Privacy Policy

This Privacy Policy explains how IzzyOps, a product of IzzyLabs Inc. ("IzzyOps", "we", "us"), collects, uses, shares and protects information when you use the IzzyOps platform, our websites and our apps (together, the "Service"). This Privacy Policy does not apply to any other IzzyLabs Inc. websites governed by a separate privacy policy.

1. Who this policy covers, and our two roles

The Service lets businesses build AI employees and automated jobs that answer and place phone calls, send and receive text messages, and carry out tasks for them. That means we handle information about two groups of people, and our role differs for each.

• Our customers and their users. These are the businesses that sign up for IzzyOps and the people they invite to their accounts. We decide how this information is used, and this policy describes it. This includes the texts Izzy, the assistant built into IzzyOps, sends to users who have agreed to them, her emails to users, and users' texts and calls to Izzy (§4.2).
• The people our customers talk to. These are the callers, the people who receive calls, texts or emails, and anyone else who communicates with a business through its IzzyOps phone numbers or jobs. We process their information on behalf of that business, following its instructions and our agreement with it. If you called or texted a business that uses IzzyOps, that business's own privacy policy governs how it uses your information. Contact the business first with any request. We will help it respond, and §9 says how to reach us directly.

2. Information we collect

2.1 From our customers and their users

• Account information: your name, email address, password (we never store it in readable form) and multi-factor authentication settings.
• Your verified phone: the mobile number you verify when you set up your account, which we confirm by texting a code to it, and the time zone your browser reports when you verify it. Verifying your phone does not sign you up for any texts.
• Your choices about texts from Izzy: whether, and when, you agreed to receive texts from Izzy at your verified phone, whether you have since replied STOP or START to Izzy's number, whether we have sent you Izzy's welcome text, and whether you have turned off holding a trigger's texts overnight (§4.2).
• Your texts and calls with Izzy: what you text Izzy and what you say to her on a call, turned into text, her replies, and a recording of each call (§4.2). When you call Izzy's number, we also record whether your mobile carrier confirmed that the call came from your verified phone.
• Business information: your business's name, and, when you choose to verify your business for calls or text messaging, its legal name, business type and industry, tax identification number (such as an EIN), website, address, and an authorized representative's name, title, email and phone number. When you set up texting, we also collect how your business texts: what it sends, sample messages, how people agree to receive them, links to your own privacy policy and terms, how many texts you expect to send, and, for a public company, its stock listing and a contact email the registry writes to. We collect these because telephone carriers and industry registries require them before your calls can be verified or your texts delivered.
• Payment information: payments are handled by Stripe. Your full card number and security code go directly to Stripe and never reach our systems. §2.4 describes exactly what Stripe collects, what we share with it, and what we keep.
• Test calls: when you test a job in the app, your browser records the call, including your microphone, the AI's voice and anybody reached through a transfer during the test, and we keep the recording for 90 days.
• Content you give the Service: the jobs and AI employees you build, their instructions and settings, the documents you upload to your knowledge base, and the connections you make to other services.
• Phone number porting information: if you move a number you already own to IzzyOps, the details your current carrier requires. This includes your account number, PIN, a recent bill and a signed letter of authorization. We pass these to our telephony provider for the port and do not keep them ourselves.

2.2 From the people our customers talk to

When somebody communicates with a business through the Service, we process the following for that business:

• Phone numbers: the number that called or texted the business, and the number the business called or texted.
• Call audio and recordings: every call a business's AI employee answers or places on its IzzyOps phone numbers is recorded from the moment it is answered. Recording stops when the call is transferred to a person, and a call the Service declines to answer is not recorded. The audio is also processed in real time, so that an AI system can listen and respond (§3). The Service does not play an automatic recording announcement.
• Transcripts: a written record of what was said on a call, made automatically as the call happens. It stops when the call is transferred.
• Text messages: the content of messages sent and received, and their delivery status.
• Email: the email address a business emailed, the content of the emails it sent, and what became of each one: whether it was delivered, bounced or marked as spam. Email sent to a business's IzzyOps address is received and kept for 30 days.
• Information collected during a conversation: for example a name, an appointment time, or an answer to a question, when a business's job is built to collect it.
• Communication preferences: whether a person has asked to stop receiving messages, calls or emails from a business, and when, including the words of a request made in a text (§4).

