Privacy Policy

Introduction

Bluepenguin Platform provides AI-powered virtual phone assistant services to businesses across multiple industries. This Privacy Policy explains how we collect, use, disclose, and protect information in connection with our services.

By accessing or using our platform, or by placing or receiving a call handled by our AI assistant, you acknowledge that you have read, understood, and agree to the practices described in this Policy. If you do not agree, please discontinue use of our services.

Scope and Applicability

This Policy applies to:

• Our business customers ("Clients") who subscribe to our AI phone assistant platform.
• End users — callers who interact with our AI assistant on behalf of or when contacting a Client.
• Visitors to our websites and users of our mobile or web applications.

Our Clients may operate in regulated industries including, but not limited to, healthcare, legal services, and financial services. Where applicable, additional industry-specific obligations are described in Section 9.

Information We Collect

3.1 Information Collected Automatically During Calls

When a caller interacts with our AI phone assistant, we may collect:

• Call Recordings: Full audio recordings of inbound and/or outbound calls, subject to applicable recording consent laws.
• Transcripts: Automated text transcriptions of call audio generated by our AI systems.
• Caller Identification Data: Caller name (where provided by the caller or supplied by telephony infrastructure such as Caller ID), phone number, and call metadata (date, time, duration, call disposition).
• Appointment and Order Details: Information shared verbally or via keypad input during the call, including scheduling requests, order specifics, account references, or other transactional data.

3.2 Information Provided by Our Clients

Our Clients may upload or sync customer records to our platform to enable personalized call handling. This may include names, phone numbers, email addresses, account numbers, appointment histories, or other records maintained by the Client.

3.3 Technical and Usage Data

We automatically collect technical information when Clients or their administrators access our platform, including IP addresses, browser type, device identifiers, pages visited, feature usage logs, and error reports.

3.4 Information You Provide to Us Directly

Clients and their representatives may provide information directly when registering for our services, contacting support, or completing forms, such as names, business contact details, and billing information.

How We Use Your Information

4.1 Service Delivery

• Operating and delivering AI phone assistant functionality to our Clients.
• Routing calls, generating transcripts, scheduling appointments, and capturing order or inquiry details.
• Providing Clients with access to call recordings and transcripts through our platform.

4.2 AI Training and Improvement

We may use de-identified or aggregated call data to train, test, and improve our AI models and speech recognition systems. We do not use personally identifiable information for AI training without a lawful basis and, where applicable, appropriate safeguards. Clients may opt out of contributing data to model training; please contact us for details.

4.3 Analytics and Reporting

• Generating call volume, performance, and quality analytics for Clients.
• Monitoring system uptime, error rates, and platform reliability.

4.4 Legal and Compliance

• Complying with applicable federal, state, and local laws and regulations.
• Responding to lawful requests from courts, regulators, or law enforcement.
• Enforcing our Terms of Service and other agreements.
• Protecting the rights, property, or safety of the Company, our Clients, callers, or the public.

4.5 Communications

We may use Client contact information to send service notices, security alerts, billing communications, and (where consented) marketing materials about new features or offerings.

Disclosure of Information

5.1 Disclosure to Our Clients

Call recordings, transcripts, caller contact information, and appointment or order details collected on behalf of a Client are made available to that Client through our platform. Clients are independently responsible for their own privacy practices with respect to caller data they receive.

5.2 Service Providers and Subprocessors

We engage trusted third-party vendors to support our operations, including cloud hosting providers, telephony infrastructure partners, payment processors, and analytics providers. These vendors are contractually required to process data only as directed by us and to maintain appropriate security standards.

5.3 Business Transfers

In the event of a merger, acquisition, asset sale, or similar corporate transaction, personal information may be transferred as part of that transaction. We will notify affected parties as required by law.

5.4 Legal Requirements

We may disclose information when we believe in good faith that disclosure is required by law, regulation, subpoena, court order, or governmental authority, or where necessary to protect legal rights or prevent imminent harm.

5.5 No Sale of Personal Information

Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, including to provide services to our Clients, comply with legal obligations, resolve disputes, and enforce our agreements. Our standard retention practices are:

• Call Recordings: Retained for up to 90 days unless a Client configures a shorter or longer retention period within the bounds permitted by applicable law.
• Transcripts: Retained for the same period as the corresponding call recording.
• Caller Contact Information and Transaction Details: Retained for the duration of the Client relationship plus 1 year, or as required by law.
• Client Account Data: Retained for the term of the Client agreement and deleted or returned within 30 days of termination upon request.

