client immediately. Tell the assistant you do not want to be contacted and it will end the call and record the same opt-out. Either way, no further automated contact is made and the client's team is told.

What we never do

• We never sell or rent personal information, and we never share one client's leads with another client.
• We never use a lead's data for advertising or for anything other than the client's own follow-up.
• We never contact a lead by automated call without consent captured at the source.

Who else touches the data

We use third-party providers to place calls, send texts and emails, transcribe audio, run the AI model, host the database, and process payments. Each receives only what it needs to do that one job, under contract, and none may use the data for its own purposes.

Your rights

You can ask us what we hold about you, ask for a copy, ask us to correct it, or ask us to delete it. A client can delete any lead (its record, timeline, transcripts and recording links) from the dashboard, and can ask for a copy of their data by email; leads can email us directly or ask the client. We answer within 30 days. If you are in a jurisdiction that grants additional rights, you have those too.

Security

Data is encrypted in transit and at rest. Access tokens and API keys are encrypted with a key that is not stored alongside them. Dashboard access is by one-time email link, and a removed team member loses access immediately.

Contact

Questions, requests, or a complaint: email support@minuteone.io and put "Privacy" in the subject line. Clients can also reply to any invoice.