Privacy Policy

Introduction

This website is operated by Taskflowify, LLC ("Assist Staff," "we," "us," or "Company"). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services ("Services").

By using our Services, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this privacy policy, please do not access our Services.

Your Privacy Rights

Assist Staff is operated by Taskflowify, LLC, a Texas limited liability company. As a Texas-based business, we comply with the Texas Data Privacy and Security Act (TDPSA) and provide all users with the privacy protections required under Texas law.

Texas Data Privacy and Security Act (TDPSA): All users are afforded rights under the TDPSA, including the right to access, correct, delete, and port your data, and to opt out of targeted advertising or data sales. See full Texas Privacy Rights

California Residents (CCPA/CPRA): If you are a California resident, you have additional rights under California law. See California Privacy Rights

Do Not Sell My Personal Information: We do not sell your personal information. You may exercise your opt-out rights under the TDPSA or CCPA at any time. Learn more

SMS / Text Messages: We send SMS for account security (MFA) and service notifications, and we deliver tenant-initiated SMS on tenants' behalf. No mobile information is shared with third parties or affiliates for marketing. Reply STOP to opt out. See SMS / Text Message Communications

What Information Do We Collect?

1. Personal Information

We collect personal information that you provide directly:

• Account Information: Name, email address, password, phone number
• Profile Information: Organization name, job title, preferences
• Billing Information: Billing address, payment method (processed via Stripe)
• Communications: Messages, feedback, support requests
• Voice & Call Data: Call transcripts, voicemail messages left for a callback, caller phone numbers, voice agent interaction logs, and call recordings for accounts that turn recording on. Calls to a tenant's number are answered by an AI voice agent, and call audio is processed in real time to produce the transcript. Call recording is off unless the account owner turns it on. When it is on, only calls that match the owner's recording rules are recorded: contacts the owner sets to always be recorded, contacts with tags the owner picks, callers who are not in the account's contacts, or calls where the caller says a phrase the owner picks. A recording started by a phrase begins at that point in the call, not at the start. Contacts the owner sets to never be recorded are not recorded. Recordings are stored as audio files in cloud storage, and only people on the account who have permission can play them. We never use call recordings to train AI models. The account owner is responsible for giving callers notice and getting any consent their location's law requires, and can turn on a built-in notice that the call may be recorded.
• SMS / Text Message Data: Mobile phone numbers, message content, delivery status, opt-in/opt-out state, and message metadata for SMS sent or received through the Services

2. Usage Data (Automatically Collected)

• IP address, which we keep in security, sign-in, and audit logs
• Browser type, version, and device information
• Pages requested and referring URLs, as recorded in our server logs

3. Cookies and Tracking Technologies

We use a small number of cookies needed to sign you in, keep your account secure, and remember your display preferences. We do not use analytics, advertising, or cross-site tracking cookies. See Cookies

Essential Service Providers

We only share your information with service providers that are essential to operating our Services. We do not share, sell, rent, or trade your information for marketing or advertising purposes.

Categories of essential service providers:

• Payment Processing: Stripe, to process payments and manage billing
• Phone Calls and Text Messages: SignalWire, to connect calls and deliver texts
• AI Language Model Providers: Receive call transcripts and conversation context to generate the voice agent's replies, call summaries, and back-office automation
• AI Speech Providers: Receive call audio to convert speech to text, and reply text to produce the agent's voice, in real time
• Integrations You Connect: Google, for Google sign-in and the Calendar, Gmail, or Drive features you choose to connect; Google also delivers some of our emails
• Infrastructure: Contabo (servers and backups in the United States) and Cloudflare (network protection, DNS, email routing, and encrypted off-site backup storage, and call recording storage for accounts that turn recording on)

Important: Each provider receives only the data it needs to perform its service for us and handles it under its business or API terms. We do not permit providers to sell your data or use it for marketing.

Google User Data

Connecting a Google account is optional. If you choose to connect one, Assist Staff asks Google for only the access listed below and uses it only to provide the features you turn on in your own account. Google data is never used for advertising, never sold, and never shared with third parties except as needed to deliver the feature you requested.

• Email address and basic profile: to sign you in with Google and show which account is connected.
• Google Calendar: so the voice agent can check availability and book, move, or cancel appointments on the calendar you select during phone calls, and so you can see those appointments in your dashboard.
• Gmail: so you can read, search, draft, send, label, and delete messages in your own mailbox from the Assist Staff dashboard, and so the voice agent can send confirmations and call summaries from your address when you ask it to.
• Google Drive: so you can browse, open, upload, and save call summaries and documents in your own Drive from the dashboard.

Access tokens are stored encrypted in our database and are scoped to your tenant. We do not transfer Google data to AI models for training, and no human at Assist Staff reads your Google data except with your permission for support, when required by law, or when aggregated and anonymized for security and abuse prevention.

