Privacy Policy

Effective Date: October 13, 2026

IntakeNexus, Inc. ("IntakeNexus," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our platform and services (collectively, the "Service"). This policy applies to all users, including those in the European Economic Area (EEA) and California residents, and addresses requirements under the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and the California Privacy Rights Act (CPRA).

The Service is used by businesses to answer and organize their customers' calls and messages. If you called, texted, messaged, chatted with, or submitted a form to a business that uses IntakeNexus, we handle your information on that business's behalf; see Section 13 for what that means for you.

1. Information We Collect

1.1 Information You Provide

• Account Information: Name, email address, phone number, company name, and billing information when you register or subscribe.
• Team Members: When an account owner or administrator invites a colleague, we store the invited person's email address and role and send them an invitation email.
• Communications: Messages, emails, and other content you send or receive through the Service, including AI-assisted conversations.
• Voice Call Data: When you interact with our AI phone assistant, we collect call recordings, transcripts, and information you provide during the call (name, service details, service location, appointment preferences). On every inbound call answered by the assistant, before any audio is streamed to an AI service, the caller is told that they are speaking with an AI assistant and not a person; we speak that line ourselves unless the business's own greeting already says the same thing. A recording and transcription disclosure is played in the same opening message; by default it also tells the caller that the call may be processed by AI systems and our service providers. It is enabled by default for every business and is always played for callers in two-party-consent jurisdictions. Outbound calls placed by a business through our campaign feature carry the same AI-identity line and the recording disclosure, spoken before the greeting.
• Business Data: Lead records, customer information, appointments, quotes, invoices, and workflow configurations you create within the platform.
• Quotes and E-Signatures: When a business sends a quote through our customer portal and its customer signs it, we record the signer's name, email address, signature, IP address, browser details, the time of signing, and a cryptographic fingerprint of the signed text, and we email the signer a copy of what they signed.
• Mobile App: If you use the IntakeNexus mobile app, we store a push-notification token for your device and your notification preferences. Push notifications carry generic text (for example, "You have a new message") and internal record identifiers, never customer names or phone numbers.
• Support Inquiries: Information you provide when contacting our support team.

1.2 Information Collected Automatically

• Usage Data: Pages visited, features used, timestamps, referring URLs, and interaction patterns.
• Device Information: Browser type, operating system, IP address, device identifiers, and screen resolution.
• Cookies and Similar Technologies: We use cookies, local storage, and similar technologies to keep you signed in and remember your preferences. We do not use advertising or third-party analytics cookies. See Section 9 below.

1.3 Information from Third Parties

• Authentication Providers: When you sign in through third-party authentication services (e.g., Clerk), we receive your profile information.
• Channel Integrations: When you connect SMS (Twilio), email, WhatsApp, Facebook Messenger, or Instagram DM, we receive messages and metadata through those platforms' APIs.
• Business Tools You Connect: When you connect a calendar, CRM, accounting, or field service tool (see Section 3.2), we exchange the records needed for that integration with it.

1.4 The Live Demo on Our Website

Our website lets visitors talk or chat with the IntakeNexus AI receptionist without creating an account. What you say or type during the demo is processed by the AI and voice vendors listed in Section 3.1 to generate the receptionist's replies, and a record of the conversation with personal details removed is kept for up to 90 days to improve the receptionist. The demo itself is held in memory for the length of the session and is not kept afterwards. Nothing else is stored unless you book a walkthrough (which creates a booking with the name, phone number and email you enter) or leave contact details in the chat (which creates a lead for our team). Before a demo call starts we run Cloudflare Turnstile to tell people from automated bots; see the Cloudflare Turnstile entry in Section 3.1. The demo can also answer as a fictional sample business in a trade, such as a plumbing company. There, calendar and booking actions are only simulated, and anything typed into that business's chat is deleted automatically about a day after the conversation goes quiet.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Process AI-powered message analysis, lead qualification, and automated responses.
• Process voice calls through AI assistants, including real-time speech processing and transcription.
• Process payments and manage subscriptions.
• Send transactional communications (e.g., account verification, team invitations, billing receipts) and push notifications you have enabled.
• Analyze usage to improve features, performance, and user experience.
• Detect, prevent, and address security issues, fraud, and technical problems.
• Comply with legal obligations and enforce our Terms of Service.