2.3 Collected automatically

• Usage and log data: the pages and features you use, the time and duration of calls and sessions, device and browser type, IP address and error logs. We use these to operate, secure and bill for the Service.
• Browser storage: the web app stores sign-in state and a few preferences (such as which business you are working in) in your browser's local storage. We do not use advertising or cross-site tracking cookies.

2.4 Payments and Stripe

We use Stripe, Inc. ("Stripe") to take payments, run subscriptions and issue invoices. We never see or store your full card number or security code: whenever you enter them, you do it on a page Stripe hosts.

• Where you pay. When you subscribe, buy Izzy credits or reactivate a business, we send you to Stripe Checkout, a payment page hosted by Stripe. You manage your saved payment method and view past invoices in the Stripe Customer Portal, which is also hosted by Stripe. Our own app contains no card field.
• What Stripe collects from you directly: your card number, expiry date and security code (or the equivalent details for Apple Pay or Google Pay), any cardholder name you provide, and your billing address. Stripe also collects information about the device and browser you pay from, for fraud prevention.
• What we send to Stripe: your business's name, the email address of the person who created the business, an internal identifier for the business, an internal identifier for the person who made a purchase and their role, the plan you chose, and the quantities of metered usage your business is billed for (such as AI voice and transfer minutes, extra phone numbers and knowledge base storage). Stripe uses them to create your subscription and calculate your invoices. We do not send Stripe the content of your calls, messages, jobs or documents.
• What we receive from Stripe and keep: your Stripe customer and subscription identifiers; your plan, subscription status and billing period; whether a payment succeeded or failed; the credit packs you bought; and the brand and last four digits of your card, so we can show you which card is on file. We read your invoices from Stripe when you view them, but do not copy them into our own systems.
• Emails from Stripe. Stripe may email your billing address directly, for example receipts, or a notice that a payment failed and a link to pay the invoice.
• Currency. If you pay from outside the United States, Stripe may show you a price in your local currency and charge and invoice you in that currency. Stripe sets that conversion.
• Stripe's own use of your information. Stripe processes payment information to provide its service to us. For some purposes, such as preventing fraud and complying with financial regulations, it decides for itself how that information is used, under the Stripe Privacy Policy. Stripe is certified to the Payment Card Industry Data Security Standard (PCI DSS) at Level 1.
• After your business closes. Closing a business account does not automatically delete the billing record we hold for it. The Stripe customer record, its invoices and payment history are kept by Stripe, because they are our accounting and tax records and are needed to answer any later dispute about a charge.

3. Calls, recordings and artificial intelligence

• Calls are answered and placed by AI. When a business uses IzzyOps, the voice you hear may be generated by artificial intelligence rather than spoken by a person. The AI can hear what you say, respond, look up information the business has given it, and, if the business has set this up, transfer you to a person.
• Calls are recorded and transcribed. Recordings and transcripts are stored so the business can review its calls and improve its service.
• Businesses are responsible for any notice or consent the law requires. The laws in some places require every party to a call to consent to its recording, or require callers to be told that they are speaking with artificial intelligence. The Service does not announce that a call is recorded or that it is conducted by AI, and does not give these notices for the business. Each business using IzzyOps must comply with the local, state and federal laws that apply to its calls, and is responsible for giving any notice, and obtaining any consent, that they require before recording begins.
• We do not train our own AI models on recordings, transcripts, or messages. The AI providers we use (§6) process this content to give the Service its answers; their use of it is governed by our agreements with them.

4. Text messaging

4.1 Texts and calls from a business

When a business sends you text messages or calls you through IzzyOps:

• You can ask to opt out of text messages by replying STOP, or STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, REVOKE or OPTOUT. The business may send a confirmation message.
• An opt-out stops every text and every call the business starts to you through IzzyOps, not only the kind you replied to. Reply START to opt back in.
• Reply HELP for help. On a business's local number, the reply gives the business's name and phone number; on its toll-free number, the reply is a general one from the mobile network.
• Message frequency varies, and message and data rates may apply.
• You can also ask in your own words, in a text to any of the business's numbers or during a call with its AI employee. An AI model reads every text to a business's number that is not one of the words above; if it may be a request to stop, we record your opt-out, keep your words as evidence of it, and text you to confirm.
• We may retain information about your opt-out request to help the business honor it. §7 describes how long we keep information.
• Mobile information and text-messaging consent are not shared for marketing. We do not share mobile information with third parties or affiliates for their marketing or promotional purposes. Text-messaging originator opt-in data and consent are not shared with any third party. The only exception is the providers that deliver the text messages (§6), which receive them solely to deliver them.

