`views/public/privacy.ejs`

69 lines
<%- include('../partials/head', { title, meta_desc }) %>
<%- include('../partials/header') %>

<main class="legal-page">
  <section class="section">
    <div class="wrap narrow">
      <p class="muted small"><a href="/">← Home</a></p>
      <h1>Privacy Policy</h1>
      <p class="muted">Last updated: <%= updated %></p>

      <h2>1. The short version</h2>
      <p class="prose">We never call on your behalf without your explicit per-call submission. The account information you submit is encrypted at rest (AES-256-GCM) and only decrypted when you click "Reveal" on the call's own detail page. We do not sell, share, or rent your data. We do not run third-party ad trackers. We do not require an account to use the service.</p>

      <h2>2. What we collect</h2>
      <p class="prose">When you submit a call request, we store the following fields you provide:</p>
      <ul class="prose">
        <li><strong>Call target</strong>: business name, business phone number, the goal of the call, any rep-facing notes.</li>
        <li><strong>Account info you choose to provide</strong>: account number, last 4 digits of SSN, billing ZIP, date of birth, verbal-auth password / security answer. All five are encrypted at rest with AES-256-GCM.</li>
        <li><strong>Callback info</strong>: your name, your phone number, optionally your email and best-time-to-reach window.</li>
        <li><strong>Limits + preferences</strong>: max hold time, max spend, recording consent, notification preferences.</li>
        <li><strong>Server logs</strong>: HTTP request method/path/status, timestamp, IP address (truncated after 7 days). No request body or query-string contents are logged.</li>
      </ul>

      <h2>3. What we don't collect</h2>
      <ul class="prose">
        <li>No third-party analytics, ad pixels, or behavioral trackers.</li>
        <li>No social-media login / OAuth scopes beyond what you explicitly grant.</li>
        <li>No browser fingerprinting.</li>
        <li>No microphone or camera access.</li>
      </ul>

      <h2>4. How we use what we collect</h2>
      <p class="prose">Strictly to fulfill the call you submitted. The business name + phone get dialed. The account info gets read back to the rep only when they ask and only when you've already joined the call. The callback info is how we ring you when an agent picks up. We do not use your data to train AI models, profile you, or send marketing.</p>

      <h2>5. Who can see your data</h2>
      <ul class="prose">
        <li>You, on this device, when you click "Reveal" on a call's detail page.</li>
        <li>Our call-dispatch worker (server-side) at the moment of dial.</li>
        <li>Anyone you authorize via "share" (not yet implemented; will require explicit opt-in).</li>
        <li>Our infrastructure provider (Kamatera) and the call-carrier provider (Twilio) under contractual data-processor agreements. Neither has plaintext access to your encrypted sensitive fields.</li>
        <li><strong>No advertisers, brokers, data resellers, or unaffiliated third parties.</strong></li>
      </ul>

      <h2>6. Retention &amp; deletion</h2>
      <p class="prose">Call submissions are retained for 90 days after the call's status reaches "done" or "failed", then automatically purged. You can request immediate deletion of any call by emailing <a href="mailto:privacy@butlr.ai">privacy@butlr.ai</a> with the call ID; we will purge within 7 days and confirm in writing. Account information is wiped from our records at the same time.</p>

      <h2>7. Call recording</h2>
      <p class="prose">Recording happens only when you check the "I consent to recording the call" box on the submission form. In two-party-consent states (CA, FL, MA, MT, PA, WA, and several others), our call-bridge plays a brief audible "this call may be recorded" disclosure to the rep at the start of the call. You can revoke recording consent at any time before the call connects by emailing the address above with the call ID.</p>

      <h2>8. TCPA + telemarketing law</h2>
      <p class="prose">Butlr is not a telemarketer. We do not initiate calls for commercial solicitation. We dial only the specific business number you submit, for the specific purpose you describe, on your behalf. We do not maintain a calling list, do not auto-dial multiple numbers, and do not contact you for purposes unrelated to the call you submitted.</p>

      <h2>9. Children</h2>
      <p class="prose">Butlr is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has submitted a call, email <a href="mailto:privacy@butlr.ai">privacy@butlr.ai</a> and we will purge the submission within 7 days.</p>

      <h2>10. California residents (CCPA / CPRA)</h2>
      <p class="prose">You have the right to: (a) know what we collect, (b) request deletion, (c) opt out of any sale of your data (we do not sell data), (d) non-discrimination for exercising these rights. Email <a href="mailto:privacy@butlr.ai">privacy@butlr.ai</a> from the address associated with your call submissions; we verify by sending a confirmation link back to the same address.</p>

      <h2>11. Changes to this policy</h2>
      <p class="prose">If we change this policy materially, we will post the new version with a new "Last updated" date and email past submitters at least 14 days before it takes effect.</p>

      <h2>12. Contact</h2>
      <p class="prose">Privacy questions / deletion requests: <a href="mailto:privacy@butlr.ai">privacy@butlr.ai</a>. Operator: Butlr (operating under the parent business listed in the <a href="/terms">Terms</a>).</p>
    </div>
  </section>
</main>

<%- include('../partials/footer') %>