Saltmeadow Estate Planning

Privacy Policy

Effective date: October 12, 2026

Amfion LLC (“Amfion,” “we,” “us,” or “our”) provides an AI-powered booking platform that helps service businesses manage appointments through conversational AI. This Privacy Policy explains how we collect, use, share, and protect personal information when you interact with our platform — whether you are a business using Amfion (“Tenant”) or a customer booking an appointment through one of our Tenants (“End Customer”).

We believe privacy policies should be clear and readable. Where a section has legal implications, we’ve included a plain-language summary in bold at the top.

1. Our Role: Data Controller vs. Data Processor

In short: When a business uses Amfion to serve their customers, the business decides what data to collect. We process that data on their behalf.

  • As a Data Processor: When End Customers interact with an AI booking assistant powered by Amfion, we process personal data on behalf of the Tenant (the business). The Tenant is the Data Controller and determines how and why End Customer data is collected. We process this data only as instructed under our agreement with the Tenant.
  • As a Data Controller: We act as a Data Controller for information we collect directly, such as when you create an Amfion account, visit our website, talk to the assistant on Amfion’s own website, try a preview assistant built from a business’s public website before that business has an Amfion account, or contact our support team. If a preview is claimed as an Amfion account, its conversations stay with that account.

2. Information We Collect

2a. From Tenants (Business Customers)

When you create an Amfion account and set up your workspace, we collect:

  • Account information: Email address and either a password (hashed and never stored in plain text) or, if you sign in with Google, the name, email address, and profile picture on your Google account
  • Business profile: Business name, phone number, email, website URL, physical address, business hours, timezone, and a link to the business’s own privacy notice if it adds one
  • Terms acceptance and account scope: When a representative of the business accepts our Terms for business accounts, we record who accepted, when, which version, the step where they accepted (such as sign-up), a keyed one-way hash of the IP address, and the browser’s user agent. We also keep the business’s country and its answer to whether it will use Amfion with personal data of people in the EEA, the UK, or Switzerland (see Section 9).
  • Branding preferences: Logo, colors, fonts, hero images, and custom messaging
  • Service configuration: Service names, descriptions, durations, pricing, FAQs, and business policies
  • Integration credentials: API keys and OAuth tokens for connected services (such as Cal.com and Google Calendar). These credentials are stored encrypted in our database provider’s vault. While a credential is in use, a copy may be held for up to an hour in our private server cache.
  • Google Calendar data: If you connect Google Calendar, we access your Google account email, calendar availability, and calendar events so Amfion can display the connected account, check for scheduling conflicts, and create or remove appointment events on your behalf.
  • Billing information: Subscriptions are paid through Stripe. We keep your plan, subscription status, and Stripe account identifiers; card details go to Stripe and never to Amfion.
  • Texting registration: If you register your business for text messaging through Amfion, the details phone carriers require — legal business name, business type, address, tax ID, and the name and contact details of an authorized representative — which we send to Twilio for carrier registration. We keep these details, except that we keep only the last four digits of the tax ID.

2b. From End Customers (People Booking Appointments)

A business may also receive your request through its Amfion request form, an embedded form, a connected marketplace, or a marketplace notification email it forwards to Amfion. We collect the contact details, requested service, message, answers, location and photos included in that request, its source, and any texting consent you give. The business uses these records to respond, follow up about the request, send a quote, and track its outcome.

When you contact a business through its Amfion assistant — in a chat on its website, by phone, by text or WhatsApp message, or by email — or manage your appointments, we collect:

  • Contact information: Name, email address, and phone number — the details you give the assistant, and the number you call or text from
  • Conversation data: Messages you exchange with the assistant, including booking requests, questions, and responses, and any replies from the business’s staff
  • Phone calls: When you call a business’s Amfion number, the number you call from, the time and length of the call, a text transcript of the conversation, and any message you leave. Before the assistant answers, a fixed notice tells you that the call is transcribed and processed by the business’s service providers; where the law or the business requires it, the notice also says the call is answered by an AI assistant. If you ask whether you are speaking with an AI, the assistant says so. Amfion does not record or store the audio of calls.
  • SMS data: When you text Amfion or a business’s Amfion number, or message it on WhatsApp, your mobile number, message content, timestamps, delivery status, opt-out status, and provider message identifiers
  • Files you share: Photos and PDF documents you send in a conversation
  • Booking details: Service selected, appointment date and time, booking status, any notes you provide, details about the pet or vehicle the appointment is for (including anything you tell the assistant the business should know, such as behavior or safety notes), and your answers to the business’s booking questions
  • Technical data: Browser type, session identifiers, and a keyed one-way hash of your IP address. Our database does not store your full IP address; Section 7 explains where it does appear.

