Privacy Policy

Nu Vantage AI · Effective date: August 30, 2026 · Version: 2.0

1. Who we are and what this policy covers

Nu Vantage AI, LLC (“Nu Vantage AI,” “we,” “us,” “our”) is a California limited liability company. It provides an AI receptionist named KIRA and related service-communication and workflow-automation services for home-service businesses. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information in connection with our websites (including nuvantageai.com), accounts, AI receptionist, communications, and related services.

When we process information from a business client’s callers solely to provide services on that client’s behalf, the client generally determines the purposes of processing and Nu Vantage AI acts as its service provider or processor. When we process account, billing, website, security, or business-contact information for our own purposes, Nu Vantage AI may act as the business or controller. Individuals may contact either the applicable business or Nu Vantage AI regarding privacy requests.

This policy applies to:

• Visitors to our websites
• Prospective customers who request information, sign up for a free trial, or attend a sales demonstration
• Customers who use our services
• Recipients of communications from us, including emails, text messages, and AI-assisted phone calls from our AI assistant, KIRA
• Individuals whose calls are answered by a Nu Vantage–powered voice bot operated by one of our customers (where we act as a service provider or processor on the customer’s behalf — see Section 5.7)

This policy does not apply to information processed by third parties whose websites or services we link to.

2. Information we collect

2.1 Information you provide directly

We collect information you choose to give us, including:

• Identity and contact information: name, business name, email address, phone number, mailing address.
• Account information: login credentials, account preferences, communication preferences.
• Payment information: billing details processed through our payment processor (Stripe). We do not store full payment card numbers on our systems.
• Communications: the content of emails, text messages, support requests, and phone calls (including AI-assisted calls), and any documents or files you share with us.
• Consent records: the channels you have opted in to, the date and time of consent, the IP address from which consent was given, the form on which it was given, and the version of the disclosure you agreed to.
• Information you submit through forms: trial signups, demo requests, support tickets, and any other forms on our websites.

2.2 Information collected automatically

When you visit our websites or use our services, we and our service providers automatically collect:

• Device and connection data: IP address, browser type and version, operating system, device identifiers, language preferences.
• Usage data: pages viewed, links clicked, time spent on pages, referring URLs, search terms used to find our site.
• Communication engagement data: when you open an email, click a link, reply to a text, answer or decline an AI-assisted call, how long a call lasted, and the outcome of the call.
• Cookies and similar technologies: see Section 7 for details.

2.3 Information from third parties and client websites

We may receive information about you from:

• Service providers (like our CRM, email platform, and analytics tools) that help us deliver communications and analyze website traffic.
• Referral partners when you are introduced to us through a partnership program. If you came to us through a partner, we may share information back with that partner; you will be informed of this at the point of signup.
• Publicly available sources, such as your business’s public website or directory listings, when you express interest in our services.
• Client website information: publicly available descriptions of a client’s services, service areas, prices, equipment, policies, warranties, hours, and contact information, used to configure the AI receptionist for that client.

2.4 Categories of personal information collected (CCPA disclosure)

In the past 12 months, we have collected the following categories of personal information as defined by the California Consumer Privacy Act:

• Identifiers (name, email, phone, IP address, account ID)
• Commercial information (products purchased, transaction history)
• Internet/network activity (browsing history on our site, interaction with our communications)
• Geolocation data (general location inferred from IP address)
• Audio/electronic information (recordings of AI-assisted calls and voicemails)
• Professional or employment-related information (your business and role, where you provide it)
• Inferences drawn from the above (preferences, predicted interests, engagement scoring)

We do not collect: biometric information (see Section 6a), sensitive personal information (as defined under CCPA/CPRA), or information about minors under 18.

3. How we use information

We use information for the following purposes:

• To provide our services: create and manage your account, deliver the services you have subscribed to, process payments, provide customer support.
• To communicate with you: send transactional messages (account confirmations, trial activation, billing), send marketing communications on the channels you have consented to (email, SMS, AI-assisted calls), respond to your inquiries.
• To improve our services: understand how our services are used, analyze usage patterns, develop new features. We use only de-identified or aggregated data for service improvement.
• To ensure security: detect and prevent fraud, abuse, security incidents, and unauthorized access; enforce our Terms of Service.
• To comply with legal obligations: respond to lawful requests, comply with applicable laws (TCPA, CAN-SPAM, CCPA/CPRA, state privacy laws), maintain consent records, and exercise or defend legal claims.
• With your consent: for any other purpose disclosed to you at the time we collect the information.

