Last updated: June 2026
AI Business Flow LLC ("Company," "we," "us," or "our") provides AI-powered lead conversion technology services to licensed real estate professionals and general contractors. This Privacy Policy explains how we collect, use, disclose, and protect information in connection with our services, including the Sofia AI Lead Conversion System.
This policy applies to visitors to AIBusinessFlow.net, professionals who engage AI Business Flow LLC as a service provider ("Clients"), and consumers whose information is processed through our AI systems on behalf of our Clients ("End Users").
AI Business Flow LLC acts as a service provider to its Clients under California law. Our Clients are responsible for their own data practices with their customers. We process End User data only as directed by and on behalf of our Clients.
Website visitors: IP address and general location, browser type and operating system, pages visited, and referring site. Used to analyze and improve our website. Never sold.
Clients: name, business, license number, contact information, payment information (processed by Stripe — we never store card or bank numbers directly), and the business information needed to configure your AI system.
End Users (on behalf of Clients): name, phone number, email, property or service interests shared during calls, call recordings and transcripts (required for compliance), SMS messages, lead scoring, and calendar bookings. This data belongs to our Clients — we do not use it for our own marketing or sell it.
All calls handled by our AI systems are recorded. Every call begins with the disclosure that the call is recorded for quality purposes, satisfying California Penal Code Section 632.
Our AI assistants are not human and identify themselves as AI at the start of every call, satisfying California SB 942. Recordings and transcripts are retained for a minimum of 24 months.
We send SMS messages on behalf of Clients only to End Users who provided explicit verbal consent during a call. End Users may opt out at any time by replying STOP. We comply with the Telephone Consumer Protection Act (TCPA).
We use information to provide and improve our AI systems, configure them for each Client's business, deliver call summaries and lead data to Clients, process payments, and comply with applicable law including SB 942, CCPA, TCPA, and Penal Code 632.
We do not sell personal information, use End User data for advertising, share data across Clients, or use call data to train AI models without consent.
We share information with the Client on whose behalf it was collected, and with service providers who help us deliver our services, limited to the following categories and only as necessary to provide their service: voice AI and telephony platforms (to operate our AI voice/SMS agents), voice synthesis providers, email and communications delivery providers (to send order confirmations, notifications, and account correspondence), workflow automation and integration tools (to connect scheduling, CRM, and calendar systems), payment processors (to process payments — we never store card or bank account numbers directly), scheduling and calendar platforms, and cloud hosting, storage, and productivity infrastructure. As our service providers change within these categories — for example, switching or adding a vendor in one of these categories — this policy's category-level description continues to apply without requiring an update for each individual change, provided the new provider processes data solely for the purposes described here.
We may also disclose information if required by law or to protect the rights, property, or safety of AI Business Flow LLC, our Clients, or others.
California residents have the right to know what personal data we've collected, the right to request deletion (subject to legal retention requirements), and the right to non-discrimination for exercising these rights. We do not sell personal information, so the right to opt out of sale does not apply.
To exercise your rights, email operations@aibusinessflow.net with the subject line "CCPA Privacy Request." We acknowledge requests within 10 business days and complete them within 45 calendar days.
We use encrypted credential storage, role-based access controls, and rely on our providers' security certifications — including Retell AI's SOC 2 compliant infrastructure and Stripe's PCI-DSS compliant payment processing. No method of transmission or storage is 100% secure, but we are committed to promptly notifying affected parties in the event of a breach as required by law.
Upon Client contract termination, End User data is deleted or returned to the Client within 30 days, unless longer retention is required by law.
Our services are not directed to children under 13, and we do not knowingly collect information from them.
We may update this policy periodically. Material changes will be communicated to active Clients by email at least 30 days before taking effect.