2c. Automatically Collected Information

  • Session data: We generate a unique session ID for each chat conversation. Sessions expire after 24 hours.
  • Authentication tokens: If you access the appointment management portal, we use a cryptographically signed token (not a cookie) to verify your identity. These tokens expire after 30 days.
  • Bot verification: We may use Cloudflare Turnstile to verify that chat interactions come from real people, not automated bots. This sends limited technical data to Cloudflare.

2d. Cookies, Analytics, and Browser Storage

In short: Amfion’s own website (amfionhq.com and its sign-up pages) uses Google Analytics to understand how people find and use Amfion. The booking assistant, a business’s booking pages, the appointment portal, and the chat widget on a business’s own website run no analytics or advertising tags and set no tracking cookies. Visitors in the EU, EEA, UK and Switzerland are asked first, and nothing optional runs unless they accept. Browsers that send the Global Privacy Control signal get no analytics at all.

On Amfion’s own website (amfionhq.com, including the sign-up and log-in pages), where analytics is allowed (see “Your choices” below), we set:

  • Google Analytics 4 (cookies named _ga and _ga_*, up to two years): measures page views, the steps of signing up, and how quickly our pages load. While we test a change to the site, it also records which of the two versions you saw. We use it for measurement only — Google Signals and ads personalization are switched off in our code. We may link Analytics to our Google Ads account to measure whether our ads lead to completed previews and activated trials, without building advertising audiences or personalizing ads. Google Analytics 4 does not log or store IP addresses. The cookies are set for amfionhq.com and its subdomains. Details: Section 4h.
  • First-visit and latest-arrival attribution (amfion_attribution and amfion_attribution_latest, 90 days from the first visit, each with a copy in your browser’s local storage): records which page and referring site first brought you to Amfion and the latest identifiable arrival (for example, a search engine or a campaign link) so that we can distinguish how you first found us from a later campaign visit. Direct returns do not replace an earlier source. It contains no name, email, or identifier for you. First-visit fields are sent to Google Analytics on the events above. When you build a website preview, send a setup request or create an account, it is saved with that preview, request or account so we can see which pages bring businesses to Amfion.
  • Site test (amfion_lp, your browser’s local storage, until the test ends and at most eight weeks): while we test a change to our website (for example, a short prompt offering a preview when you are about to leave a page), which of the two versions you see, when the prompt last showed, and whether you already started a preview, opened the chat, signed up or sent a setup request, so it is not shown to you again. It contains no name, email, or identifier for you.

On every surface, strictly necessary storage only:

  • Region check (amfion_geo, deleted when you close your browser): the two-letter country code our edge network reports for your connection. It exists solely to decide whether we ask before analytics runs and holds nothing else.
  • Your cookie choice (amfion_consent, on Amfion’s own website, six months): whether you accepted or rejected analytics, and the version of this cookie section you saw. When the section changes, we ask again.
  • Sign-in session cookies (set by our authentication provider, Supabase, when a business signs in to its admin, or when someone verifies an email to ask for preview setup help).
  • Chat session storage in the visitor’s browser (local storage, never sent to a third party): the signed credential for the conversation they started, so they can return to the same chat, and whether they dismissed the widget’s teaser line. The appointment portal uses the signed link token described above, not a cookie.

Businesses’ own websites: the chat widget renders inside a frame on Amfion’s domain and sets no cookies on the site that embeds it. Any analytics or advertising tags on a business’s own website belong to that business, not to Amfion.

Your choices: visitors located in the EU, EEA, UK or Switzerland, and Tor connections, see a short notice on our website asking whether we may use analytics cookies, with Reject and Accept side by side. Until you accept, the analytics tag is not loaded and nothing in the list above is stored; ignoring the notice counts as no. Anyone can change their answer at any time from “Cookie settings” at the bottom of our website’s pages; visitors elsewhere can turn analytics off there, and it stops right away. When analytics is turned off, we delete the analytics cookies and browser storage our website can reach; copies Google already received stay with Google under Section 4h. Your answer is kept in the amfion_consent cookie (strictly necessary, six months, with the version of this section), and we ask again when it expires or this section changes. Analytics never runs for browsers that send the Global Privacy Control signal, and those visitors are not asked. You can also block or delete cookies in your browser settings or install Google’s browser add-on; the site works fully without analytics cookies.