Legal Basis (GDPR): We process your data based on contractual necessity (to deliver the Service), legitimate interests (to improve and secure the Service), your consent (where applicable, e.g., marketing emails), and legal compliance.

3. How We Share Your Information

We do not sell your personal information. We may share information with:

• Service Providers: Third-party vendors who help us operate the Service (see Section 3.1 below), under written terms that are, or before they process personal data for us will be, in place to limit their use of the data to providing their service to us.
• Services You Connect or Enable: Integrations you connect and optional services you turn on that use data under their own terms (see Sections 3.2 and 3.3 below).
• Legal Requirements: When required by law, court order, or governmental authority, or to protect our rights, safety, or property.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

3.1 Third-Party Data Processors

We use the following service providers to operate the Service. Each one is, or before it processes personal data on our behalf will be, bound by written data-protection terms — either a data processing agreement with us or the provider's standard data processing terms that form part of its service agreement — that permit it to process the data only to provide its service to IntakeNexus. Providers marked "when enabled" receive data only if the related feature or channel is in use.

3.2 Integrations You Choose to Connect

You can connect your own accounts with other services, such as Google Calendar, Microsoft Outlook calendar, HubSpot, Salesforce, Zoho, QuickBooks, Xero, Jobber, Google Business Profile, and Facebook Pages. These are not our sub-processors: you choose to connect them, they operate under your own agreement with that provider, and we send them only the data the integration needs (for example, appointment details to your calendar or contact details to your CRM) at your direction. Disconnecting an integration stops future transfers; data already sent is governed by your agreement with that provider.

If you use review monitoring, we also retrieve the public reviews of your business from Google using our own access to Google's services. For those requests we send only your business's listing identifier, not your customers' personal data; the reviews we receive include the reviewer names and text that Google publishes. By default we show those Google reviews when you view them and do not store them. We do not currently retrieve reviews from Yelp.

3.3 Optional Services That Use Data Under Their Own Terms

The following services are used only if you turn them on. Their providers receive personal data in connection with the Service but handle it under their own terms and privacy policies, as independent businesses rather than as our service providers, so they are not our sub-processors:

• Meta (Facebook Messenger and Instagram): if you connect your Facebook Page or Instagram account, messages between you and your customers on those channels pass through Meta's platform, which Meta handles under its own terms and privacy policy. WhatsApp messages are covered by the Meta Platforms entry in Section 3.1.

What is removed before an AI provider sees it. Social Security numbers and payment card numbers are stripped from every prompt sent to an external AI provider. For supporting tasks that do not need contact details — language detection, summarization, sentiment analysis, classification, review replies, service matching, and greeting generation — phone numbers, email addresses, and street addresses are stripped as well. For the conversational tasks that make the assistant work — reading details out of a message, generating a reply or quote, chat and voice responses, emergency handling, booking, translation, and human-handoff summaries — that contact information is sent, because the assistant cannot confirm a callback number or route a technician to an address it is not permitted to see. Images are forwarded exactly as received. There is no setting that keeps message processing inside the platform: analysis, extraction, and reply generation always go to the providers named above. The voice leg of a call — speech recognition, the model, and speech synthesis — also runs on the external providers named above; no self-hosted option is offered on any plan. Separately, our internal AI processing logs are written with full redaction applied — phone, email, address, Social Security, and card numbers are all removed before storage (see Section 4).

4. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. After a business account is terminated (which includes its paid plan or free trial ending without being renewed or converted to a paid plan), we keep its data for 90 days so that the business can request an export. After that window ends, we will delete the data, or de-identify it so that it no longer identifies individuals, within a further 30 days — except for records we keep for legal, billing, security, or compliance reasons (such as the business's account and billing records, invoices and payment records, consent and opt-out records, signed authorizations and the minimum related records needed to keep them meaningful, privacy-request records, and audit logs) and copies in encrypted backups, which expire on a fixed schedule of up to two years. Specific retention periods:

• Call records: Anonymized after 365 days. Call metadata (duration, status) retained; PII fields (transcripts, names, phone numbers) are redacted.
• Messages: Anonymized after 365 days for closed conversations.
• Conversations: Anonymized after 730 days (closed conversations).
• Lead records: Anonymized after 90 days for completed, lost, or spam leads.
• Webhook events: Deleted after 30 days.
• Integration logs: Integration logs, integration events and outbound webhook delivery records are deleted after 90 days.
• AI processing logs: Deleted after 90 days (PII-redacted).
• Audit logs: Retained for 7 years and then deleted, so that we can investigate security incidents and show how consent, opt-out, and account changes were handled if a dispute or regulatory inquiry arises.

