1. Introduction

SoloBusinessAI is operated by SPD Digital Consulting LLC, a Florida limited liability company based in Wildwood, Florida, United States ("we," "our," or "us"). SoloBusinessAI is an AI tool for small businesses: it builds the business a website, puts an AI receptionist on that website, and creates marketing content. You may reach us about privacy at privacy@solosolutionsai.com. This Privacy Policy explains how we collect, use, and protect information.

This policy applies to all users of the Service, including professionals who create accounts ("Professionals") and their clients who submit information through intake conversations ("Clients").

If you reached this page from a business's website or its AI receptionist: that business uses SoloBusinessAI to run its website and receptionist. The business decides what to ask you and what to do with your answers, and it is responsible for telling you how it uses your information and for any consent it needs. We process what you send on the business's behalf, to deliver it to them and to run the Service, and we handle it as this policy describes. For questions about how the business uses your information, contact the business directly. To ask us to delete what you sent through the Service, email privacy@solosolutionsai.com.

2. Information We Collect

2.1 Professional Account Information

When a professional creates an account, we collect: full name, email address, business name, office city and state, phone number, profession/vertical, service areas or specialties, and optional business logo. Professionals may also configure: AI assistant name, client greeting, disclaimers (English and Spanish), intake questions, and scheduling preferences.

2.2 Client Intake Information

Information submitted by clients through AI-powered chat conversations includes: full name, email address, phone number (optional; clients may decline), city and state, primary concern or reason for inquiry, desired outcome, contact preference, and responses to business-specific intake questions configured by the professional.

2.3 Conversation Transcripts

Full transcripts of conversations with the AI receptionist on your website are stored and shown to the business in its portal. Transcripts include every message exchanged between the customer and the AI receptionist.

2.4 Uploaded Documents

When a client uploads documents at the request of their professional, we collect the document files, file names, file types, and file sizes. Documents may include records, correspondence, identification, or other materials relevant to the client's matter. Providing documents is entirely voluntary.

2.5 Usage and Technical Data

We collect standard technical information including: IP address, browser type, device type, pages visited, time spent, referring URLs, and similar analytics data through Google Analytics 4, which runs only if you accept analytics cookies. This data is used to improve the Service and is not linked to individual client intake records.

3. Sensitive Information We Try to Keep Out

The AI receptionist checks each message for the following kinds of sensitive information and tries to keep them out of what we store:

Social Security Numbers: removed when recognised
Credit and debit card numbers: removed when recognised
Bank account and routing numbers: removed when recognised
Passport, driver's license and other government ID numbers: removed when recognised

When the receptionist recognises one of these, it leaves the message out of the stored transcript and asks the customer to continue without it. Detection is automatic but pattern based, so it will not catch every format or wording, and it does not apply to documents a customer uploads. Businesses must not ask their customers for this information through the Service.

4. How We Use Your Information

We use collected information to:

Provide, operate, and maintain the Service
Process client intake submissions and deliver them to the appropriate professional
Generate AI-powered intake summaries, context notes, and intelligence briefs
Analyze uploaded documents using AI to produce structured summaries for the professional
Send email notifications about new intake submissions to professionals and confirmation emails to clients
Build the professional's website and generate AI-powered marketing content (social posts, ad images, blog posts), intelligence briefs and AI team replies at the professional's request
Sync intake data to third-party services (HubSpot, Zapier, webhooks) when configured by the professional
Provide appointment scheduling functionality via Calendly integration
Monitor platform health and performance via internal analytics
Improve and personalize the Service
Respond to support requests

5. Third-Party Integrations and Data Sharing

We use the service providers listed below to run the Service, and we share data with integrations only when the professional explicitly configures them. We do not sell, rent, or share client data with third parties for their own marketing purposes.

5.1 HubSpot CRM

When a professional connects their HubSpot account via OAuth, completed intake data (client name, email, phone, location, primary concern, desired outcome, contact preference, and AI context summary) is automatically sent to HubSpot to create or update a contact record. Data flows one way: from SoloBusinessAI to HubSpot. The professional's HubSpot account is governed by HubSpot's own privacy policy and terms.

5.2 Webhooks (Zapier, Make, Custom Endpoints)

Professionals may configure webhook URLs that receive intake data when a client completes an intake. The data payload includes: client name, email, phone, location, primary concern, desired outcome, contact preference, intake source, and vertical. Webhook payloads are signed with HMAC-SHA256 when a signing secret is configured. The professional is solely responsible for the security and privacy practices of their webhook endpoints and connected services.

5.3 Calendly

When a professional connects Calendly, we store OAuth tokens to facilitate appointment invite emails. We do not access or store Calendly appointment data beyond the scheduling URL and event type.

