The short version
- Calls the assistant answers are recorded and transcribed — and every caller is told so, up front, in the greeting. That sentence cannot be turned off.
- Your business data (contacts, bookings, leads, call history, messages) belongs to your business. We process it to run your front desk; we don't sell it, rent it, or use it to advertise.
- We never train AI models on your data, and the AI providers we use are contractually barred from doing so.
- Texting is strictly consent-based: STOP always works instantly, and an opt-out is kept permanently — even if you leave.
- Call recordings are deleted 90 days after the call. Deleting your account deletes everything else immediately, except three records we explain below.
- You can export everything, any time, from Settings → Workspace → Your data.
Who is responsible for what
If you call or text a business that uses Conduit, that business is responsible for your data — it decides what to collect and why — and Conduit (Brainsmithy LLC) is its service provider: we answer, record and transcribe the call, send and receive the texts, and store the results, only on that business's instructions and only to serve it. We don't use your call for any purpose of our own. To exercise a right over that data, contact the business first; we'll help it respond.
If you run a business on Conduit, we are the controller of your account data (your name, email, sign-in) and your business's processor for everything your assistant handles. The Terms contain our processor commitments.
What we collect
- Account data — your name, email, and sign-in credentials (passwords are hashed; we can't read them). If you sign in with Google or Apple, see the Google section below.
- Business data you enter — services, hours, policies, contacts, the questions you want your assistant to ask.
- Communications — recordings, transcripts and metadata of calls the assistant answers; text conversations on your business number; voicemails.
- Customer records — names, phone numbers, addresses and booking history of your customers, as captured on calls and texts or entered by you. Your business controls this data; we process it on its behalf.
- Usage and billing records — the minutes and texts your assistant used, and the audit trail of actions taken in your account.
- Product and site usage — which pages are visited on our website and in the app, measured mostly with our own cookie-free counter (see Cookies & analytics).
Call recording & AI disclosure
Every call the assistant answers begins with “This call is recorded, and I'm {name}, {business}'s AI assistant.” The sentence is added by the platform to every greeting, including custom ones, and cannot be removed. It is the notice that all-party recording-consent states require, and the disclosure that the AI-transparency laws we track ask for; the business you call remains responsible for its own compliance, and we don't give legal advice. Voice audio is used only to run the call and produce the transcript. We do no voice biometrics or speaker identification of any kind, and neither do our providers on our traffic: returning callers are recognized by their phone number, never by their voice. If you ask the assistant whether it is a person, it tells you it is not.
Google sign-in & Google Calendar
Conduit uses Google in two separate, entirely optional ways. Its use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
1. Sign in with Google (optional)
If you choose to create your account or sign in with Google, we receive your basic Google profile — your name, email address, and profile picture — using only the standard openid, email, and profile scopes. We use it solely to create and secure your Conduit account: to identify you, sign you in, and contact you about your account. We never request your Gmail, contacts, Drive, or files. You can skip Google entirely and use an email and password instead.
2. Connect Google Calendar (optional)
If you connect a Google Calendar so your assistant can schedule around your real availability, Conduit requests a single, narrow permission — https://www.googleapis.com/auth/calendar.events — and nothing else. We use it for exactly two things: reading your existing events so the assistant knows when you're busy, and creating, updating, or cancelling the appointments your assistant books on the connected calendar.
Limited Use of Google user data
Conduit's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. For all Google user data — your sign-in profile and any connected calendar data:
- We use it only to provide and improve the user-facing features described above (signing you in and running your assistant's scheduling). We do not use it for any other purpose.
- We do not use Google user data for advertising, and we do not sell it.
- We do not transfer Google user data to others except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger or acquisition in which the successor honors this policy, and then only with your prior explicit consent.
- We do not let humans read your Google user data, unless you give explicit consent (for example, for support you request), it is necessary for security such as investigating abuse, it is aggregated or anonymized for internal operations, or we are required to by law.
- We do not use Google user data to develop, improve, or train generalized or non-personalized AI and/or ML models.
The product-analytics and product-improvement uses described elsewhere in this policy do not apply to Google user data — it is used solely as stated in this section. Google user data is never sent to PostHog, Google Analytics, or any other analytics tool.
AI and your Google data
Conduit is an AI assistant, so what the AI does and does not see matters. The content of your Google Calendar — event titles, descriptions, guests, locations, and notes — is never sent to any AI model or AI provider. Your assistant works only from anonymous busy-and-free time windows (start and end times) computed on our own servers. Event titles are stored solely to draw your own schedule page inside Conduit, and are never spoken by the assistant, never included in a prompt, and never transmitted to a third party.
The AI providers Conduit uses are third-party APIs — we do not host our own models. Our language-model routing is configured account-wide for zero data retention, with every endpoint that retains or trains on inputs disabled, so nothing we send can be retained or used to develop or improve generalized or foundational AI/ML models. Conduit's use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
You can disconnect Google Calendar, or revoke Google sign-in, at any time — from Settings, or directly at your Google Account permissions page. On disconnect we stop syncing and delete the stored Google refresh token; calendar events we previously created remain on your calendar unless you delete them.
