Privacy Policy

Aestar AI Solutions is a service operated by Profacio, LLC. This Privacy Policy explains how Aestar AI Solutions ("Aestar," "we," "us") collects, uses, and shares information when you visit our website, request a pilot, or use our services (the "Services"). By using the Services you agree to this Policy.

1. Information we collect

• Information you give us. Your name, business name, trade, city, business phone, mobile number, email, business hours, pricing, and similar details you enter when you request a pilot or complete onboarding.
• Business operations data. If you connect a phone number, scheduling/CRM tool, Google Business Profile, or upload a customer list, we process the associated records (e.g. call events, customer contact details, reviews) to operate the Services on your behalf.
• Usage data. Basic technical information such as pages visited and device/browser type, used to keep the site working and secure. We do not use third-party advertising trackers.

2. How we use information

• To provide, operate, and improve the Services (missed-call text-back, pricing analysis, reactivation, reviews, and briefings).
• To set up your account, build your dashboard, and communicate with you about your pilot and account.
• To send service messages you request, and — only with your consent — to send text messages on your behalf to your customers.
• To secure the Services, prevent abuse, and comply with legal obligations.

3. SMS / text messaging

Our Services include text messaging. We only send automated texts on your behalf after you provide explicit consent, and every message follows applicable law (including the TCPA) and carrier rules (A2P 10DLC).

• Message frequency varies. Message and data rates may apply.
• Recipients can opt out at any time by replying STOP, and can get help by replying HELP.
• We do not use purchased or cold contact lists, and mobile numbers collected for one purpose are not sold or shared for others' marketing.
• Consent to receive texts is not a condition of any purchase.

4. How we share information

We do not sell your personal information. We share it only with service providers who help us run the Services, under agreements that limit their use of it:

• Hosting & database: Vercel (hosting) and Supabase (database).
• Messaging & voice: Twilio (phone numbers, SMS, and call routing), when enabled for your account.
• AI phone assistant: Retell AI, which operates the voice agent. When a call is answered by the assistant, Retell processes the call audio and produces a recording and transcript.
• Language models: OpenAI, which generates the assistant's spoken replies from the call transcript, and Anthropic, which we use for text features such as reading an uploaded price sheet. Neither is permitted to train models on your data.
• Email: Resend, for the notifications and summaries we send you.
• Payments: Stripe (billing), when you subscribe. Card details go directly to Stripe; we do not store full card numbers.
• Reviews: Google (Business Profile), when you connect it.

4a. Calls: recording, transcripts, and how long we keep them

If you enable the AI phone assistant, calls to that line are recorded and transcribed. The assistant discloses this at the start of every call, before anything else is discussed — it says it is an AI assistant and that the call may be recorded. Some states require all parties to consent to recording; the up-front disclosure is how we handle that, and a caller who does not want to be recorded can hang up or ask for a person.

What we keep: a recording and transcript of the call, a short written summary, the caller's phone number, and anything the caller asked us to pass on (name, address, what they need).

How long: call recordings and full transcripts are retained for 90 days, after which they are deleted. Call summaries and the contact details needed to serve the customer are kept for the life of your account.

Deletion on request: if one of your customers asks to have their recording, transcript, or details removed, email privacy@aestarai.com with the phone number and approximate date. We remove it from our systems and from Retell within 30 days and confirm when it is done.

Who is responsible for what: for your own customers' information, you are the data controller and Aestar is your processor — we handle that data on your instructions, to deliver the service you asked for. If you need a written data processing agreement for your own compliance, ask and we will provide one.

We may also disclose information if required by law or to protect the rights, safety, or security of Aestar, our customers, or others.

5. Google user data (Calendar)

When you choose to connect a Google account — for example, so your AI receptionist can check your availability and book appointments on your Google Calendar — Aestar requests only the access needed for that feature. This section describes how we handle Google user data, in addition to the terms above. Connecting Google is optional; the Services work without it.

What we access. With your explicit authorization on Google's own consent screen, we request these Google OAuth scopes:

• Google Calendar — read (calendar.readonly): to read your calendar's busy times so we only offer appointment slots that are genuinely open.
• Google Calendar — events (calendar.events): to create and update the appointment events that our Services book on your behalf.

How we use it. Google Calendar data is used solely to provide the scheduling features you turned on — checking availability and creating or updating booking events. We do not use Google user data for advertising, we do not sell it, and we do not use it to develop, improve, or train generalized AI/ML models.

How we store it. We store the Google authorization (refresh) token needed to keep the feature working, encrypted at rest, and we store the appointments we book so they appear in your dashboard. We do not retain a copy of your broader calendar contents.

How we share it. We do not share Google user data with third parties except the infrastructure providers that operate the Services on our behalf (hosting and database), and only as needed to run the feature you enabled. We never sell it or transfer it for advertising.

Revoking access & deletion. You can disconnect Google at any time from your Aestar dashboard, or from your Google Account at myaccount.google.com/permissions. When you disconnect, we delete the stored Google authorization token. To request deletion of associated data, email hello@aestarai.com.

6. Data retention & security

We keep information for as long as needed to provide the Services and to meet legal, tax, and security obligations, then delete or de-identify it. We use reasonable technical and organizational safeguards (encrypted transport, access controls, hashed passwords). No system is perfectly secure, but we work to protect your information.

7. Your rights & choices

Depending on where you live (including under CCPA/CPRA and GDPR), you may have the right to access, correct, delete, or receive a copy of your personal information, and to opt out of certain processing. We do not sell personal information. To exercise any right, email hello@aestarai.com and we'll respond within the time the law requires. You can stop service texts anytime by replying STOP.

8. Cookies

We use a small number of strictly necessary cookies to keep you signed in and secure (for example, your session cookie). We do not use advertising or cross-site tracking cookies.

9. Children

The Services are for businesses and are not directed to children under 16. We do not knowingly collect information from children.

10. Changes

We may update this Policy from time to time. We'll post the new version here with an updated effective date, and for material changes we'll make reasonable efforts to notify you.

11. Contact

Questions about this Policy or your information? Email hello@aestarai.com.