5.4 AI Processing Services

We use Anthropic (Claude Sonnet 4.6 and Claude Haiku 4.5) for the AI receptionist, context summaries, intelligence briefs, document analysis, website and blog writing, the AI team, and support assistance. We use OpenAI (gpt-image-2 for images, and gpt-4o-mini and gpt-4o for some writing tasks and for analysing inspiration images you upload) for marketing content and AI-generated images. Neither provider uses your data to train their models. Data may be retained briefly by the provider for abuse monitoring in line with their standard API terms, and is not used for any other purpose. We may move to newer models from the same providers as they are released.

5.5 Email Services

Transactional emails (new-customer notifications, customer confirmations, document requests, billing notices) are sent through Resend, which keeps delivery records and message content for a limited period under its own retention policy.

5.6 Analytics

We use Google Analytics 4 on our marketing website and in the app to understand how they are used. It runs only if you accept analytics cookies in the cookie banner; until then, analytics storage stays off. Analytics data is pseudonymous (it uses a random identifier, not your name) and is not linked to individual client intake records. We do not use advertising cookies, and the business websites we host do not load analytics or advertising cookies. We do not respond to browser Do Not Track signals; analytics runs only if you accept analytics cookies.

5.8 Payment Processing

Subscription billing is processed through Stripe. We do not store credit card numbers, bank account details, or other payment instrument data on our servers. Stripe handles all payment data under PCI DSS Level 1 compliance. We store only the Stripe customer ID, subscription status, plan tier, and billing period dates. For Stripe's privacy practices see stripe.com/privacy.

5.9 Social Media Publishing

The Service writes social posts for you to copy and post yourself; it does not connect to or post from your social media accounts. We publish posts to SoloBusinessAI's own Facebook and Instagram pages for our own marketing. No customer data is used in those posts.

5.10 Embeddable Widget and AI-Generated Websites

Professionals may embed a chat widget on their own website, and may generate a business website hosted by us on a solobusinessai.com subdomain or a connected custom domain. The widget loads an iframe from app.solosolutionsai.com and collects only what the client provides during the intake conversation. It does not use tracking cookies, fingerprinting, or cross-site tracking on the professional's website. Generated websites publicly display only the business information the professional provides; no client intake data is displayed publicly.

5.11 Infrastructure and Monitoring

The platform runs on Supabase (database, authentication, storage and serverless functions, hosted on AWS in the United States) and Vercel (web hosting and delivery). We use Upstash for rate limiting, which processes request metadata such as IP addresses. We use Sentry for error monitoring in the app: when an error occurs, Sentry receives diagnostic information including IP address and browser and device details, and a replay of the browser session in which the error occurred. Replays mask text and form inputs by default. These providers process data on our behalf as service providers.

5.12 Search and Website Reading

To write intelligence briefs we send Brave Search queries built from your business profile and research topics (such as your trade and location). When you give us the address of an existing website at sign-up, we use Jina AI Reader to fetch the public text of that page so the AI can learn about your business. Neither receives your customers' information.

6. Data Security

We implement robust technical and organizational security measures to protect your information:

All data is encrypted in transit using TLS 1.2+ and at rest using AES-256 encryption
Database access is governed by Row Level Security (RLS) policies, so professionals can only access their own data
Client document storage uses private, encrypted buckets with access-controlled policies
We do not read your customers' conversations or documents in the normal course of running the Service; processing is automated. Our staff may access specific records only when you ask us to for support, when needed to keep the Service secure or fix a fault, or when the law requires it.
API rate limiting is enforced to prevent abuse
Cross-origin request handling is applied to platform endpoints; embeddable and public endpoints accept requests from any origin by design, because they are intended to run on our customers' own websites
Integration tokens (HubSpot, Calendly) are stored in our database and protected by encryption at rest and strict row-level access controls

7. Data Retention

Professional accounts: Account information is retained for as long as your account is active. You may request account deletion at any time.

Client intake records: Intake submissions, conversation transcripts, and AI-generated summaries are retained for as long as the professional's account is active. Professionals can archive intake records in their admin portal. To have intake records permanently deleted, contact privacy@solosolutionsai.com.

Uploaded documents: Client-uploaded documents and their AI-generated summaries are retained for as long as the professional's account is active. The Service is designed as a pass-through service rather than a permanent document repository, so you are responsible for downloading and retaining your own copies of anything you need. To have documents permanently deleted, contact privacy@solosolutionsai.com.

Saved ad images: Ad images you save in the Marketing Kit are deleted automatically 14 days after you save them, so download any you want to keep.

AI team messages and system logs: Messages you send to your AI team are stored so the team can remember your business. We periodically summarise them into notes the team keeps while your account is active, and we aim to delete the original messages about 90 days after they have been summarised. Most operational logs of AI activity and system events are deleted automatically after 30 to 60 days.

Integration data: OAuth tokens for connected services (HubSpot, Calendly) are retained until the professional disconnects the integration. Data that has been synced to third-party services is governed by those services' retention policies.

