Plain English about your data.

1. Who we are

NeuralFlow AI LLC is a New Jersey limited liability company based in Bayonne, NJ. We build AI receptionists, agents, automations, websites and search presence for businesses of every kind. For this website and our own ARIA, we are the data controller. For receptionists we build and run for client businesses, the client is the controller and we process data on their instructions (see section 7).

2. What we collect

Information you give us

• Chatting with ARIA. The messages you type, and anything you include in them, such as your name, email address, phone number, company and what you need. ARIA asks for a name and email so a confirmation can be sent.
• Booking a demo or sending a form. Name, email, phone (where asked), company and the description you write.
• ROI calculator. The numbers you enter are calculated in your browser and are not sent to us unless you submit the "email me this estimate" form, in which case we receive your name, email, phone, industry and the estimate.
• Email. Anything you send to [email protected].

Information collected automatically

• Analytics. We use Google Analytics 4 to understand how the site is used: pages viewed, approximate location, device and browser type, and events such as opening ARIA or clicking "Book a call". Google sets cookies for this. IP addresses are truncated by Google. If your browser sends a Global Privacy Control signal, we do not load analytics at all.
• Server logs and security. Our hosting and edge providers log requests (IP address, user agent, timestamps) to run the service and prevent abuse. We rate-limit by IP address.
• Preferences. Your light/dark theme choice and an in-progress chat are kept in your browser's local storage so they survive a reload. They never leave your device.

3. How we use it

• To answer you, book the demo you asked for, send confirmations and a reminder, and follow up if a chat was left unfinished.
• To run ARIA: your messages are sent to our AI provider to generate a reply (section 5). ARIA's memory of a conversation is held for about 30 minutes and then discarded; details you gave us (name, email, phone, what you asked) are kept as a lead so we can follow up.
• To improve the site and the receptionist, including reviewing conversations for quality.
• To keep the service secure and to comply with the law.

We do not sell your personal information, and we do not use it for advertising networks. We will not send you marketing email unless you asked for it, and every marketing email will have an unsubscribe link.

4. Legal bases (where they apply)

If you are somewhere that requires a legal basis for processing: we process to perform the service you requested (bookings, replies), for our legitimate interests in running and improving the site and in security, and with your consent where we ask for it (for example, analytics cookies where consent is required).

5. Who processes data for us

We use a small number of providers, each bound by their own terms and privacy commitments:

• Anthropic (AI model that powers ARIA's replies; OpenRouter as a fallback). Messages are sent to generate a response. We do not use them to train models.
• Google (Google Calendar for availability and bookings; Google Analytics; Google Workspace for email).
• Resend (sends confirmation, reminder and alert emails).
• Twilio (text confirmations and reminders, only when enabled and only to a number you gave us for that booking).
• Railway (hosting) and Cloudflare (network, security and caching).

We may also disclose information if the law requires it, to protect our rights or safety, or as part of a sale or reorganization of the business (we would tell you).

6. How long we keep it

• ARIA conversation memory: about 30 minutes, in memory only.
• Leads and booking records (name, email, phone, company, what you asked, appointment time): up to 24 months, or until you ask us to delete them.
• Emails you send us: as long as needed to deal with the matter, then archived like any business correspondence.
• Analytics: per Google Analytics retention settings (14 months by default).
• Server logs: typically 30 days.

7. Receptionists we build for clients

When you chat with a receptionist on another business's website that is "powered by NeuralFlow AI", that business is responsible for the conversation and for how it uses your details; its own privacy policy applies. We process the conversation on its behalf to generate replies, book appointments on its calendar, send confirmations and reminders, and alert the business. We keep the records needed to do that and to report to the business, and we delete them when the business asks or the engagement ends. We do not use those conversations for any purpose of our own beyond operating and improving the service.

8. Text messages (SMS) and mobile numbers

NeuralFlow sends text messages for our own business (booking confirmations and reminders) and, through NeuralFlow CRM, on behalf of the service businesses that use it (replies to people who contacted that business, appointment confirmations and reminders, and follow-ups on quotes they asked for). Texts go only to people who contacted the business first or who agreed to texts, for example by ticking the unticked box on a booking page ("It is OK to text me about this visit (reminders and changes). Reply STOP any time."). We record when and where that consent was given.

• Mobile numbers and text-messaging consent are never shared, sold or rented to third parties or affiliates for their marketing or promotional purposes. The only parties that see a number are the business you contacted and the providers that deliver the message for it (Twilio and the mobile carriers), solely to deliver it.
• Reply STOP (or STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT) to any text to stop all texts from that number; you get one confirmation and nothing more. Reply START to resubscribe. Reply HELP (or INFO) for help, or email [email protected].
• Message frequency varies with your conversation and appointments. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

9. Business outreach

We sometimes email business owners and managers we have not met, using contact details from public sources such as their own websites and business listings. These are business-to-business messages about services relevant to that business. Every one includes who we are, a physical address and a working way to say no, and we stop promptly when asked and keep a suppression list so you are not contacted again. We do not buy consumer lists and we do not send these to personal addresses on purpose.

10. Where your data lives

Our systems and providers are in the United States. If you use the Site from elsewhere, your information is transferred to and processed in the United States, where privacy laws may differ from those where you live.

11. Sensitive information

ARIA and the receptionists we build are for taking inquiries and booking appointments. Please do not share health details, case details, financial account numbers, government identifiers or other sensitive information in a chat; a person at the business will ask for what they need directly, under that business's own policy. A receptionist is not an emergency service: if something is urgent, call the business or emergency services.

12. Your choices and rights

• Access, correction, deletion. Email [email protected] and we will show you what we hold, fix it, or delete it, usually within 30 days. We will verify it is you first.
• Analytics. You can block Google Analytics with a browser extension or by disabling cookies; the site works without them.
• Texts. Reply STOP to any text from us to stop them.
• Email. Use the unsubscribe link, or reply and say so.
• Do Not Track / Global Privacy Control. We do not sell or share data for cross-context advertising, so there is nothing to opt out of; we honor these signals for analytics where we can.

Residents of California, Virginia, Colorado and other states with privacy laws have the rights those laws give them, including to know, delete and correct; use the email above. Residents of the EU, UK and Switzerland may also lodge a complaint with their supervisory authority.

13. Security

Traffic is encrypted in transit. Access to systems is limited to Danny and the providers above. Credentials are stored as environment variables, never in code or documents. No method is perfect; if we learn of a breach that affects you, we will tell you as the law requires.

14. Children

The site and ARIA are for businesses and adults. We do not knowingly collect information from anyone under 16. If you think we have, email us and we will delete it.

15. Changes

If we change this policy in a way that matters, we will update the date at the top and, where appropriate, tell you by email or a notice on the site.

16. Contact

NeuralFlow AI LLC · Bayonne, New Jersey · [email protected]