We do not sell personal information or share it with third parties for their own cross-context behavioral advertising. We do not use identifiable call recordings to train general-purpose AI models or models made available to unrelated third parties unless we provide additional notice and obtain any consent required by law.

4. AI-assisted communications

We use an AI voice assistant named KIRA and automated systems to send text messages and emails. Because AI and automated communications are subject to specific legal requirements, this section describes our practices in detail.

Consent and legal basis: Where we make or receive calls, texts, or voicemails on your behalf, we do so based on the consent you and your callers provide, and to perform our contract with you. Our AI greeting discloses call recording and requests consent, and our workflows capture caller consent.

4.1 KIRA — our AI voice assistant

KIRA is software, not a human. KIRA may call you to follow up on a free trial, answer questions about our services, schedule meetings, or provide support — only if you have given us prior express written consent to receive AI-assisted calls.

AI disclosure: At the start of every call, KIRA identifies itself as an AI assistant. You will not be misled into believing you are speaking with a human.

Call recording: Calls with KIRA are recorded for quality, compliance, and service-improvement purposes. Recordings are ordinarily retained for no longer than twenty-four (24) months, after which they are deleted or de-identified, unless a longer period is required by law or reasonably necessary for a dispute or legal hold (see Section 6).

AI training: We do not use your call recordings, transcripts, or any other identifiable data to train AI models — neither our own nor those of our vendors. We may use de-identified, aggregated metrics (such as average call duration or outcome distributions) to improve our service.

Calling hours: KIRA only places calls between 8:00 a.m. and 9:00 p.m. in your local time zone, in compliance with the Telephone Consumer Protection Act. Our typical operational window is 10:00 a.m. to 6:00 p.m. local time.

Frequency: We will not call you more than once in any 24-hour period or more than four (4) times within any 14-day period, unless you specifically request additional contact.

4.2 Text messages (SMS)

If you have given us prior express written consent, we may send you marketing and transactional text messages, some of which may be sent using automated technology. Message frequency varies; you will typically receive up to five (5) marketing messages per month, plus transactional and service messages as needed. Message and data rates may apply.

Opt-out: Reply STOP to any message to unsubscribe. Reply HELP for help. See our SMS Terms at nuvantageai.com/sms-terms for full details.

4.3 Email

We send transactional emails (account, billing, service notices) to all customers regardless of marketing preferences while you have an active relationship with us. Marketing emails are sent only to those who have opted in, and you can unsubscribe at any time using the link in any email or by replying UNSUBSCRIBE.

4.4 Voicemail

If we attempt to call you and reach your voicemail, we may leave a brief message identifying ourselves and providing a callback number. Voicemails left by KIRA will identify KIRA as an AI assistant. We do not use ringless voicemail technology.

5. How we share information

We do not sell or rent your personal information. We share information only as described below.

5.1 With service providers

We share information with companies that help us operate our business and deliver services to you. These service providers are bound by contract to use your information only to provide services to us and to protect it appropriately. Categories of service providers include:

• CRM and marketing automation: GoHighLevel hosts our customer database, workflows, and communications.
• AI voice platform: Thinkrr places AI-assisted calls and stores call recordings and transcripts on our behalf.
• Email and SMS infrastructure: our messaging is delivered via providers integrated with GoHighLevel and our 10DLC-registered SMS provider.
• Payment processing: Stripe processes payments and stores billing information.
• Hosting and infrastructure: Cloudflare provides DNS and email security services; GoHighLevel hosts our website pages and forms.
• Analytics: Google Analytics helps us understand website traffic and improve our services. We do not use Google Analytics to track individual users across other sites.
• Professional services: our attorneys, accountants, and similar professionals, when their services require access to information.

Service providers may process information only for authorized purposes and are subject to contractual confidentiality, security, and data-use restrictions. A current list of material subprocessors may be requested at [email protected]. We do not authorize service providers to independently sell caller information, use it for unrelated advertising, or create biometric voice identifiers.