2e. Website Preview Setup Help

If you verify your email on a website preview and explicitly ask our team for help, we store your email, your self-reported relationship to the business, and the time and wording of your request. We use these details to reply about setting up that preview, not to subscribe you to marketing. They are visible only to Amfion platform operators and are not sent to Google Analytics or Google Ads. Verifying an email does not verify business ownership or start a trial. How long we keep a request is in Section 6.

2f. Setup Requests From Our Website

If you send a setup request from our website, we store the website or business listing you enter, your email address, a callback number if you add one, the page you sent it from, the first-visit and latest-arrival sources described in Section 2d, a keyed one-way hash of your IP address, and the time and wording of the request. We email these details to our team (through Resend, Section 4i) and use them only to reply about setting up Amfion, by email or, if you gave a number, by phone. They do not subscribe you to marketing, are visible only to Amfion platform operators, and are not sent to Google Analytics or Google Ads. Sending a request does not create an account or start a trial. How long we keep a request is in Section 6.

3. How We Use Your Information

In short: We use your data to provide the booking service you’re using. We don’t sell it, and Amfion doesn’t use it for its own advertising.

Separately, a business that uses Amfion can choose to send its own customers follow-up emails, such as a rebooking reminder or a review request. Amfion sends those on the business’s behalf, to that business’s customers only, and each one includes an unsubscribe link.

For End Customers, we use your information to:

  • Process your messages and calls through our AI assistant to help you book appointments, answer your questions, and pass your requests and messages to the business
  • Create, confirm, reschedule, or cancel appointments on your behalf
  • Send you booking confirmations and verification codes and, if the business turns them on, appointment reminders and the business’s own follow-up emails (such as a rebooking reminder, a review request, or an offer when an appointment opens up), sent on the business’s behalf. Follow-up emails always include an unsubscribe link.
  • Tell you when a slot opens for a waitlist you joined — by email, or by text only if you agreed to texts
  • Recognize you when you contact the same business again (for example, by the phone number you call or text from, or the email address or phone number you give), so the assistant can use your contact details and a summary of your past and upcoming appointments with that business. On a call, the assistant confirms who is calling before it uses a name or mentions a booking. The assistant of a law-firm account never recognizes returning customers.
  • Provide access to your appointment management portal
  • Maintain context within your conversation
  • Respond to customer-care and appointment requests you initiate by SMS and maintain delivery, consent, and opt-out records

For Tenants, we use your information to:

  • Create and maintain your Amfion workspace
  • Configure your AI booking assistant with your business details
  • Connect to your calendar and scheduling systems
  • Provide customer support and account management

For all users, we use information to:

  • Protect against fraud, abuse, and unauthorized access
  • Comply with legal obligations
  • Improve and maintain the security and reliability of our platform

4. AI Processing and Third-Party Services

In short: When you chat with, text, email or call a business that uses Amfion, AI model providers process your messages. Each business chooses which: US providers only (Anthropic and OpenAI); DeepSeek, an open-weight model reached through OpenRouter and served only by US-based zero-data-retention providers; or Amfion’s default, which today also runs on DeepSeek through OpenRouter, on zero-data-retention providers that may be outside the United States. The speech on a phone call is always processed by OpenAI. Under their published terms for business use, and through OpenRouter under a restriction on every request we send, these providers do not use your data to train their models.

4a. AI model providers (AI Processing)

Our AI booking assistants are powered by large language models. Each business chooses which of these models may handle its conversations, calls, and the reading of its website:

  • US models (Anthropic and OpenAI). Anthropic’s Claude handles chat, text and WhatsApp messages, email and the reading of the business’s website; OpenAI (or, where Amfion has configured it, Claude) handles the lookups behind phone calls. No request goes to OpenRouter or to an open-weight model, including when Amfion tests the assistant. Law-firm accounts may select this setting instead of their DeepSeek default. “US” describes the companies, not where a request is processed: see Section 9.
  • DeepSeek on US-based hosts. The same work may run on DeepSeek, an open-weight model developed by a company based in China, served only by US-based companies that offer zero data retention (currently Baseten, Fireworks AI, Together AI, DeepInfra, Parasail and Modal). Every request requires zero data retention, forbids training on its contents, is limited to those companies, and is never sent to DeepSeek’s own servers. This is the law-firm default, explicitly acknowledged by the firm before go-live. OpenRouter does not let us fix a processing region on our plan, so we cannot guarantee that processing happens inside the United States. When DeepSeek cannot answer, Claude or OpenAI answers instead.
  • Platform default (not available to law-firm accounts). Amfion chooses the model for each task. Today, replies in the chat widget, by text, WhatsApp and email come from DeepSeek V4.1 Flash, which OpenRouter routes to providers with a zero-data-retention policy; the lookups behind phone calls and the reading of the business’s website run on DeepSeek through OpenRouter too, as described below.

