Privacy Policy

Maurie AI LLC is an Iowa limited liability company at 5791 Pigeon Creek Rd., Bettendorf, IA 52722, United States. Contact service@maurieai.com for privacy inquiries.

This policy describes personal information we handle through our website, accounts, business communications, and Services. It also explains our role when business customers use Maurie AI to process information about their contacts, employees, website visitors, signers, or purchasers.

For account administration, billing, service support, security, and our own business communications, Maurie generally determines the purposes and means of processing. For information a business customer places in its workspace or collects using its configured tools, Maurie generally processes it on that customer’s instructions, subject to an appropriate data processing agreement where required. Some payment providers and integrated platforms act independently for their own purposes.

If you interact with another business’s Maurie-powered agent, campaign, document, review link, or checkout, that business’s privacy notice also applies. Direct requests about its records to that business first; we assist our customers with appropriate requests.

Account and business details: names, email addresses, business identifiers, roles, workspace membership, contact and billing information, and authentication-related identifiers.

Customer workspace information: CRM contacts and properties; companies; tasks, notes, and activity; chat messages, attachments, and feedback; connected email and calendar information; marketing recipients and campaign activity; reviews; documents, quotes, signature-related records, and transaction and receipt details, depending on enabled features.

AI inputs and outputs: prompts, instructions, website or help-center content you connect, FAQs, uploaded training files, retrieved knowledge, generated replies, and other outputs. Inputs transmitted for AI processing can include chat history, business training content, attached images and PDFs, and, for Inbox drafts, the email thread and contact details. Supported voice input can also involve voice-related information needed to provide that feature.

Phone calls: when a business uses the AI Phone Receptionist, we process the caller’s phone number and caller ID, what the caller says and their voice, call recordings, transcripts and AI summaries, details callers give (such as name, email address, message, or appointment), call times and durations, transfer results, and spam and block-list status.

Payments: subscription and transaction references, amounts, status, refunds, and limited payment-method information. Stripe processes sensitive card credentials; supported stored-card displays in Maurie show limited identifiers such as brand and last four digits rather than the complete card number.

Technical and usage information: information needed to operate, authenticate, troubleshoot, and secure the Services, including browser/device information, access times, identifiers, logs, and feature activity. Requests to hosting providers or browser-loaded resources can disclose technical connection information such as IP address. We use Cloudflare Web Analytics on our public website to count page views and visits. It does not use cookies or store anything on your device, and it does not track you across other websites. If you accept the ads cookie notice on our public website, we also use the Meta Pixel to measure how our Facebook and Instagram ads perform: it records the public pages you view and whether you create an account, and Meta sets its own cookies (_fbp and _fbc). When you then create an account, we send Meta that sign-up through Meta’s Conversions API with a hashed (SHA-256) copy of your email address and name, your browser type, and the ad you came from, so Meta can match the sign-up to the ad. If you decline, or your browser sends Global Privacy Control, none of this happens. When you arrive from one of our ad links, your browser keeps the link’s campaign tags for 30 days, and we save them with your account so we know which ad brought you. We use no error-tracking services; this does not mean operational logs or provider security processing are absent.

Support and communications: information you provide when contacting us, reporting problems, or requesting assistance. Do not send PHI or full card credentials to support.

We receive information from you, authorized workspace users, people interacting with customer-configured features, enabled integrations, and technical operation of the Services. People who call a business’s AI Phone Receptionist number provide information during the call; the caller ID comes from the telephone network. Customers choose the business sources they connect or upload and are responsible for having the right to provide them. Connecting an integration may allow us to receive its authorized data until access is revoked, subject to its permissions.

We use information to provide and configure accounts and features; retrieve customer-selected knowledge and generate AI responses; manage communications, signatures, transactions, and receipts as instructed; process subscriptions; provide support; maintain reliability; prevent abuse and unauthorized access; respond to lawful requests; and maintain necessary business records.

We may use operational and diagnostic information to maintain software reliability and security, subject to applicable law. Maurie itself does not use Customer Content to train or improve general-purpose AI models or models for other customers. Connecting your business sources so your agent can retrieve information and answer questions is distinct from training a general-purpose model.

AI requests use either Google Gemini or OpenAI, with only one provider active at a time. Relevant messages and history, business training material, attached images or PDFs, and email-thread/contact information for Inbox drafts are sent to the active provider as needed for the feature. Provider retention, safety review, and any training or product-improvement use depend on its applicable agreement, account type, and settings. Maurie has not yet verified the account-specific no-training conditions, so this policy does not guarantee that every provider is prohibited from using all inputs for those purposes. Contact service@maurieai.com for the current provider and available account-specific information before submitting sensitive or confidential material.