Disconnecting and deleting: You can disconnect Google at any time from Settings > Google > Disconnect. Disconnecting deletes the stored access and refresh tokens immediately. You can also revoke Assist Staff's access from your Google Account permissions page. Appointment records already saved in Assist Staff remain in your account until you delete them or your account is closed.

Assist Staff's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

SMS / Text Message Communications

Assist Staff uses text messaging in a narrow, transactional way: to protect your account and to send short reminders and follow-ups tied to a call your tenant's voice agent has already had with the recipient. We do not run bulk marketing or promotional text campaigns. Texts are delivered by our messaging provider, SignalWire, over A2P 10DLC business numbers registered with The Campaign Registry as a conversational / low-volume use case.

Types of Texts We May Send

• Account security (MFA): One-time verification codes when you sign in, if you have turned on SMS multi-factor authentication.
• Service notifications: Important account, billing, and provisioning alerts to tenants.
• Reminders and follow-ups: Short messages tied to an interaction the recipient has already had with the tenant, such as an appointment reminder, a callback confirmation after a missed call, or a brief post-call follow-up. These go only to recipients who gave the tenant their mobile number for that purpose.

We do not use text messaging for bulk marketing, promotional blasts, prospecting to numbers the recipient did not provide directly, lead-list outreach, or any SHAFT-DC content (sex, hate, alcohol, firearms, tobacco, drugs, cannabis).

Message Frequency, Carrier Charges, and Help

• How often: MFA texts arrive only when you sign in. Service notifications are rare. Reminder / follow-up texts depend on the tenant's interaction with the recipient.
• Carrier charges: Standard message and data rates from your wireless carrier may apply. We do not charge you to receive texts.
• Reply HELP to any message for support, or email [email protected].
• Reply STOP (or UNSUBSCRIBE, CANCEL, END, QUIT) to opt out. You may receive one confirmation message, and then you will get no further texts from that business until you opt back in. STOP does not affect email or in-app notifications. To turn off SMS-based MFA, change it in your account security settings.

Mobile Information and Consent Sharing

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing is limited to subcontractors that support the SMS service itself (for example, our SMS delivery provider, fraud-prevention tooling, and consent-management tooling), and only to the extent necessary to operate the Services. All such subcontractors are contractually prohibited from using mobile opt-in data, phone numbers, or message content for their own marketing or for resale.

Who is the Sender? Tenant Responsibilities

When a tenant uses the Services to send a reminder or follow-up text to their own customer:

• The tenant is the sender and is responsible for the recipient's mobile number and the message content.
• Assist Staff acts as a service provider that delivers the message on the tenant's behalf.
• The tenant must have received the recipient's number directly from the recipient for the purpose of receiving reminders or follow-ups, and the message must stay transactional. Sending marketing or promotional texts through the Services is not permitted.
• Assist Staff treats STOP replies on registered 10DLC numbers as an opt-out from all texts sent by that tenant through the Services.

SMS Data Retention

Message content, delivery metadata, and opt-in/opt-out state are retained as described in "Data Retention Periods" below. Opt-out records are kept for as long as the tenant's account is active so that the opt-out continues to be honored.

How We Use Your Information

• Provide, operate, and maintain our Services
• Process transactions and send related information
• Manage your account and provide customer support
• Send administrative information, updates, and security alerts
• Personalize and improve user experience
• Monitor the Services for reliability, abuse, and security
• Detect, prevent, and address technical issues and fraud
• Comply with legal obligations
• Enforce our Terms of Service

Data Retention Periods

We keep your information while your account is active and as needed to provide the Services. When an account is closed, we delete its data on request or when we remove the account.

• Account Data: While your account is active, until the account is removed
• Transaction Records: Up to 7 years, for tax and legal requirements
• Call Transcripts, Voicemails & Contacts: While your account is active, unless you delete them sooner. Items you delete in the dashboard are hidden immediately and permanently erased when the account is removed
• Call Recordings: Only for accounts that turn recording on. Kept while your account is active, unless you delete them sooner. Deleting a call in the dashboard hides its recording immediately, and all of an account's recordings are permanently erased when the account is removed
• SMS Messages & Delivery Metadata: While your account is active; opt-out records for as long as the tenant's account is active
• Server and Security Logs: As long as needed for security, troubleshooting, and abuse prevention
• Service Desk: Please don't put sensitive information (such as passwords or card numbers) in Service Desk tickets. We keep tickets as a service history, including after an account is closed. If you ask, we will send you a copy of your tickets and then delete them
• Backups: We make a nightly encrypted backup of our database, store a copy off-site, and keep each backup for 30 days. Before we remove a tenant account, we make a backup of that account's data, which we keep until we delete it
• Legal Holds: For as long as the law requires

How We Share Your Information

Our Commitment: We do NOT sell, rent, or trade your personal information. We only share data with essential service providers and as required by law.