4.2 Texts, calls and emails with Izzy

Izzy, the assistant built into IzzyOps, can text the users of our customers' accounts from IzzyOps's own phone number and email them from IzzyOps's own address, and users can text and call her. These texts, calls and emails are with us, not with a business, and this section describes them.

• Izzy texts you only if you agree. After you verify your phone, we ask whether you would like Izzy's texts, and you can agree or decline then or at any time later in your profile. Agreeing is optional, and is not a condition of using the Service, of any purchase, or of employment. Your agreement is for that phone number alone: a new phone starts without it.
• What Izzy texts. Updates, reminders and answers about the business you work in, such as a summary of yesterday's calls every morning. Izzy may send them on her own, at the times a schedule names or, where it is available for your business, when something a trigger names happens in the business. A schedule or trigger can be set up by you, by Izzy at your request, or by another user in your business, and one somebody else set up for you says who the first time it texts you. A text a trigger asks for between 9pm and 8am where you are is held until 8am, unless you turn that off in your profile. Izzy's texts can contain information from that business's account, such as details of its calls and the people who called it.
• The welcome. The first time you agree, Izzy sends you a welcome text with her contact card.
• Message frequency varies, and message and data rates may apply.
• You can opt out at any time. Reply STOP (or STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, REVOKE or OPTOUT) to any of Izzy's texts, or choose to stop Izzy's texts in your profile. A STOP to Izzy's number stops her texts from every business you are in. You can also ask Izzy to stop in your own words. Reply START to her number to have them back.
• Reply HELP for help.
• Texting Izzy. Where it is available for your business, you can text Izzy's number from your verified phone and she answers as she does in the app: she can look up information in the business's account, make the changes you ask for, and you can pick one of the options she offers by replying with its number. If you are in more than one business, she asks which one a text is for, and remembers your choice for a day. Where texting Izzy is not available, a text to her number receives an automated text saying so. A text to Izzy's number from a phone that is not verified in IzzyOps receives an automated text explaining what the number is, at most once a day. A call to Izzy's number from a phone that is not verified in IzzyOps is answered with a short automated message.
• Calling Izzy. You can call Izzy's number from your verified phone, or call her from the app using your device's microphone, and talk to her as you would in the app: she can read you information from the business's account and make the changes you ask for. A call to her number is connected only when your mobile carrier confirms that it comes from your verified phone. What you and Izzy say is turned into text as you speak, using AI, and kept in your conversation with her. Calls with Izzy are recorded, and we use the recordings only to review and evaluate how Izzy works and to check that the Service is used as our terms allow, not to train AI models. Her number is not monitored by a person and cannot reach emergency services.
• Izzy reads your texts using AI. Every text you send Izzy's number is read by an AI model, to answer it and to recognize a request to stop in your own words. A request to stop that it recognizes stops her texts as a STOP does, and is confirmed by text.
• Emails from Izzy. A schedule or trigger can have Izzy email you instead of texting you, at the address you sign in with, about the business it was set up in. Like her texts, her emails can contain information from that business's account. Each one says which schedule or trigger sent it and where in the app to turn it off, and you can stop Izzy's emails to you in your preferences. Replies to Izzy's emails are not read: answer her in the app. We record whether each email was accepted for delivery.
• Your conversation with Izzy. Izzy's texts and emails, your texts to her, what was said on your calls with her, and what a schedule or trigger asked her to do, are kept in your conversation with Izzy in the app, with whether each of her texts and emails was delivered.
• Mobile information and text-messaging consent are not shared for marketing. We do not share the phone number you verify, or your agreement to Izzy's texts, with third parties or affiliates for their marketing or promotional purposes. The only exception is the providers that deliver the text messages (§6), which receive them solely to deliver them.

We may in future let Izzy reach you in other ways, such as by calling you.

4.3 Emails from a business

When a business emails you through IzzyOps:

• Every email has an unsubscribe link. Using it stops every email from that business to that address. We also stop its emails to an address when an email to it bounces permanently or is marked as spam.
• An email opt-out is for that address alone, and does not stop the business's texts or calls. The Service does not currently let an email opt-out be reversed.
• Replies. Email sent to a business's IzzyOps address is received, scanned for spam and viruses, and kept for 30 days. It is not yet passed to the business, so contact the business another way. Before we do, we will update this policy and ask for any consent the law requires.