Clients operating in regulated industries (e.g., healthcare, legal, financial services) may be subject to specific statutory retention requirements that supersede our standard schedule.

Security

We implement industry-standard administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256).
• Role-based access controls and multi-factor authentication for platform access.
• Regular security assessments, penetration testing, and vulnerability management.
• Employee training on data privacy and security practices.
• Incident response procedures for detecting, investigating, and reporting data security events.

No method of electronic transmission or storage is 100% secure. While we strive to protect personal information, we cannot guarantee absolute security. We encourage Clients to maintain strong access credentials and promptly report any suspected security incidents to us.

Your Rights and Choices

8.1 Rights of Callers (End Users)

If you are a caller who has interacted with one of our Clients' AI phone assistants, the Client is the data controller with respect to your information. Please contact the Client directly to exercise privacy rights related to your call data. We will cooperate with Clients in responding to verified end-user requests.

8.2 Rights of Clients and Their Personnel

Subject to applicable law, you may have the right to:

To exercise any of these rights, contact us using the information in Section 12. We will respond to verified requests within the timeframes required by applicable law.

8.3 Call Recording Opt-Out

Callers who do not wish to have their call recorded may request to speak with a live representative, if the Client has made that option available. Our AI assistant will notify callers of recording at the outset of each call.

Healthcare and Legal / Financial Sector Considerations

9.1 Healthcare Clients — HIPAA

Clients in the healthcare industry may use our platform in connection with Protected Health Information ("PHI") as defined by the Health Insurance Portability and Accountability Act ("HIPAA"). For such Clients, we operate as a Business Associate and enter into a Business Associate Agreement ("BAA") governing our handling of PHI. Our HIPAA-compliant service tier includes:

• Encryption of PHI at rest and in transit.
• Access logging and audit trail capabilities.
• Breach notification procedures consistent with the HIPAA Breach Notification Rule.
• Restrictions on use and disclosure of PHI to those permitted by the BAA and applicable law.

9.2 Legal and Financial Services Clients

Clients in legal, financial advisory, banking, or insurance sectors may be subject to confidentiality, professional privilege, or consumer financial protection requirements (e.g., Gramm-Leach-Bliley Act, state bar rules). We recommend that such Clients:

• Review our Data Processing Agreement and standard contractual terms with counsel.
• Configure recording and transcript access controls appropriate to their obligations.
• Notify callers of AI assistance and recording in compliance with applicable professional rules.

9.3 State Privacy Laws

Residents of certain states may have additional rights under applicable state privacy laws. While our platform is operated in the United States, we recognize that state-level protections may apply, including:

• California: The CCPA, as amended by the CPRA, grants California residents rights to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioral advertising.
• Illinois: BIPA may apply if our services process voiceprints or other biometric identifiers. Clients in Illinois should contact us to understand applicable configurations.
• Other States: We monitor developments in state privacy legislation and update our practices accordingly.

9.4 Telephone Recording Consent Laws

Recording consent requirements vary by state. Some states require all-party consent (e.g., California, Illinois, Florida), while others require only one-party consent. Our platform is configured to announce recording at the start of calls. Clients are responsible for ensuring their call handling practices comply with the laws applicable to their jurisdiction and the jurisdictions of their callers.

Children's Privacy

Our services are not directed to or intended for use by individuals under the age of 13, and we do not knowingly collect personal information from children. If we become aware that we have inadvertently collected information from a child under 13, we will promptly delete it. Parents or guardians who believe a child's information has been collected should contact us using the information in Section 12.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify Clients by email and/or by posting a prominent notice on our platform at least 30 days before the changes take effect. Your continued use of our services after the effective date of the revised Policy constitutes your acceptance of the changes.

We encourage you to review this Policy periodically. The "Last Updated" date at the top of this document indicates when it was most recently revised.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

This document is provided for informational purposes. Bluepenguin Platform recommends that Clients consult with qualified legal counsel to confirm compliance with all laws and regulations applicable to their specific industry, jurisdiction, and business operations.