5.2 With referral and channel partners

If you came to us through a referral or channel partner, we may share with that partner: your name, business, the products you purchase, and your engagement with our service. This sharing is limited to the partner who referred you and is used solely to administer the referral relationship and our partnership program.

5.3 For legal reasons

We may disclose information when we reasonably believe it is necessary to:

• Comply with applicable law, regulation, legal process, or governmental request
• Enforce our Terms of Service or this Privacy Policy
• Protect the rights, property, safety, or security of Nu Vantage AI, our users, or others
• Detect, prevent, or address fraud, abuse, security, or technical issues

5.4 In a business transfer

If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, we may transfer information as part of that transaction. We will notify you (via email or a notice on our website) of any change in ownership or use of your personal information.

5.5 With your consent

We may share information for any other purpose with your explicit consent.

5.6 We do not sell your personal information

We do not “sell” your personal information for monetary or other valuable consideration. We do not “share” your personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act and similar state laws.

5.7 Information processed on behalf of our customers

Our customers (home service businesses) may use Nu Vantage AI to operate AI voice assistants that handle calls from their own customers, leads, or inbound callers. When we handle this data, we do so as a service provider (a “data processor” under applicable law) on our customer’s behalf and under our customer’s instructions.

In those scenarios:

• Our customer is the controller of that data and is responsible for providing notice to and obtaining any required consent from their callers
• We process call recordings, transcripts, and related metadata only as needed to deliver the voice bot service
• We do not use that data for our own marketing or sales purposes
• Retention and deletion of that data is governed by our agreement with the customer

Client-owned systems: Call recordings and consent records may be stored in the CRM configured for a customer’s account. Where that CRM is a system the customer owns or controls (for example, a GoHighLevel account they maintain or a third-party CRM linked via webhook or API), once data is transferred to that system, its own policies and the customer’s configuration govern it. Nu Vantage AI does not control, and is not responsible for, the security, retention, access, accuracy, or lawful handling of data once it is transferred to such a system. The customer controls access to and retention of those records through their own CRM.

6. How long we keep information

We keep personal information for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law. Specific retention periods include:

• Active customer data: for as long as the customer relationship is active.
• Inactive contact data (no engagement): up to two (2) years after the last engagement, then archived or deleted.
• Full call recordings and transcripts: ordinarily up to twenty-four (24) months, unless a longer period is reasonably necessary for an active dispute, legal hold, contractual requirement, or documented legal obligation.
• Limited consent recordings, consent logs, and script-version records: up to seven (7) years.
• Email and SMS engagement data: up to two (2) years after the last engagement.
• Billing and tax records: seven (7) years, as required by tax law.
• Suppression and revocation records: as long as reasonably necessary to prevent unwanted communications.
• Records subject to litigation, investigation, or legal hold: until the matter is resolved and the hold is released.

At the end of the applicable period, information is deleted, de-identified, or rendered inaccessible in accordance with our retention procedures.

6a. Voice recordings and biometric information

Call recordings contain a caller’s voice. Nu Vantage AI uses recordings and transcripts to provide the requested services, document communications and consent, maintain quality and security, and address disputes.

Nu Vantage AI does not use caller voices to create voiceprints, biometric templates, voice embeddings used for identity recognition, or biometric authentication profiles. Returning callers are recognized through telephone numbers and account information rather than biometric voice recognition.

If Nu Vantage AI later introduces biometric voice identification or authentication, it will first provide a separate biometric-data notice, establish an appropriate retention and destruction policy, and obtain any consent required by applicable law.

7. Cookies and similar technologies

We use cookies and similar tracking technologies on our websites. The categories include:

• Strictly necessary cookies: required for the site to function (e.g., session management). Cannot be disabled.
• Analytics cookies: help us understand how visitors use our site (Google Analytics).
• Functional cookies: remember preferences (e.g., login state).

You can control cookies through your browser settings. If you reject cookies, some features of our site may not work properly. Where required by law, we obtain your consent before placing non-essential cookies.

