Privacy Policy

2. How we use information

We process personal information only for legitimate business purposes:

• Operating, maintaining, and delivering our AI front desk and appointment booking infrastructure.
• Qualifying inbound inquiries and synchronizing appointment details directly with client calendars and CRM platforms.
• Processing payments, invoicing, and tax collection via our payment partners.
• Preventing fraudulent use, security incidents, and unauthorized system access.
• Complying with statutory, regulatory, and tax obligations across our operating jurisdictions.

No model training on customer data: We do not use client communications, call audio, transcripts, or end-customer records to train, retrain, or improve generalized public AI models, ours or any third party's, without explicit written consent.

3. Calls, messaging, and consent disclosures

The Service places, receives, and processes live phone calls, SMS, and messaging conversations. Where applicable by law, callers are informed at the start of the interaction that the conversation is handled by an automated AI front desk and may be recorded and transcribed.

Detailed rules governing recording consent, call concurrency, all-party consent states, TCPA compliance, and carrier messaging standards are set out in Section 9 and Section 10 of our Terms of Service and our AI Disclosure Statement.

4. Information sharing and sub-processors

We share personal data only with vetted third-party vendors who perform services on our behalf, including telephony carriers, speech synthesis providers, cloud hosting, calendar integrations, and payment processors.

Every vendor is contractually bound to confidentiality and data protection obligations under our Data Processing Agreement. The complete list of approved sub-processors is maintained in Annex 1 of our Data Processing Agreement.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

5. Data retention

We retain personal information only as long as necessary to fulfill the purposes outlined in this policy or as instructed by the client:

• Call audio and transcripts: Retained for a default period of 6 months, unless the client specifies a shorter or longer period, or selects our zero-data-retention configuration which purges call content immediately after CRM synchronization.
• Client account data: Retained for the active duration of the subscription plus 90 days following account closure.
• Financial and billing records: Retained for 7 years to satisfy standard statutory tax and accounting regulations.

6. Security measures and breach response

We employ industry-standard administrative, physical, and technical safeguards to protect personal data against unauthorized access, loss, or alteration. All data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256. Details on our technical and organizational measures are available in Annex 2 of our DPA.

In the event of a confirmed personal data breach affecting client records, we notify affected clients without undue delay and within 72 hours of becoming aware, in alignment with GDPR Article 33.

7. International data transfers

Our infrastructure is hosted in secure data centers located in the United States. For clients located in the United Kingdom, Canada, Australia, Ireland, or South Africa, transfers of personal data outside their jurisdiction are governed by approved transfer mechanisms, including the UK International Data Transfer Addendum and applicable adequacy arrangements.

8. California privacy rights (CCPA / CPRA)

This section applies solely to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

• Categories collected: Identifiers (name, email, phone number, IP address), commercial transaction records, communications audio and transcripts, and internet activity records.
• No sale or sharing: Zero Headache does not sell personal information and does not share personal information for cross-context behavioral advertising. We have not sold or shared personal information in the preceding 12 months.
• Right to know and access: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to delete: You have the right to request the deletion of personal information we have collected from you, subject to legal exceptions.
• Right to correct: You have the right to request the correction of inaccurate personal information.
• Right to non-discrimination: We will not discriminate against you in price, service level, or quality for exercising your statutory privacy rights.

To submit a California privacy request, contact us at legal@zeroheadache.co. We respond to verifiable consumer requests within 45 days.

9. United Kingdom and Ireland privacy rights (UK GDPR)

If you reside in the United Kingdom or Ireland, you hold specific data protection rights under the UK Data Protection Act 2018 and the Data Protection Act 2018 (Ireland):

• Right of access: Obtain confirmation whether your data is being processed and receive a copy of your personal data.
• Right to rectification: Request correction of inaccurate or incomplete records.
• Right to erasure ("right to be forgotten"): Request erasure of your personal data where retention is no longer legally justified.
• Right to restriction: Request restriction of processing under certain statutory conditions.
• Right to data portability: Receive your data in a structured, commonly used, and machine-readable format.
• Right to object: Object to processing based on legitimate interests or for direct marketing.
• Right to lodge a complaint: Lodge a complaint with the UK Information Commissioner's Office (ICO) or the Irish Data Protection Commission (DPC).

UK and Irish residents may submit inquiries or exercise rights by emailing legal@zeroheadache.co.

10. Canada, Australia, and South Africa privacy notices

Canada: We process personal data in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation. You have the right to access and challenge the accuracy of your personal data held by us.

Australia: We manage personal information in accordance with the Australian Privacy Principles (APPs) established under the Privacy Act 1988 (Cth). Australian individuals may request access to their personal information or lodge a complaint by contacting our privacy contact.

South Africa: We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA). South African data subjects have the right to request access to, correction of, or deletion of their personal information. Complaints may be lodged with the Information Regulator of South Africa. Contact legal@zeroheadache.co to exercise your rights.

11. Children's privacy

The Service is strictly intended for commercial business use and is not directed toward children. We do not knowingly collect personal data from individuals under 16 years of age (or under 13 in the United States under COPPA). If we learn that we have inadvertently received personal information from a minor, we will promptly delete such records.

12. Policy updates and contact

We may revise this Privacy Policy periodically to reflect operational, legal, or regulatory updates. When changes are made, the revised date at the top of this page will be updated.

For privacy inquiries, rights requests, or data protection questions, contact us at:

legal@zeroheadache.co