privacy policy

1. about this policy

this privacy policy explains how msp ar llc, which operates donna ("donna," "we," "us," "our"), collects, uses, shares, and protects personal information. donna is a bilingual (english + spanish) ai phone receptionist for small businesses. this policy covers our website, the signup flow, the customer dashboard, and the ai phone + text service. by using donna you agree to this policy and to our terms of use.

two kinds of people appear here: (a) the business owner who signs up for and uses donna ("you," the "customer"), and (b) the callers and customers of that business whose information flows through the service ("end users"). for end users' personal information, the business customer is the controller and we act on their behalf — see section 11.

2. information we collect

account & business info: your name, email, phone, business name, industry, service areas/city, services and prices, hours, transfer number, and the settings and instructions you give your ai.

call & message content: when your ai line is used, we collect and store call audio recordings, transcripts, voicemails, text messages, caller phone numbers, caller names, service addresses, appointment details, and the lead and booking records the ai generates.

payment info: when you subscribe, payment is processed by stripe. we receive limited billing details (such as status, card brand/last 4, and subscription id) but we do not collect or store full card numbers.

integration data: if you connect a calendar or crm, we store the access/refresh tokens needed to read and write your bookings (for example google, microsoft 365/outlook, or housecall pro).

technical & usage data: logs, ip address, device and browser type, the pages and actions you take, and timestamps, plus a sign-in (session) cookie to keep you logged in.

3. how we collect it

directly from you (signup, the dashboard, and uploads such as a menu photo or a website link you give us to read); automatically (calls, texts, and your use of the service); and from third parties (your callers, and the integrations you choose to connect).

4. how we use information

to operate and provide the service — answer calls, understand callers, capture leads, book and reschedule, and send confirmations and your price list; to create your account and ai assistant; to provide support; to bill and manage your subscription; to secure the service and prevent fraud and abuse; to maintain, improve, and develop the service; to comply with the law; and to contact you about your account.

5. ai processing

to answer calls and texts, the content is processed by third-party ai providers — speech-to-text, large language models, and text-to-speech — to understand callers and generate responses. this happens automatically, and the ai can make mistakes, mishear, or be unavailable.

6. how we share information (service providers)

we share personal information with the vendors that make the service work, only as needed to run it: telephony & sms (twilio); voice-ai orchestration (vapi); ai language and vision (openai); text-to-speech and speech recognition (elevenlabs and other speech providers); calendars and maps (google); microsoft 365 / outlook; payments (stripe); hosting, database, authentication, and storage (google firebase / google cloud, railway, vercel); transactional email (resend); and owner notifications (callmebot / whatsapp).

each provider processes information under its own terms and privacy practices. we may also share information when required by law, to protect rights, safety, or our service, or as part of a business transfer (such as a merger or sale). we do not sell your personal information.

text messaging (sms): we do not sell or share your or your callers' mobile phone numbers, or any sms opt-in or consent information, with third parties or affiliates for their own marketing or promotional purposes. sms is used only to run the service — appointment confirmations to callers and booking alerts to the business owner, typically one to three messages per appointment. message frequency varies. message and data rates may apply. reply help for help or stop to opt out at any time.

7. call recording & consent

to provide the service we record and transcribe calls and store messages. as the business customer, you are responsible for giving any notice and obtaining any consent your callers require under the laws that apply to you — some states and countries require all parties to consent to recording. see the terms of use.

8. cookies

we use a strictly-necessary, http-only session cookie to keep you signed in to the dashboard, and the minimum cookies needed to run the site. we keep tracking to a minimum.

9. data retention

we keep personal information while your account is active and as needed to provide the service. if you cancel or delete your account, we may keep an archived copy of your business data and records for our legitimate purposes — backups, security, fraud prevention, legal compliance, and so we can restore your account if you return — and it may persist after your live account is removed. we keep information as long as needed for these purposes or as the law requires.

10. your choices & rights

you can view and update most of your information in the dashboard. you may request access to, correction of, or deletion of your personal information by emailing support@msparllc.com (subject to our retention needs and legal obligations).

depending on where you live, you may have additional rights — such as to access, correct, delete, or limit certain processing of your personal information, or to not be discriminated against for exercising them. contact us and we will respond as the law requires. we do not sell personal information.

11. end users' information & your responsibilities

much of the information in donna belongs to your callers and customers. for that information, you (the business) are the controller and we act as your processor — we handle it to provide the service on your behalf and under your instructions. you are responsible for the privacy notices, consents, and choices the law requires for your callers, and for handling their privacy requests; we will help you as reasonably needed.

12. security

we protect information with measures such as encryption in transit, access controls, and keeping secrets server-side. no method of transmission or storage is completely secure, so we cannot guarantee absolute security.

13. where data is processed

we and our providers are based in, or process data in, the united states. by using the service you understand that your information may be processed in the u.s. and in other countries where our providers operate.

14. children

donna is a business tool that is not directed to children. it is intended for users 18 and older, and we do not knowingly collect personal information from children under 13.

15. changes to this policy

we may update this policy from time to time. if we make material changes we will take reasonable steps to let you know, and we will update the "last updated" date above. continuing to use the service after that means you accept the updated policy.

16. contact

questions or requests about privacy: msp ar llc · donna · support@msparllc.com · 786-833-4076.