8. Your rights and choices

8.1 Communication preferences

You can opt out of our communications at any time:

• Email: click “unsubscribe” in any marketing email or reply UNSUBSCRIBE.
• SMS: reply STOP to any text message.
• AI-assisted calls: say “stop,” “remove me,” or “do not call” on any call from KIRA, or call/email us using the contacts in Section 12.
• All channels at once: update your preferences at our Preference Center: nuvantageai.com/preferences

8.2 Privacy rights

Depending on applicable law and subject to statutory exceptions, you may have the right to:

• Confirm whether we process personal information about you
• Access or obtain a copy of your personal information
• Correct inaccurate personal information
• Request deletion of personal information (subject to limited exceptions, such as data we must keep for legal or accounting reasons)
• Obtain certain information in a portable format
• Opt out of certain targeted advertising, sales, or profiling
• Limit certain uses of sensitive personal information (we generally do not collect sensitive personal information)
• Appeal the denial of a privacy request
• Be free from unlawful discrimination for exercising your privacy rights

To exercise these rights, email us at [email protected] or write to the address in Section 12. We may request information reasonably necessary to verify your identity and authority. When we process information solely for a business client, we may refer the request to that client and assist it in responding. An authorized agent may submit a request where permitted by law, subject to verification of the agent’s authority.

Appeals: If we deny a request, you may appeal by emailing [email protected] with “Privacy Appeal” in the subject line. We will respond within the timeframes required by applicable law.

8.3 California residents — additional rights

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including:

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information
• Right to limit the use of sensitive personal information
• Right to non-discrimination for exercising your privacy rights

California residents may also designate an authorized agent to make requests on their behalf. We will verify both the agent’s authority and the requester’s identity before responding.

8.4 Texas residents — additional rights

If you are a Texas resident, you have rights under the Texas Data Privacy and Security Act (TDPSA), including the right to access, correct, delete, and obtain a portable copy of your personal data, and the right to opt out of certain processing. To exercise these rights, contact us as described in Section 12.

8.5 Other states

If you reside in Virginia, Colorado, Connecticut, Utah, Oregon, Montana, Iowa, Indiana, Tennessee, or another state with a comprehensive privacy law, you may have similar rights to those described above. Contact us as described in Section 12 to exercise any rights available to you under your state’s law.

8.6 Federal Do-Not-Call Registry

We honor the federal Do-Not-Call Registry. If your number is on the registry and you have not given us prior express written consent to receive marketing calls, we will not call you for marketing purposes.

9. How we protect information

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information from loss, misuse, unauthorized access, disclosure, alteration, and destruction. These include:

• Encryption of data in transit (TLS/SSL) and at rest where appropriate
• Access controls limiting employee and contractor access to personal information on a need-to-know basis
• Regular review of our security practices
• Vendor due diligence and contractual data protection obligations

No system is perfectly secure. If we become aware of a security incident affecting your personal information, we will notify you in accordance with applicable law.

10. Children’s privacy

Our services are intended for businesses and adults aged 18 or older. We do not knowingly collect personal information from anyone under 18. If we learn we have collected personal information from someone under 18, we will delete it. If you believe a minor has given us personal information, contact us immediately at [email protected].

11. International users

Our services are operated from the United States and intended for U.S. customers. If you are accessing our services from outside the United States, your information will be transferred to, processed, and stored in the United States. By using our services, you consent to this transfer.

12. How to contact us

For questions about this Privacy Policy, to exercise your rights, or to report a privacy concern, contact us:

• By email: [email protected]
• By phone: (760) 406-5554
• By mail: Nu Vantage AI, LLC, 1111 6th Ave Ste 550 PMB 435864, San Diego, CA 92101-5211
• Online preference center: nuvantageai.com/preferences

We acknowledge requests within five (5) business days and complete them within the timeframes required by applicable law.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The version number and effective date at the top of this policy will reflect the current version. For material changes — meaning changes that materially affect how we use, share, or protect your personal information — we will notify you by email and provide at least thirty (30) days’ notice before the changes take effect, where reasonable and permitted by law. For non-material changes (e.g., typo fixes, clarifications), we will update the version number and effective date.

We retain prior versions of this policy and the date each was in effect. To request a copy of an earlier version, email [email protected].