We may share your information only in these limited situations:

• Essential Service Providers: Only the providers listed under "Essential Service Providers" above, for the services they perform for us.
• Business Transfers: In connection with a merger, sale, or acquisition (you will be notified)
• Legal Requirements: When required by law, court order, or to protect rights, property, or safety
• With Your Explicit Consent: When you specifically authorize us to share information

We do NOT share your information for: Marketing purposes, advertising, data brokers, or any non-essential purposes.

Cookies and Tracking Technologies

Types of Cookies We Use

• Essential Cookies: Keep you signed in, protect sign-in forms from forgery, and remember a device you chose to trust for multi-factor authentication. These are required for the Services to work.
• Preference Cookies: Remember your display theme and light/dark mode.

We do not use analytics, performance-tracking, advertising, or cross-site tracking cookies, and we do not use web beacons.

Managing Cookies

You can block or delete cookies in your browser settings. If you block essential cookies, you will not be able to sign in.

Texas Privacy Rights (TDPSA)

Taskflowify, LLC is incorporated and operates in the State of Texas. We comply with the Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024 (Tex. Bus. & Com. Code Ch. 541). The TDPSA provides the following consumer rights:

• Right to Access: Confirm whether we are processing your personal data and access that data
• Right to Correct: Correct inaccuracies in your personal data
• Right to Delete: Delete personal data you have provided or we have obtained
• Right to Portability: Obtain a copy of your data in a portable, readily usable format
• Right to Opt-Out: Opt out of the processing of your data for targeted advertising, sale of personal data, or profiling that produces legal or similarly significant effects

How to Exercise Your Rights

To submit a verifiable consumer request, contact us at [email protected]. Per TDPSA requirements, we will acknowledge your request within 10 business days and respond substantively within 45 days. If we need additional time, we will notify you of a one-time 45-day extension. If we deny your request, you may appeal by replying to our response, and we will respond to the appeal within 60 days.

Sensitive Data

We do not ask for sensitive personal data (including racial/ethnic origin, religious beliefs, health diagnosis, sexual orientation, citizenship/immigration status, genetic or biometric data, children's data, or precise geolocation). Callers may choose to share such information during a call; when they do, we process it only to provide the Services to the tenant they called. For our own account holders, we do not process sensitive personal data without affirmative consent.

Data Protection Assessments

We do not engage in targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects. If we begin any processing that the TDPSA says requires a data protection assessment, we will conduct and document one first.

Texas Attorney General

If you are not satisfied with our response to your request or appeal, you may file a complaint with the Texas Attorney General at texasattorneygeneral.gov.

Do Not Sell My Personal Information

We do NOT sell, rent, or trade your personal information. Period. This applies under both the Texas Data Privacy and Security Act (TDPSA) and the California Consumer Privacy Act (CCPA/CPRA).

We only share your information with essential service providers (payment processors, cloud hosting, intelligent services) necessary to provide our Services. These providers:

• Receive only the data needed for the service they perform for us
• Handle it under their business or API terms
• Are not permitted by us to sell it or use it for marketing

To exercise your opt-out rights under the TDPSA or CCPA, contact: [email protected]

Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to Know: Request disclosure of personal information collected, used, and shared
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt out of the sale or sharing of personal information
• Right to Non-Discrimination: Not be discriminated against for exercising your rights
• Right to Correct: Request correction of inaccurate information
• Right to Limit Use: Limit use and disclosure of sensitive personal information

To exercise these rights, contact us at [email protected]. We will respond within 45 days as required by the CCPA.

Data Security

We use reasonable security measures, including:

• TLS encryption for traffic between your browser or app and our website. Phone calls travel over the public telephone network and our phone carrier connection, which are not end-to-end encrypted
• Passwords stored only as one-way hashes; MFA secrets and connected-provider credentials encrypted with AES-256
• Nightly encrypted database backups
• Multi-factor authentication with an authenticator app or text message codes, available to every user
• Role-based access controls that keep each tenant's data separate
• Server administration limited to key-based access, and automated nightly security scanning

However, no method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Data Breach Notification

If a data breach affects your personal information, we will notify you by email without unreasonable delay, and within the time required by law (under Texas law, no later than 60 days after we determine the breach occurred). We will also notify the Texas Attorney General when Texas law requires it. Our notice will describe what happened, what information was involved, and steps you can take to protect yourself.

Children's Privacy

Our Services are not intended for individuals under 16 years of age. We do not knowingly collect personal information from children under 16. If we learn we have collected such information, we will delete it promptly. If you believe we have collected information from a child under 16, please contact us.

Your Choices and Controls

• Account Settings: Update your profile and preferences anytime
• Email: We send only account, security, billing, and service emails. We do not send marketing emails
• Cookies: Manage cookies in your browser settings
• Data Access/Deletion: Request your data or account deletion via email
• Do Not Track and Global Privacy Control: We do not track you across websites, run targeted advertising, or sell personal data, so these browser signals do not change how we handle your data

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the new policy on this page with an updated "Last Updated" date. For material changes, we may also notify you by email or by a notice in the Services.

Your continued use of our Services after changes constitutes acceptance of the updated policy.