For the AI Phone Receptionist, call audio is sent to Google Gemini in real time so the receptionist can listen and answer, and Google Gemini also produces the transcript and summary. We do not create voiceprints or use callers’ voices to identify them.

We may send necessary account and service notices. Optional promotional communications follow applicable consent and opt-out requirements. We do not sell personal information. Apart from Cloudflare Web Analytics on our public website, which uses no cookies, and the Meta Pixel and Conversions API described above, which run only if you accept the ads cookie notice, we use no analytics, advertising, or error-tracking service. Sharing information with Meta to measure our ads may count as “sharing” for cross-context behavioral advertising under some U.S. state laws. You can opt out at any time with “Cookie choices” at the bottom of our website, by clearing this site’s storage in your browser, or by sending Global Privacy Control. A future material change requires an updated notice and any legally required choice or consent before the new processing begins.

We disclose information as needed for the purposes described here, including to authorized account users, providers operating the Services, integrations you enable, and recipients you instruct us to contact or publish to.

Supabase provides production database, authentication, and file storage in the United States, in us-east-1. Render hosts the backend in Virginia, United States. A separate Supabase development project in Singapore is used for test data, not identified here as the production customer-data environment.

Google Gemini or OpenAI processes relevant AI requests, with one provider active at a time. The information sent and the limits of our current account-specific verification are described in Section 4.

Mailgun in the United States handles email sending and receiving. Resend is a backup provider for alert emails. Stripe handles subscription billing and the Maurie Pay integration, including merchant payments and associated transaction information.

Twilio provides the phone numbers for the AI Phone Receptionist and connects calls, including transfers to a business’s team, and stores call recordings and call records. Google Gemini processes call audio and produces transcripts and summaries for the AI Phone Receptionist.

Google Calendar and Google Business Profile receive relevant information only when a customer connects them. Meta integrations for WhatsApp, Facebook, and Instagram, and LinkedIn integrations, operate only when connected by a customer. Connection permissions determine which information is exchanged. Google Fonts and Google Maps also load in the browser where used; requests for these resources can disclose technical connection information to Google even without a Calendar or Business Profile connection.

Cloudflare Web Analytics loads on our public website pages and receives the page address, the referring site, and browser, device, and approximate location information, without cookies, so we can count page views and visits.

Meta Platforms receives, only after you accept the ads cookie notice on our public website, the addresses of the public pages you view, browser and device information, and Meta’s cookie identifiers, and, when you create an account, the sign-up event with a hashed email address and name, to measure our Facebook and Instagram ads. Meta’s use of this information is described in Meta’s Privacy Policy at https://www.facebook.com/privacy/policy.

DataForSEO receives keywords and locations for ranking checks, rather than CRM records, contact details, or chat content. Keywords and locations may still identify or describe a business; do not place unnecessary personal information in ranking inputs.

Providers processing personal information on our behalf are subject to contractual obligations applicable to their role. Some providers, payment services, and independently operated integrations also process information under their own terms and privacy notices. Production storage in the United States does not establish that all provider operations take place only there.

Publishing a page, post, review, or widget can make its configured content publicly accessible. Customers choose what they share and are responsible for having the necessary rights and permissions. We may disclose information when legally required, to establish or defend legal claims, investigate abuse, or protect safety and security, with scope limited as appropriate. Information may also be transferred in a merger, acquisition, or asset sale, subject to applicable confidentiality, privacy, and notice requirements.

Where laws require a legal basis, account and service processing may be necessary to perform a contract; security, support, and proportionate business administration may rely on legitimate interests after considering individual rights; legally required records or disclosures may rely on legal obligations; and optional processing may rely on consent where required. You can withdraw consent without affecting the lawfulness of earlier processing.

When acting as a processor for a business customer, we follow that customer’s lawful instructions; the customer is responsible for identifying the legal basis for its processing. Do not interpret use of a website or this policy as blanket consent to all data processing.

Canceling a paid subscription takes effect at the end of its billing period. The account moves to Free and Customer Content is retained, subject to Free-plan functionality and usage limits. Cancellation does not request data deletion.

There is currently no fixed general retention period: customer data remains stored until the customer deletes it or requests deletion, subject to applicable law. Deleting a workspace immediately removes its database records. It does not currently remove all files, including some contact files, signed documents, and logos, or the associated login account. There is no self-service account-deletion function for an individual user at present.

Call recordings, transcripts, and summaries from the AI Phone Receptionist are deleted automatically 90 days after the call, and the business can delete a call sooner. The call’s date, time, number, duration, and outcome stay for call history and billing, and a summary the business has copied into a lead, task, or notification stays until the business deletes it.