Anonymized and aggregated data may be retained indefinitely for analytics and product improvement. We may retain certain information longer if required by law or for legitimate business purposes such as fraud prevention.

5. Data Security

We implement industry-standard security measures, including:

• Encryption in transit (TLS), and field-level encryption at rest with AES-256-GCM for the customer names, contact details, and addresses held in primary customer records (such as leads, appointments, and invoices), call transcripts, and the content of SMS, email, WhatsApp, Messenger, Instagram, and website chat messages, including the details our assistant extracts from a chat. Some records are stored without field-level encryption and are protected by the access controls below: IP addresses, browser details, and referring web addresses kept as security, consent, and analytics evidence; staff names and email addresses; free-text notes and context entered by a business's team; copies of customer details in integration, workflow, and webhook delivery logs; the email address given with a privacy request; customers' free-text satisfaction and feedback comments; and the names of uploaded files.
• Access controls with multi-tenant data isolation at the application layer: each request carries a tenant identity that we verify against our own records rather than trusting the token alone, and database queries are scoped to that tenant by an automatic tenant filter. PostgreSQL row-level-security policies for the same boundary are deployed and continuously tested in our build pipeline, and become a second enforcing layer at the database-role cutover.
• Regular security audits and vulnerability scanning.
• Webhook signature verification for all third-party integrations.

However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Your Rights

6.1 Rights Under GDPR (EEA Residents)

If you are in the European Economic Area, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Restriction: Request restriction of processing under certain circumstances.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests or for direct marketing.
• Withdraw Consent: Where processing is based on consent, withdraw it at any time.

6.2 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the right to:

• Know: Request what personal information we collect, use, disclose, and sell.
• Delete: Request deletion of personal information we have collected from you.
• Correct: Request correction of inaccurate personal information.
• Opt-Out: Opt out of the sale or sharing of personal information (we do not sell personal information).
• Limit Use of Sensitive PI: Request that we limit the use and disclosure of sensitive personal information to what is necessary for the Service.
• Automated Decision-Making: We do not use automated decision-making technology to make significant decisions about you, such as decisions about employment, credit, housing, education, or access to essential goods or services. If that changes, we will update this policy and honor any opt-out and access rights the law then gives you. (A business that uses the Service to sort or route its own customers' requests is responsible for how it uses those results; see Section 13.)
• Non-Discrimination: Not be discriminated against for exercising your privacy rights.

6.3 Sensitive Personal Information

During voice calls, callers may disclose health-related information (e.g., symptoms, medical needs) or other sensitive personal information. We treat all information gathered during calls as potentially sensitive and apply the highest level of protection:

• Call transcripts and conversation context are encrypted at rest (AES-256-GCM).
• PII is redacted from AI processing logs before storage.
• You have the right to limit our use of sensitive personal information to what is strictly necessary for providing the Service.

To exercise any of these rights, contact us at privacy@intakenexus.com. We will respond within the timeframes required by applicable law (30 days for GDPR, 45 days for CCPA/CPRA). If you are a customer of a business that uses IntakeNexus, see Section 13.

7. Global Privacy Control

We recognize the Global Privacy Control (GPC) browser signal, which the California Privacy Rights Act (CPRA) treats as a valid opt-out of the sale or sharing of personal information. We do not sell personal information, and we do not disclose it to third parties for cross-context behavioral advertising — so there is no sale or sharing for a GPC signal to stop. When your browser sends the signal and you have not yet saved a cookie choice, our cookie notice tells you we detected it.

Non-essential cookies stay off unless you affirmatively accept them, which is the default for every visitor with or without GPC, and acknowledging the notice records a declined preference. If a GPC signal is sent to our compliance API, we record it as durable evidence of your opt-out request and set a one-year cookie so that request survives even if your browser later stops sending the signal.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. When we transfer data outside the EEA, we use appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

9. Cookies and Tracking Technologies

We use only the following cookies and similar technologies:

• Essential Cookies: Required for the Service to function — sign-in and session cookies set by our authentication provider (Clerk), including its bot-protection check (Cloudflare Turnstile) on sign-up and sign-in, and the Cloudflare Turnstile check we run ourselves when a visitor starts a demo call on our website (Section 1.4). These cannot be disabled.
• Preference Cookies and Storage: Remember your settings, such as your cookie choice, dashboard accent colour, contrast level, and sidebar layout.
• Privacy-Signal Cookie: The one-year Global Privacy Control cookie described in Section 7, set only if a GPC opt-out request reaches our compliance API.