Whatever the setting, the speech on an assistant-answered phone call is processed by OpenAI. Whenever a business’s setting uses DeepSeek for chat, a reply that fails or is too slow to start comes from Anthropic’s Claude instead, and a message that includes a PDF is answered by Claude, because the open-weight route cannot read PDFs. A change to the setting applies to messages, calls and website reads that start after it is saved. A business that has not chosen runs on the platform default; law-firm accounts are the exception and start on DeepSeek through OpenRouter on the listed US-based hosts unless they choose US models. When a preview is built from a business’s public website before the business signs up, that website is read on the platform default; conversations with the preview then follow the same rules — DeepSeek on the listed US-based hosts for a preview Amfion identifies as a law firm’s, the platform default otherwise. When you send a message to a booking assistant:

  • Your message, along with relevant business context (service details, availability, business hours), is sent to the model provider’s API to generate a response
  • The provider processes this data to generate the response and does not use it to train AI models — under the provider’s published terms for business use of its API (Anthropic’s Commercial Terms, OpenAI’s Services Agreement), or, through OpenRouter, because every request requires a zero-retention endpoint and forbids training on its contents
  • Earlier messages in your conversation are included for context so the assistant can follow the flow of your conversation
  • If you have been recognized as a returning customer of the business, your contact details and a short summary of your past and upcoming appointments with it are included too (never for a law-firm account)

OpenAI and OpenRouter also serve the features below, under the same no-training terms:

  • OpenAI holds phone conversations. When you call a business’s Amfion number, OpenAI’s realtime voice model processes your speech live to talk with you and to produce the call transcript. OpenAI’s models also handle the lookups behind phone calls for businesses on US models, answer a phone lookup when the OpenRouter route described below is slow or unavailable, run the business owner’s setup assistant, and run the search over a business’s own documents — for that search, OpenAI receives the business’s documents and the text of a customer’s question.
  • OpenRouter routes model requests to open-weight models served by zero-data-retention providers: chat conversations as described above; for phone calls, the lookups and actions behind the call, such as checking availability and booking — the caller’s request as text plus the business’s details; and the reading of a business’s public website (the import that builds its assistant), with Anthropic as the fallback for that reading. Requests from a business that chose US models never go to OpenRouter. These protections are enforced on every request Amfion sends, not by an account setting: each request requires a zero-retention endpoint and refuses providers that train on or keep its contents, and it is never sent to the model maker’s own servers. For a business that chose DeepSeek on US-based hosts, requests are limited to US-based providers. On the platform default, chat and website-reading requests exclude the providers we know operate outside the United States, and phone lookups go to whichever zero-retention provider is answering fastest, which may be outside the United States. In neither case is the processing location guaranteed. Your speech itself is processed by OpenAI as described above.

Law-firm accounts: a check of the assistant’s replies. For a law firm’s account, whatever its setting, Anthropic’s Claude also reviews the assistant’s replies for anything that reads like legal advice, after they are sent. Each reply by chat, text, WhatsApp or email, and each of the assistant’s turns of a phone call once the call has ended, goes to Claude together with the message it answered; a short reply with nothing legal in it is cleared without being sent. The check never changes a reply: one it flags, or could not check, is listed for the firm’s staff to review.

How long AI providers keep data. OpenAI and Anthropic may keep API data for up to 30 days, for example to monitor for abuse, and content they flag under their usage policies can be kept longer. We have asked both for zero data retention; it has been requested, not granted. The requests Amfion itself sends to OpenAI’s Responses API — the setup assistant, and phone lookups when Amfion runs them — ask OpenAI not to store the response. The phone conversation itself runs in OpenAI’s live voice session, together with any lookups OpenAI runs inside that session (as it does for businesses on US models), and OpenAI’s standard retention applies there.

Whatever the setting, pages of a business’s website that need a browser to display are fetched through Jina AI’s Reader service, which receives only the page address.