Contact service@maurieai.com to request deletion of remaining files, a login account, or other personal information. We assess and handle requests in accordance with applicable law, customer instructions where we act as a processor, and any governing data processing agreement. Applicable rights and legal response periods remain in effect despite technical limitations. Some information may need to remain for payments, tax or other legal records, disputes, or legal claims.

Supabase retains seven days of daily database backups. Maurie also takes its own backups twice per month and before releases; these additional backups currently have no fixed expiry date. Deleted information may remain in those copies. Workspace deletion is therefore not a promise of immediate erasure from every backup, nor a guarantee that particular content can be recovered. Backup retention and any restoration must be handled consistently with applicable legal obligations and rights requests.

If you need a copy of your information or want to understand what remains after deletion, contact us before deleting your workspace. We do not offer a guaranteed archival or recovery service.

Messages and files in Maurie Chat, the team messaging feature, are deleted automatically 30 days after they are posted, and a user can delete a message, a file, or a conversation sooner. A task or contact created from a chat message stays in the CRM until the business deletes it.

Facebook and Instagram connections. When a user connects a Facebook Page to a Maurie AI business location, we store the Page id and name, the linked Instagram business account id, a Page access token used only to publish the posts that user approves and to read their results, and the id of the Facebook account that made the connection. This data is deleted immediately when the connection is removed in Maurie AI, when the Maurie AI app is removed from the Facebook account, when Facebook sends us a data deletion request, or when the Maurie AI account is deleted. Instructions and the status of a deletion request are at maurieai.com/facebook-data-deletion.

We use appropriate technical and organizational measures designed to protect personal information. Specific security or certification claims will be made only when verified. No online service can guarantee complete security. Customers should protect credentials, limit access, and notify us promptly about suspected compromise.

PHI is prohibited under our Terms. Maurie AI is not offered for HIPAA-regulated patient-data processing, and these Services do not include a Business Associate Agreement. If prohibited information is submitted, contact service@maurieai.com so we can assess appropriate containment and removal subject to legal obligations.

We are based in the United States and intend to serve international business customers where legally and technically supported. Production database, authentication, and files are hosted through Supabase in the United States, and the backend is hosted through Render in Virginia, United States. The separate Singapore development project is used for test data.

Other providers may process information in additional countries under their applicable service arrangements. We do not represent that every AI, payment, communications, or integration operation is confined to the United States.

Where applicable law restricts international transfers, an appropriate transfer mechanism and any necessary additional safeguards must be in place for the relevant processing. Available mechanisms may include standard contractual clauses or applicable UK arrangements where validly established. This policy does not claim that Maurie is certified under the EU–US Data Privacy Framework. Contact service@maurieai.com for information about applicable transfer arrangements and available safeguards.

Depending on applicable law, you may have rights to access, correct, delete, or obtain a copy of personal information; restrict or object to processing; withdraw consent; and appeal a decision on a rights request. You may also have rights concerning sale, sharing for targeted advertising, or certain profiling. Maurie currently does not sell personal information or use advertising cookies. We do not discriminate against individuals for exercising applicable rights.

Send requests to service@maurieai.com. We may request proportionate information to verify identity or authority and respond within applicable legal time limits. Authorized agents may submit requests where permitted, with appropriate evidence. Some rights have exceptions, such as legally required retention or protection of others’ rights. Where local law gives an appeal right, send the appeal to the same email with “Privacy appeal” in the subject line.

For records controlled by one of our business customers, contact that business. We will direct or support the request as appropriate. You may complain to the relevant privacy regulator, including your local supervisory authority where GDPR applies. Cookie and browser-storage choices are described in the Cookie Policy. Optional marketing messages will include an opt-out method; essential service notices may still be sent.

Maurie account holders and authorized users must be 18 or older. The Services are intended for business use, not for children to create accounts. Customer-facing AI deployments must follow the active provider’s age and geographic restrictions; customers must not direct those AI features to minors or deploy them where provider terms prohibit access.

Businesses deploying tools are responsible for their audience, notices, and any applicable permissions. They must not knowingly collect information from children in violation of law or provider restrictions. If you call a business that uses the AI Phone Receptionist, that business decides how your call is answered, whether it is recorded, and how its records are used. Contact that business with questions or requests about your call. If you believe prohibited child information has been provided, contact service@maurieai.com so we can investigate and act appropriately.

We will date policy changes and provide notice of material changes where required. We will obtain additional consent when required rather than treating an updated notice as automatic consent. The date shown above identifies the current version.

Maurie AI LLC
5791 Pigeon Creek Rd.
Bettendorf, IA 52722, United States
service@maurieai.com
Website: https://www.maurieai.com