Cookies & analytics
- Essential cookies. A small number of strictly necessary cookies keep you signed in and protect the app (session, CSRF, rate limiting). They can't be switched off without breaking sign-in.
- Our own visit counter. On our website, help center, setup and app pages, your browser sends us the page path, the referring page and any UTM tags. We store those with a visitor identifier that is a one-way hash keyed by a salt that changes every day — so the same person is one visitor for one day and a stranger tomorrow — and we drop anything that looks like a crawler. It sets no cookie and stores nothing that identifies you.
- Third-party analytics. Where enabled, PostHog (product analytics inside the app) and Google Analytics 4 (aggregate website traffic) may set cookies or local-storage entries to recognize a return visit. Both are limited to product and site usage. We don't build advertising profiles, run ad-network or remarketing tags, or sell your data, and analytics is never tied to a caller's phone identity or to the content of calls and texts. Google user data is excluded entirely — nothing from Google sign-in or a connected calendar is ever sent to any analytics tool.
- Relaunch funnel. We record the steps a business takes from signup to going live (for example “plan viewed”, “went live”) in a platform-wide table that carries no business or customer identity beyond the same daily-rotating hash, so we can see where setup is hard.
Where your data goes
We use a small set of infrastructure providers — hosting, database, telephony and texting, voice AI and speech-to-text, language-model processing, recording storage, payments, transactional email, the calendar and sign-in services you choose to connect, analytics and error monitoring — to run the service. The categories are on our subprocessors page; the specific named list, with what each does and sees, is available on request and attached to our Data Processing Agreement. Our language-model providers are configured for zero data retention and are contractually barred from training on anything we send. Data lives in US data centers, encrypted in transit and at rest. Every business's data is isolated with database-enforced row-level security — isolation is a property of the database, not of our application code being bug-free. We email account owners before adding or replacing a subprocessor.
Retention & deletion
- Call recordings: deleted from our storage 90 days after the call. Our voice provider's copy is deleted on the same schedule, and database backups expire within our hosting provider's restore window after that. Transcripts and summaries are kept while your account is active.
- Transcripts, messages, contacts, bookings, leads and business records: kept while your account is active.
- Text opt-outs: kept permanently — so a customer who said STOP is never texted by your business through Conduit again, even after you leave.
- Audit trail: a record of who did what in your account, kept for security and dispute purposes.
When you delete your account, export first if you want a copy. Deletion is immediate: your sign-in, your businesses, their assistants, phone numbers and texting registrations, and every call record, recording, transcript, message, contact, booking and lead are deleted, and any paid subscription is cancelled on the spot. There is no undo and no grace period. Three things are kept by design: the text opt-out list (so a STOP stays honored); the security and audit trail of account actions (who did what, when — no call content); and anonymous activity records — the assistant's log of what it did and when, no longer linked to any sign-in, business or contact. Billing records stay with our payment processor for accounting. If your business has other team members, transfer ownership first — we'll block the deletion and say so.
Your rights & choices
Everyone
Email support@conduitapp.ai to access, correct, export or delete your data, or use Settings → Workspace → Your data to download it yourself. If you're a customer of a business that uses Conduit, contact that business first — it controls the records — and we'll help it honor your request.
California (CCPA / CPRA)
You have the right to know what personal information we hold, to access, correct and delete it, and to opt out of its “sale” or “sharing.” We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of; you can still exercise every other right and we will never discriminate against you for doing so. For data your business holds about its customers, your business is the “business” under the CCPA and Conduit is its service provider.
Other US states
Residents of states with consumer-privacy laws have equivalent rights of access, correction, deletion and portability; email us and we'll honor them.
EU / UK (GDPR)
For the account data you give us, Conduit is the controller; for the customer records your business enters, Conduit is a processor acting on that business's instructions. We rely on these lawful bases: performing our contract with you (running your account), our legitimate interests (securing and improving the service), and consent where required (such as optional analytics). You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your local supervisory authority.
Children's privacy
Conduit is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child's information reached us, email support@conduitapp.ai and we'll delete it.
International processing
We operate in the United States and store data in US data centers. If you use Conduit from outside the US, your data is processed in the US. Where required for transfers of personal data out of the EU/UK, we rely on appropriate safeguards such as the Standard Contractual Clauses; a Data Processing Agreement incorporating them is available on request at support@conduitapp.ai.
Security & breach notice
We protect your data with encryption in transit and at rest, database-enforced tenant isolation (row-level security), hashed passwords, versioned encryption of the tokens we hold on your behalf, and least-privilege access. No system is perfectly secure. If a breach ever affects your data, we'll notify affected account owners — and any regulators the law requires — without unnecessary delay.
Changes to this policy
When this policy changes in a way that matters, we email account owners the same day we post it and show the new effective date at the top; a change that reduces your protections takes effect 30 days after that email. If we ever want to use Google user data for anything beyond what the Google section allows, we would update this policy and ask for your consent first.
Contact us
Conduit is operated by Brainsmithy LLC (Colorado, USA). Questions, requests, or a Data Processing Agreement: support@conduitapp.ai. Our mailing address is available on request.