4b. Cal.com (Scheduling)

Amfion can schedule appointments with its own booking engine or through Cal.com. If the business schedules through Cal.com, then when a booking is created your name, email, phone number (if provided), and appointment details are shared with Cal.com to create and manage the calendar event. Cal.com reports that it holds SOC 2 Type II and ISO 27001 certifications.

4c. Supabase and Hetzner (Hosting, Database and Authentication)

We use Supabase to store account data, conversation history, files shared in conversations, and booking records, and to sign businesses in to their accounts. Our Supabase database and file storage are located in Germany. Supabase provides encryption at rest and encrypted vault storage for sensitive credentials.

The application servers that run Amfion, our server cache, and our encrypted database backups are hosted by Hetzner in Germany.

Separation between businesses’ data is enforced by the database itself: the work Amfion does for a business runs under a restricted database role that can reach only that business’s records, and automated tests on every release try to reach one business’s data from another with the application’s own filters removed. Section 7 and our Security page describe exactly what is enforced today.

4d. Cloudflare (Security and Delivery)

We use Cloudflare for DNS management, DDoS protection, delivery of our website through its network, and optional bot verification (Turnstile). When bot verification is enabled, limited technical data (such as your IP address) is sent to Cloudflare to confirm you are a real person. Cloudflare also reports the country of your connection to us; we use that only to decide whether to ask for your consent before analytics runs, as described in Section 2d.

4e. Google API Services (Calendar Integration)

When a Tenant chooses to connect Google Calendar, Amfion uses Google API Services to read calendar availability and to create or delete appointment events needed to provide the calendar-sync features the Tenant requests. We store the Tenant’s Google account email, selected calendar identifier, encrypted OAuth refresh token, connection status, and identifiers for events created by Amfion. Appointment events include the service, the time, and the customer’s name and email. Calendar availability is used to prevent booking conflicts; access tokens may be cached briefly and expire automatically.

We do not sell Google user data, use it for advertising, or share it with third parties except service providers acting on our behalf as necessary to operate and secure Amfion, or when required by law. We do not use Google user data to train generalized AI or machine learning models. Users can disconnect Google Calendar in Amfion, which revokes access and removes the stored connection credentials; related booking records and audit logs remain subject to the retention periods described below.

Amfion’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Forwarded marketplace emails. When a business forwards a marketplace notification to its Amfion lead address, the email’s sender, subject, body and reply-to information are sent to the AI extraction provider to identify the person’s contact details and request. The provider follows the business’s AI model setting and fallback rules described above. This creates a lead for the business to manage; it does not grant permission to text the person. Unclear requests are kept for staff review.

4f. Twilio (Phone, SMS and WhatsApp Delivery)

We use Twilio to route phone calls and to receive and deliver SMS and WhatsApp messages. When you call, text, or message an Amfion number, Twilio processes your phone number, message or call metadata, delivery status, and the content needed to provide the communication you requested. WhatsApp messages also pass through WhatsApp’s business messaging service, operated by Meta.

If a business uses Call now to call you back about a request, Twilio first calls a person at the business and plays a short summary of the request. Only after that person accepts does Twilio call your number and connect you to them. The summary may use text-to-speech on the business’s side. You speak with that person; no AI voice answers on your side. Amfion keeps the call’s status, timestamps, duration and estimated cost, and does not record the audio or create an AI transcript of this callback.

4g. Text Messaging With a Business on Amfion

When you text a business’s Amfion number, you consent to replies about your own request. During a call, a text is sent only when you ask for it or say yes to the offer. A waitlist alert is sent only after you agree to that alert. A business may also ask on its own web form, with a texting box that is never pre-checked, or during intake; it then texts you only about what you agreed to. A missed call alone is not permission to send a text.

The Amfion request form and its embedded version have an optional texting checkbox that starts unchecked. Checking it lets the business send an initial response and follow-up texts about that request, including questions, a quote or help booking. Leaving it unchecked still lets you submit the request. We record the consent wording, time, contact identifier and a keyed one-way hash of the IP address as evidence of that choice.

Replies may be automated by the business’s assistant or sent by a person. This is not a recurring marketing program. Message frequency varies with your conversation, and message and data rates may apply. Reply STOP to opt out at any time and HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Your phone number and your texting opt-in are used only to deliver the conversation you started. Sharing with subcontractors that support that service, such as the message-delivery provider above, is limited to what delivering the messages requires. Text-messaging consent is never sold and is not a condition of purchase.