Right to deletion: Clients and professionals may request deletion of their data, including intake records and uploaded documents, at any time by contacting privacy@solosolutionsai.com. Upon receiving a valid request we will delete the relevant data from our systems within 30 days. Note: data already synced to third-party services (HubSpot, webhooks) must be deleted by the professional from those services directly.

8. Profession-Specific Considerations

We serve professionals across multiple regulated and unregulated industries. The following considerations apply:

8.1 Legal Professionals

SoloBusinessAI is a software tool only. Use of the Service does not create an attorney-client relationship. Attorneys are responsible for ensuring their use of the platform complies with applicable rules of professional conduct, ethics rules, and client confidentiality requirements in their jurisdiction. Data retention requirements vary by state bar, so attorneys should download and retain intake records according to their jurisdictional requirements.

8.2 Mental Health Professionals

The Service is designed for initial client onboarding and lead capture, not for clinical documentation, treatment planning, or session notes. The AI intake conversation does not constitute a therapeutic session. Therapists and counselors are responsible for ensuring their use of the platform complies with applicable licensing board requirements and client confidentiality obligations. The Service is not intended to be HIPAA-compliant and should not be used to collect protected health information (PHI) as defined by HIPAA. We do not sign Business Associate Agreements.

8.3 Social Workers

Social workers using the Service should ensure compliance with the NASW Code of Ethics regarding client confidentiality and informed consent. The Service supports initial intake and inquiry capture; it is not a case management system.

8.4 Healthcare Professionals

The Service captures initial client information for onboarding purposes. It is not an electronic health records (EHR) system and should not be used to store medical records, diagnoses, or treatment plans. AI-generated intelligence briefs are informational tools and do not constitute medical advice.

8.5 Financial Professionals

Accountants and insurance professionals are responsible for complying with the financial privacy rules that apply to them. Our automatic detection is designed to keep financial account numbers, Social Security Numbers and similar identifiers out of receptionist conversations, but it is not perfect, so do not request them through the Service.

8.6 All Professions

Regardless of profession, all professionals using SoloBusinessAI are solely responsible for ensuring their use of the platform complies with applicable laws, regulations, professional standards, and ethical codes in their jurisdiction. SoloBusinessAI provides a technology platform; it does not provide legal, medical, financial, or professional advice of any kind.

9. Your Rights

Depending on your location, you may have the following rights:

Access: Request a copy of the personal information we hold about you
Correction: Request correction of inaccurate information
Deletion: Request deletion of your personal information
Portability: Request your data in a structured, machine-readable format
Objection: Object to processing of your information for certain purposes
Restriction: Request that we limit how we use your information
Withdrawal of consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at privacy@solosolutionsai.com. We will respond within 30 days.

10. US State Privacy Laws

We comply with applicable US state privacy laws, including:

California (CCPA/CPRA): California residents have the right to know what personal information is collected, request deletion, and opt out of the sale of personal information. We do not sell personal information.
Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA): Residents of these states have similar rights to access, correction, deletion, and portability of their personal information.

We do not sell, share for cross-context behavioral advertising, or use personal information for profiling in furtherance of decisions that produce legal or similarly significant effects.

11. International Users and Data Transfers

All data is currently stored and processed in the United States (AWS US-East-1 region via Supabase). SPD Digital Consulting LLC, the operator of the Service, is based in Wildwood, Florida, United States.

11.1 United Kingdom

For users in the United Kingdom, personal data is transferred to and processed in the United States. We do not currently rely on an adequacy decision or certification framework for these transfers. We process personal data based on: (a) contractual necessity, to provide the Service you have requested; (b) legitimate interests, to operate, maintain, and improve our platform; or (c) your explicit consent.

Your rights under UK GDPR include: access, rectification, erasure, restriction of processing, data portability, objection to processing, and the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11.2 European Economic Area

For users in the EEA, personal data is transferred to and processed in the United States on the same basis described in Section 11.1. We do not currently rely on an adequacy decision or certification framework for these transfers. You have the right to lodge a complaint with your local data protection authority. The same lawful bases and data subject rights described in Section 11.1 apply.

11.3 Data Residency

All data is currently stored in the United States. We are evaluating regional data residency options (including UK-based storage) for future availability. If you have specific data residency requirements, please contact us at privacy@solosolutionsai.com.

By using the Service, you acknowledge and consent to the transfer and processing of your information in the United States in accordance with this Privacy Policy.

12. Children's Privacy

The Service is not intended for individuals under 18 years of age, and businesses must not use the AI receptionist or any other feature to collect information from children under 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us immediately at privacy@solosolutionsai.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered professionals of material changes by email and by posting the updated policy on this page with a revised "Last Updated" date. Continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy, wish to exercise your rights, or have concerns about our data practices, please contact us at:

Email: privacy@solosolutionsai.com

SPD Digital Consulting LLC Wildwood, Florida, United States