5. How we use information

We use information to:

• provide, operate and maintain the Service, including answering and placing calls, delivering messages and running the jobs our customers build;
• verify businesses with telephone carriers and industry registries, so their calls and texts are delivered and identified correctly;
• verify your phone, send you the texts from Izzy you have agreed to receive and the emails a schedule or trigger asks her to send, answer your texts and calls to her, and review recordings of those calls to evaluate how Izzy works (§4.2);
• honor communication preferences, including opt-outs;
• process payments and measure usage for billing;
• secure the Service, prevent fraud and abuse (such as unsolicited or fraudulent messaging), and investigate problems;
• provide support and communicate with customers about their accounts;
• comply with the law and enforce our terms.

We process the information in §2.2 only to provide the Service to the business it belongs to, and as the law requires.

6. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share it only as follows:

• With the service providers that run the Service for us, under contracts that limit their use of it to providing their service to us:
  • Amazon Web Services: hosting, storage, databases, sign-in (Amazon Cognito), email delivery (Amazon SES), and AI models through Amazon Bedrock (including models by Amazon, and, where we use it for a business, Anthropic's Claude);
  • Anthropic: the Claude AI models that power Izzy in the app, by text and on calls, read texts sent to Izzy's number, and summarize a business's calls;
  • Deepgram: turning what you say on a call with Izzy into text;
  • ElevenLabs: Izzy's voice on calls with her;
  • Atlassian (Jira): the feedback and problem reports you send us through the Service, with your name and email address, your business, the page you were on, your message and any screenshot you include;
  • Twilio: phone numbers, calls (including calls to Izzy's number), call recording, text messages (including the codes that verify your phone, and texts to and from Izzy), number porting, and business verification with carriers;
  • OpenAI: real-time voice conversation and transcription on a business's calls;
  • Stripe: payments, subscriptions, invoices and usage-based billing (§2.4);
  • Qdrant: search over the documents a business uploads to its knowledge base;
  • Other service providers that receive personal information through the Service, including providers used for connected integrations or operational monitoring, where applicable.
• With telephone carriers and industry registries. Business verification details (§2.1) are filed with carriers and with The Campaign Registry, because delivering a business's verified calls and texts requires it.
• With the services a business chooses to connect. When a business connects another service to IzzyOps and builds a job that sends it information, we send that information at the business's direction.
• Within a business's account, with the other users that business has invited.
• For legal reasons: to comply with law or valid legal process, to protect the rights, safety and property of IzzyOps, our customers or others, and to enforce our terms.
• In a business transfer: as part of a merger, acquisition or sale of assets, subject to this policy.

7. How long we keep information

8. Security

We protect information with encryption in transit and at rest. Credentials the Service holds for a business are separately encrypted with managed keys. Each business's data is isolated from every other business's, and we restrict employee access to what a task requires. Our staff use an internal console across all businesses, which shows account details, members' names and email addresses, phone numbers, usage, billing status and alerts, and lets staff change a business's feature settings; every change made through it is logged before it is made. Where a task requires it, such as support, checking the quality of the Service, or checking that it is used as our terms allow, our staff may review call recordings, transcripts and conversations with Izzy. No system is perfectly secure. If we learn of a breach affecting your information, we will notify you as the law requires.

9. Your rights and choices

Depending on where you live, you may have the right to:

• know and access the personal information we hold about you;
• correct it;
• delete it;
• receive a copy of it in a portable form;
• opt out of certain processing;
• not be discriminated against for exercising these rights;
• withdraw your agreement to receive texts from Izzy, at any time (§4.2).

Customers and their users can update most account information in the app, and can make any other request to legal@izzylabs.com.

People who communicated with a business through IzzyOps should contact that business first, because it controls that information. You can also write to legal@izzylabs.com. We will pass your request to the business and help it respond. To ask a business to stop texting and calling you, reply STOP to any of its texts, or ask during a call with its AI employee. To stop its emails, use the unsubscribe link in any of them (§4).

We will verify a request before acting on it, and respond within the time the law requires. You may use an authorized agent where the law permits.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information.

11. Where information is processed

We store and process information in the United States.

12. Changes to this policy

We will post any change here and update the date above. If a change is material, we will tell customers by email or in the app before it takes effect.

13. Contact us

IzzyLabs Inc., 9850 Von Allmen Ct, Suite 201, Louisville, KY 40241, or legal@izzylabs.com