4h. Google Analytics (Amfion’s Own Website Only)

We use Google Analytics 4 on amfionhq.com and its sign-up pages to measure how people find Amfion and where they stop on the way to signing up. Google processes the page addresses you visit, the events described in Section 2d, and technical data about your browser under Google’s privacy policy. We configure it for measurement only: Google Signals and ads personalization are disabled in our code and we do not build advertising audiences. We may share completed-preview, setup-request and trial-activation events from Analytics with our linked Google Ads account to measure advertising results. Google can associate these events with ad interactions using analytics identifiers and campaign information. We do not include names, email addresses, conversation content, or preview access tokens in these conversion events. Google Analytics is never loaded on a business’s booking pages, in the chat widget, in the appointment portal, or for browsers that send the Global Privacy Control signal. For visitors in the EU, EEA, UK and Switzerland it is loaded only after they accept, and we then tell Google, through its Consent Mode, that analytics storage is allowed and advertising storage is not.

4i. Resend (Email)

We use Resend to send email — booking confirmations, verification codes, reminders and follow-ups to customers, notifications to businesses, which can include a customer’s name, contact details and message, and the setup requests sent from our website to our own team (Section 2f) — and to receive email sent to a business’s Amfion email address.

4j. Stripe (Payments)

Stripe processes businesses’ subscription payments. When a business asks for a deposit, you pay on a Stripe-hosted checkout page for the business’s own Stripe account. Amfion creates that page with your email address, the service, and the amount, and receives the payment status — never your card details.

4k. Google Places (Website Previews From a Listing)

A preview assistant can be built from a business’s Google Maps listing instead of its website. When someone pastes a Google Maps link or types a business name and city, Amfion sends Google’s Places service the search text or link (a short Maps link is followed through Google’s own redirect), plus the map location the link points to when it has one. Google returns the business’s public listing — its name, address, phone number, website, opening hours, business categories and status, Google Maps link, and map coordinates. Amfion stores that listing with the preview and uses it to build the preview; if the listing names a website, Amfion reads that website as described in Section 4a. No customer conversation data is sent to Google.

4l. Google Fonts (Pages Hosted for a Business)

Pages that Amfion hosts at a business’s own Amfion web address, such as its booking pages, full-page chat, and appointment portal, display the business’s chosen typeface from Google Fonts. Your browser requests the typeface from Google, so Google receives your IP address and browser details. The appearance settings in a business’s admin load the typeface the same way to preview it. Amfion’s own website serves its fonts from its own domain.

5. Data Sharing

We do not sell your personal data. We never have, and we never will.

We share personal data only in these circumstances:

  • With the Tenant: End Customer data (name, contact information, booking details, and conversation and call transcripts) is accessible to the business you are booking with. They are the Data Controller for this information.
  • With systems the business connects: If a business — or a platform that manages its Amfion account for it — connects its own tools, such as webhooks, custom integrations, or its calendar, the relevant information is sent to those tools at the business’s direction.
  • With service providers: We share data with the third-party providers listed in Section 4 above to operate the platform. If your use requires a data processing agreement, contact us before providing personal data through the Service.
  • For legal compliance: We may disclose data if required by law, court order, or government request, or to protect the rights, safety, or property of Amfion, our users, or the public.
  • Business transfers: If Amfion is acquired or merges with another company, personal data may be transferred as part of that transaction. We will notify affected users before their data becomes subject to a different privacy policy.

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. All data-sharing categories in this policy exclude text messaging originator opt-in data and consent. We do not sell, rent, or share that information with third parties, except aggregators and service providers acting solely to deliver and support the text messaging service.

For SMS conversations, message frequency varies based on your conversation. Message and data rates may apply. Reply STOP to opt out.

6. Data Retention

In short: We keep data as long as it’s needed for the purpose it was collected.