We do not use analytics, advertising, or cross-site tracking cookies, and we do not load Google Analytics or similar tracking scripts. If you select "Reject Non-Essential" (or acknowledge the notice), a click on a sign-up or demo button on our marketing pages is counted on our own servers as an anonymous tally — which button, the page, the referring website, and the time — with no cookie, device identifier, or IP address stored. If optional analytics is introduced in the future, it will be gated behind explicit consent and documented in our Cookie Policy first.

You can manage cookie preferences through our cookie consent banner or your browser settings. Blocking essential cookies will prevent sign-in.

Web fonts for the dashboard are self-hosted/system fonts; visitor browsers are not required to fetch typography assets from Google Fonts CDNs.

10. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will take steps to delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the effective date above. For significant changes, we may also send you a notification via email or through the Service.

12. Contact Information

If you have any questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at:

IntakeNexus, Inc.
Email: privacy@intakenexus.com

For GDPR inquiries, you also have the right to lodge a complaint with your local data protection supervisory authority.

13. If You Contact a Business That Uses IntakeNexus

Businesses use IntakeNexus to answer their phone calls, text messages, WhatsApp, Messenger and Instagram messages, emails, website chat, and web forms, and to send quotes and booking links. If you contact one of those businesses, or it contacts you through the Service, this section applies to you.

13.1 Who Is Responsible for Your Information

The business you contacted decides why and how your information is used and is responsible for it (under privacy laws it is the "controller" or "business"). IntakeNexus processes your information on that business's behalf and on its instructions, as its processor or service provider, under our Data Processing Addendum. We do not sell your information, share it for cross-context behavioral advertising, or use it to market our own services to you. For how the business itself uses your information, please see that business's own privacy notice.

13.2 What We Process for the Business

• Phone calls: your phone number, the call audio, a recording (unless the business has turned recording off where the law allows), a transcript, and the details you give, such as your name, address, the service you need, and appointment preferences. At the start of a call answered by the assistant you are told that you are speaking with an AI assistant, and by default a notice that the call is recorded and transcribed is played as well.
• Texts, social and email messages: your phone number, email address, or messaging account identifier, what you write, and any photos or files you send.
• Website chat and forms: what you type, the contact details you enter, the page you were on and the page that referred you, and your IP address and browser details, which are kept for security and spam prevention. The chat widget stores a random visitor identifier and a reference to your conversation in your browser's local storage so a conversation can continue if you reload the page, and keeps the conversation itself in session storage, which your browser clears when you close the tab. If the business has turned on Google reCAPTCHA for its chat or form, your browser loads Google's reCAPTCHA script, and Google receives your IP address and browser, device, and interaction information to check that you are not a bot — which happens when you first click, tap, or move into the chat or form, before you submit anything. Google does this as one of our service providers (see Section 3.1).
• Quotes, signatures, and payments: if you sign a quote the business sends you, we record your name, email address, signature, IP address, browser details, the time, and a fingerprint of the signed text, and email you a copy. Deposits and payments are processed by Stripe.

13.3 How It Is Used

Your information is used to provide the business's service to you: an AI assistant, powered by the providers listed in Section 3.1, reads or listens to what you send so it can reply, collect the details the business needs, book appointments, and alert the business's staff. AI replies can be incomplete or wrong, and the assistant is not an emergency service: if anyone is in danger, or you smell gas or see a fire, leave the area if it is safe to do so and call 911 or your local emergency number.

13.4 Text Messages

You can stop text messages from a business's IntakeNexus number at any time by replying STOP.

13.5 How Long It Is Kept

The business controls how long your information is kept while it uses the Service. The default retention and anonymization periods described in Section 4 apply unless the business deletes your information sooner.

13.6 Your Choices and Rights

To access, correct, or delete your information, or to exercise any other privacy right you have, please contact the business directly; it decides how to respond, and we help it do so. If you contact us instead at privacy@intakenexus.com, tell us which business you contacted and how (for example, the phone number you called), and we will pass your request to that business and assist it in responding.