  • Conversations: Chat sessions stay active for 24 hours. Conversation history — including call transcripts, messages, and files shared in a conversation — is kept as part of the business’s records: until the business deletes it or its account data, or, if the business chooses, for 30, 90, 180 or 365 days after a conversation’s last message.
  • Booking data: Retained with the Tenant’s account until that account’s data is deleted (see the next item), plus any period required by law. If the business chooses, a customer’s details (their name, contact details, notes and answers) are removed from an appointment 2, 3, 5 or 7 years after it ends; the appointment’s date, service and price stay in the business’s records.
  • Appointment portal tokens: Expire after 30 days.
  • Tenant account data: Retained while the account is active, and after it ends until it is deleted. A Tenant’s admin can delete its account data from the dashboard (the account stops at once and is deleted after a 7-day period in which the deletion can be cancelled), or ask us by email, and we act within 30 days of a verified request. We delete it from our database, file storage, and sign-in records, except where retention is required by law; we keep the billing records the law requires. Some copies are outside that step: backups expire as described below; our server logs and the records of background jobs in our server cache are replaced by newer entries over time, not on a fixed date; and our providers keep some copies under their own terms. As part of the deletion, we also delete the Tenant’s message records (with any photos) and call records (with any recordings) from our Twilio account, where our records hold the identifier Twilio needs; Twilio may keep deleted records in its own backups for a limited time. We do not yet delete Twilio records we hold no identifier for, Resend’s email logs, or what AI providers retain (Section 4a).
  • Website previews: A preview assistant built from a business’s website or public listing that is not claimed is deleted, with its conversations, the files stored for it (such as photos or PDFs shared in its conversations and its recorded greeting), and the listing details, 7 days after it was last used and no later than 30 days after it was created. We keep a measurement record of each preview so we can count how previews are used: when it started, the kind of business, which steps it reached, and the first and latest arrival sources, without the business’s name or website or the visitor’s contact details. Operator classification, assignment and review history are kept with these records so internal tests can be excluded and changes audited.
  • Preview setup-help requests: Removed on withdrawal, when the associated preview or sign-in account is deleted, or after 30 days, whichever comes first. Expired requests immediately disappear from the operator view and are purged by the scheduled preview sweep. You can withdraw from the help panel while your preview link is available, or contact us to request deletion. An email-verification account is separate; withdrawing a help request does not delete that account.
  • Setup requests from our website: The website or listing, email address, callback number and IP hash are deleted 90 days after the request, or sooner if you ask us. We keep a record without them (the page, the time, the arrival sources and our follow-up status) so we can count which pages and campaigns lead to requests. Our reply and anything you write back stay in our email like any other correspondence.
  • Backups: Encrypted database backups are kept for up to 12 weeks, so data deleted from our database can remain in a backup until that backup expires.
  • Server logs: Our servers’ logs, which include IP addresses, are overwritten on a rolling basis.
  • Audit logs: Retained for compliance and security purposes.
  • SMS records: Inbound and outbound message records, consent evidence, delivery status, and opt-out status are retained as needed to provide the requested conversation, honor messaging preferences, and meet audit and legal obligations.

7. Data Security

We implement technical and organizational measures to protect your data, including:

  • Encryption in transit: HTTPS for all web traffic to Amfion and for Amfion’s requests to its providers; traffic between our own servers stays on a private network
  • Encryption at rest for our database, file storage, and backups, with integration credentials kept in an encrypted vault
  • Separation between businesses’ data, enforced by the database and checked in our application code:
    • Since September 24, 2026, the work Amfion does for a business runs under a restricted database role whose row-level security admits only the records of the business the request is for. A query that misses its filter still cannot return another business’s data, and a write addressed to another business is refused.
    • Queries for a business’s data also carry an explicit filter for that business. An automated check runs on every code change and fails when a query against a business’s tables has no such filter and no recorded reason why it is safe without one (for example, platform-wide billing jobs).
    • Every part of our code that reads or writes a business’s data either goes through a shared access layer, which adds that filter to every query automatically and refuses to write data that names another business, or is on a short, reviewed list of platform functions, each with a recorded reason. The same check fails a change that does neither.
    • The list of tables that check covers is verified against the database schema on every change, so a new table cannot be left out, and a new table without the database’s row rules fails the build.
    • A test suite sets up two real businesses and tries to reach one business’s data from the other with each kind of access credential: business logins, customer links, the AI-agent gateway, and partner API keys. On every change it also runs under the restricted role with the application’s own filters removed, and fails if the database returns or accepts a single record of the other business.
    A short list of platform functions keeps a privileged database connection by design: working out which business a request is for; account setup, including previews built from a business’s public website; billing, payments and usage metering; background jobs that find work across businesses; some Amfion staff tools; discovery and lead routing across a partner’s own businesses; and encrypted credential storage. Files shared in conversations, greeting audio and logos are kept separate by our application code, not by the database.
  • Row-level security is switched on for every table and the public keys a browser can hold have no database permissions, so our database cannot be read directly from a browser
  • Rate limiting on public endpoints, and optional bot verification on chat
  • IP addresses stored in our database only as a keyed one-way hash, except that our authentication provider may record the IP address used to sign in to a business account. Full IP addresses are also used to route and rate-limit requests and appear in server logs that are overwritten on a rolling basis.
  • Cryptographic signing for authentication tokens (HMAC-SHA256)
  • Webhook signature verification for third-party integrations

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data.

For all users:

  • Access: Request a copy of the personal data we hold about you
  • Correction: Request correction of inaccurate data
  • Deletion: Request deletion of your personal data
  • Data portability: Request your data in a structured, machine-readable format

Additional rights under GDPR (EU/EEA/UK residents):

  • Restriction: Request that we limit how we process your data
  • Objection: Object to processing based on legitimate interests
  • Withdraw consent: Where processing is based on consent, you may withdraw it at any time
  • Lodge a complaint: You have the right to file a complaint with your local data protection authority
  • Human intervention: You have the right to request human review of any decision made solely by automated processing that significantly affects you

Additional rights under CCPA (California residents):

  • Know: Right to know what personal information we collect and how it is used
  • Delete: Right to request deletion of your personal information
  • Non-discrimination: We will not discriminate against you for exercising your privacy rights
  • No sale: We do not sell personal information as defined by the CCPA

End Customers: Because we process your data on behalf of the business you booked with, we recommend first contacting the business directly. Where the business has added its own privacy notice, the chat and the appointment portal link to it; otherwise they link to this policy. If the business is unable to assist, you may contact us at [email protected].

Tenants: Contact us at [email protected]. We will respond within 30 days.

9. Where Data Is Processed and International Transfers

Amfion is based in the United States, and the platform runs in more than one country:

  • Germany: our database and file storage (Supabase), and the application servers, server cache and encrypted backups that run Amfion (Hetzner), are located in Germany.
  • United States: our AI, telephony, messaging, email, and payment providers — including Anthropic, OpenAI, OpenRouter, Twilio, Resend, and Stripe — and Google (Sections 2a, 4e, 4h, 4k, and 4l) are US companies, so data they process is transferred to the United States.
  • Other countries: some of these providers may also process data in other countries where they operate. Anthropic, for example, may process a request outside the United States, and our requests to Anthropic do not ask for processing in the United States only. A request routed through OpenRouter can be processed by a provider outside the United States (Section 4a); a business that chose US models sends nothing to OpenRouter. Cloudflare delivers our website through its global network. We have not confirmed where Jina AI processes the web page addresses it receives (Section 4a).

Wherever you are, your data will therefore be transferred to and processed in the United States and Germany, and may be processed in other countries where our providers operate.

Analytics on our website: if you are in the EU, EEA, UK or Switzerland and accept analytics cookies (Section 2d), Google processes your analytics data in the United States. For these transfers Google relies on the EU-U.S. Data Privacy Framework and, for data from the UK and Switzerland, the UK Extension to it and the Swiss-U.S. Data Privacy Framework; where those do not apply, Google may rely on Standard Contractual Clauses.

Amfion currently serves US-based businesses. When a business signs up, it tells us its country and whether it will use Amfion with personal data of people in the EEA, the UK, or Switzerland. An account outside the United States, or one that answers yes or not sure, does not go live until we have reviewed it. For personal data a business sends through the Service, we have not put in place documented transfer arrangements with our providers, such as Standard Contractual Clauses, for data subject to EEA, UK, or Swiss transfer rules, and we do not approve that use until they exist. If your business plans that use, contact us before sending the data through the Service. A US focus does not remove obligations that may apply when someone in one of those places contacts a US business, and we do not block visitors by location.

10. Legal Basis for Processing (GDPR)

Where we process End Customer data on a Tenant’s behalf, the Tenant determines the legal basis for that processing. Where Amfion decides how to use personal data for its own purposes, and GDPR applies, our legal bases depend on the activity and may include:

  • Contract performance: Providing services requested by a person who has a contract with Amfion
  • Legitimate interests: Platform security, fraud prevention, and service reliability
  • Legal obligations: Compliance with applicable laws and regulations
  • Consent: Analytics cookies and similar browser storage on our own website for visitors in the EU, EEA, UK and Switzerland (Section 2d; you can withdraw it at any time from “Cookie settings”), and wherever else it is specifically required (e.g., optional marketing communications)

11. Children’s Privacy

Amfion is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us at [email protected] and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify Tenants by email and update the effective date at the top of this page. We encourage you to review this policy periodically.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us: